WO2017054705A1 - 一种局域网内基于物理位置的终端监控方法及系统 - Google Patents

一种局域网内基于物理位置的终端监控方法及系统 Download PDF

Info

Publication number
WO2017054705A1
WO2017054705A1 PCT/CN2016/100362 CN2016100362W WO2017054705A1 WO 2017054705 A1 WO2017054705 A1 WO 2017054705A1 CN 2016100362 W CN2016100362 W CN 2016100362W WO 2017054705 A1 WO2017054705 A1 WO 2017054705A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
monitoring
location
information point
association
Prior art date
Application number
PCT/CN2016/100362
Other languages
English (en)
French (fr)
Inventor
张巨世
张聪
Original Assignee
北京奇虎科技有限公司
奇智软件（北京）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京奇虎科技有限公司, 奇智软件（北京）有限公司 filed Critical 北京奇虎科技有限公司
Publication of WO2017054705A1 publication Critical patent/WO2017054705A1/zh

Links

Images

Definitions

  • the present invention relates to terminal security management and control technology, and in particular to a physical location based terminal monitoring method and system in a local area network.
  • the existing operation interfaces that can be displayed in the system for controlling the terminal are all in the form of a list, and the basic information such as the ID, user name, and usage status of each terminal in the local area network can be displayed in the list for the administrator. Monitor terminals inside the LAN.
  • the information in the list is often complicated and professional. Therefore, most existing systems for controlling terminals need more professional administrators to operate, which puts higher requirements on internal terminal management and control.
  • the main purpose of the embodiments of the present invention is to provide a method and system for monitoring a terminal based on a physical location in a local area network, so as to make the management and control of the intranet terminal of the enterprise simpler and more intuitive, thereby reducing the threshold of the internal network terminal management and control of the enterprise.
  • an embodiment of the present invention provides a physical location-based terminal monitoring method in a local area network, where the terminal monitoring method includes: creating a monitoring physical layer according to a physical location structure map, and defining a corresponding physical layer in the monitoring physical layer The information point; establishes the association relationship between the terminal and the information point; when the terminal triggers the event, the trigger event is displayed in the position of the corresponding information point in the monitoring physical layer.
  • the embodiment of the present invention further provides a physical location-based terminal monitoring system in a local area network
  • the terminal monitoring system includes: an information point definition unit, configured to create a monitoring physical layer according to the physical location structure map, and define and monitor the physical layer in the monitoring physical layer The information point corresponding to the terminal; the association relationship establishing unit is configured to establish an association relationship between the terminal and the information point; and the trigger event display unit is configured to display the trigger event in the monitoring physical layer when the trigger event occurs The location of the point.
  • Embodiments of the present invention also provide a program comprising readable code that, when executed on a computing device, causes the computing device to perform a local area network based on any of the embodiments of the present invention Terminal monitoring method for physical location.
  • An embodiment of the present invention further provides a readable medium, where the storage is as described in the embodiment of the present invention. program of.
  • the beneficial effect of the embodiment of the present invention is that a physical layer based on a physical location structure map is used as an interface for monitoring an intranet terminal of the enterprise, and various events that may occur in the terminal are displayed in real time on the physical layer, so that the enterprise is
  • the monitoring process carried out by the intranet terminal is more visual and simplistic, and is suitable for monitoring the intranet of different users in the intranet of the enterprise, thereby lowering the threshold of the professional background of the relevant staff, so that the intranet terminal of the enterprise is Monitoring tends to be administratively involved, which can improve the user experience and facilitate the application and promotion of the monitoring method.
  • FIG. 1 is a flowchart (1) of a physical location based terminal monitoring method in a local area network according to an embodiment of the present invention
  • FIG. 2 is a schematic diagram of an internal structure of an enterprise according to an embodiment of the present invention.
  • FIG. 3 is a flowchart (2) of a method for monitoring a terminal based on a physical location in a local area network according to an embodiment of the present invention
  • FIG. 4 is a schematic structural diagram of a physical location based terminal monitoring system in a local area network according to an embodiment of the present invention (1);
  • FIG. 5 is a schematic structural diagram (1) of an association relationship establishing unit 200 according to an embodiment of the present invention.
  • FIG. 6 is a schematic structural diagram (2) of an association relationship establishing unit 200 according to an embodiment of the present invention.
  • FIG. 7 is a schematic structural diagram (3) of an association relationship establishing unit 200 according to an embodiment of the present invention.
  • FIG. 8 is a schematic structural diagram of a physical location based terminal monitoring system in a local area network according to an embodiment of the present invention (2);
  • FIG. 9 shows a block diagram of a computing device for performing a physical location based terminal monitoring method within a local area network in accordance with the present invention.
  • Fig. 10 shows a storage unit for holding or carrying program code implementing a physical location based terminal monitoring method in a local area network according to the present invention.
  • Embodiments of the present invention provide a method and system for monitoring a terminal based on a physical location in a local area network. The invention will be described in detail below with reference to the accompanying drawings.
  • the embodiment of the invention provides a method for monitoring a terminal based on a physical location in a local area network.
  • the terminal monitoring method mainly includes the following steps:
  • S101 Create a monitoring physical layer according to the physical location structure diagram, and define an information point corresponding to the terminal in the monitoring physical layer;
  • S102 Establish an association relationship between the terminal and the information point.
  • S103 Determine whether the trigger event occurs in the terminal.
  • the trigger event is displayed on the location of the corresponding information point in the monitoring physical layer.
  • a physical layer based on the physical location structure map is used as an interface for monitoring the intranet terminal of the enterprise, and various events that may occur in the terminal are displayed in real time on the physical layer, so that the intra-enterprise is
  • the monitoring process carried out by the network terminal is more visual and simplistic, and is suitable for monitoring the intranet of different users in the intranet, reducing the threshold of the professional background of the relevant staff, and monitoring the intranet terminal of the enterprise. It tends to be administratively involved, which can also improve the user experience and facilitate the application and promotion of the monitoring method.
  • the monitoring physical layer is created according to the physical location structure diagram, and the information point corresponding to the terminal is defined in the monitoring physical layer.
  • the terminal monitoring method in the embodiment of the present invention is based on the physical location information inside the enterprise, and implements a method for monitoring the intranet terminal on the monitoring physical layer based on the physical location structure map. Therefore, it is first necessary to import the internal structure diagram of each floor in the enterprise as a basic template. As shown in FIG. 2, the figure shows a plan view of the internal structure of a certain floor in the enterprise, and only illustrates the style of the plan view. In an actual application, the imported internal structure drawing may be a drawing file drawn by a drawing tool such as AutoCad, and the present invention is not limited thereto. Moreover, FIG.
  • the internal structure map can also match different vertical heights for different office equipment (eg, terminal, office seat, etc.).
  • office equipment eg, terminal, office seat, etc.
  • To form a layout view with a stereo effect e.g., terminal, office seat, etc.
  • a two-dimensional floor plan of multiple floors or a layout view with a stereo effect can be superimposed to form an entire office environment of the enterprise (for example, an office building or a multi-story office).
  • the floor is superimposed as a whole three-dimensional model perspective view.
  • the monitoring physical layer based on the internal structure diagram can be created on the management side (server side) according to the internal structure diagram, and the information point corresponding to the terminal is defined in the monitoring physical layer.
  • the information points include, but are not limited to, an area information point, an office building information point, a terminal information point, an enterprise service information point, an application information point, and a network device information point.
  • step S102 is performed to establish an association relationship between the terminal and the information point.
  • terminal refers to a series of physical devices such as various types of devices, mobile terminals, and interfaces connected to the local area network.
  • the process of establishing an association between a terminal and an information point mainly includes two ways: one is to establish an association through an agent; the other is to directly establish an association without a client.
  • the first is to establish an association through the client.
  • the premise of establishing the association between the terminal and the information point by using this method is that a corresponding application (application) is pre-installed on the intranet terminal of the enterprise, and the application can be used by the user.
  • the display device of the terminal device presents the user with a physical layer that is consistent with the monitoring physical layer.
  • the user can click on the location corresponding to his workstation (specific floor, workstation, etc.) in the physical layer, and input the basic information of the user after clicking, including: user name, position, department Wait.
  • the application obtains the basic information of the user through the physical layer
  • the basic information of the user and the terminal information used by the user can be simultaneously uploaded to the management server through the intranet, and the basic information of the user and The terminal information used by the terminal is updated to the monitoring physical layer at the same time, and the corresponding relationship between the terminal of the user and the information point is established.
  • the above is a process of establishing a relationship between a terminal and an information point for a user. For each employee in the enterprise, the association between the monitoring physical layer and the user terminal can be established through the above process, thereby implementing the control terminal and the Initialization of associations between terminals.
  • the main difference between the manner in which the clientless association is directly established and the manner in which the client is associated with the client is that the user does not require the application to be installed in the terminal of the user, but the terminal used by the user.
  • Connected network communication devices such as switches, etc.
  • the traffic is monitored by collecting statistics on the traffic used by the application in the user terminal, for example, by the browser, thereby generating traffic statistics, and transmitting the traffic statistics to the management server through the intranet, and the server is controlled.
  • the management server receives the webpage information of the current webpage of the browser of the user terminal, analyzes the webpage information, obtains a web application label corresponding to the user, and matches the web application label and the preset web application mapping table.
  • the physical layer that is consistent with the monitoring physical layer is pushed to the browser of the user terminal.
  • the physical layer can be pushed by pushing a web page into a browser of the user terminal.
  • the user can select the location of the workstation in the physical layer (the specific floor, workstation, etc.) in the physical layer displayed on the web page, and input the basic information of the user after clicking. , including: user name, position, department, etc.
  • the basic information of the user and the terminal information used by the user can be simultaneously uploaded to the management server through the intranet, and the basic information of the user and the used information thereof are used.
  • the terminal information is simultaneously updated to the monitoring physical layer. At this time, the corresponding relationship between the terminal of the user and the information point is established.
  • the location of the user terminal may be determined according to whether the port information of the network communication device to which the user terminal is connected changes. Changed.
  • the process of determining whether the location of the user terminal is changed in the embodiment of the present invention is described in detail by using the switch as the above-mentioned network communication device.
  • the present invention is not limited thereto. Specifically, the port numbers of the user terminals and the switches to which they are connected can be obtained, and a reference list (terminal and switch port correspondence list) is generated, and the correspondence between the number of ports of each user terminal and the switch to which it is connected is recorded.
  • the management server receives the webpage information of the current webpage of the browser of the user terminal, analyzes the webpage information, obtains a web application label corresponding to the user, and matches the web application label and the pre-
  • the network application mapping table is set to push the physical layer that is consistent with the monitoring physical layer to the browser of the user terminal. Specifically, the physical layer can be pushed by pushing a web page into a browser of the user terminal.
  • the user can select the location of the workstation in the physical layer (the specific floor, workstation, etc.) in the physical layer displayed on the web page, and input the basic information of the user after clicking. , including: user name, position, department, etc.
  • the basic information of the user and the terminal information used by the user can be simultaneously uploaded to the management server through the intranet, and the basic information of the user and the used information thereof are used.
  • the terminal information is simultaneously updated to the monitoring physical layer. At this time, the corresponding relationship between the terminal of the user and the information point is established, and the corresponding update of the location change of the user terminal is implemented.
  • the above is a process of establishing a relationship between a terminal and an information point for a user, for the enterprise
  • Each employee in the above process can establish an association between the monitoring physical layer and the user terminal through the above process, thereby realizing the initialization of the association relationship between the management terminal and the terminal.
  • step S103 is performed to determine whether the terminal has a trigger event.
  • the trigger event is displayed in the monitoring. The location of the corresponding information point in the physical layer.
  • the terminal management and control method of the embodiment of the present invention can be used to implement control and control of data leakage prevention and execution security policies of an intranet terminal of an enterprise.
  • real-time monitoring of various operations of various information points in the intranet such as: user login/logout, access network, outreach network, access to external devices, etc., wherein, for each information in the intranet
  • the trigger events of the key monitoring are shown in Table 1.
  • an information point corresponding to the terminal in which the trigger event occurs is highlighted on the monitoring physical layer.
  • it may be displayed in a form of a highlighted form, a flashing form, an enlarged form, a separate pop-up form, or the like, which can highlight the physical position of the information point, and the present invention is not limited thereto.
  • the administrator of the control terminal can more easily and intuitively understand the location where the trigger event occurs.
  • the basic information of the user at the location and the operations performed by the triggered event may also be simultaneously displayed at the location.
  • triggering events described in the foregoing Table 1 are only examples.
  • the events that can be detected by the physical location-based terminal monitoring method in the local area network according to the embodiment of the present invention are not limited to the triggers listed in Table 1.
  • Events can also include operational events and related operations in various types of intranets.
  • the physical location-based terminal monitoring method in the local area network of the embodiment of the present invention uses the physical layer layer based on the physical location structure map as an interface for monitoring the intranet terminal of the enterprise, and displays various types of terminals that may occur in the physical layer on the physical layer. Events, making the monitoring process for intranet terminals more Visualization and simplification, suitable for different users in the intranet to monitor the intranet, reduce the threshold of the professional background of the relevant staff, and make the monitoring of the intranet terminal tend to be administratively involved. It can improve the user experience and facilitate the application and promotion of the monitoring method.
  • the terminal monitoring method in the embodiment of the present invention is not limited to the above-mentioned trigger event display prompt.
  • the trigger may be further displayed for the trigger.
  • the specific countermeasure of the event is as shown in FIG. 3, step S104: displaying the countermeasure for the trigger event at the position of the information point corresponding to the terminal where the trigger event occurs; receiving the user's selection, and performing corresponding response according to the user's selection. Measures.
  • the word “recommendation” can be given for the best response plan to prompt the administrator to select the best response for this type of event; when it is detected that a terminal has “violation access” behavior, it may occur
  • the risk of an unidentified program attack or virus infection inside the enterprise may indicate whether to perform the isolation and disconnection measures for the event, or may indicate whether to perform the shutdown or other operations, but may be given for the best response plan. "Recommended” to remind administrators of the best possible response to this type of event.
  • the display of the countermeasures may be displayed to the manager through a pop-up window, a drop-down menu, etc., and the invention is not limited thereto.
  • the terminal that generates the trigger event can perform corresponding operations such as isolation, network disconnection, shutdown, etc., and timely handle the trigger event to prevent further spread of the harm caused by the trigger event.
  • the physical location-based terminal monitoring method in the local area network of the embodiment of the present invention can not only display the terminal that generates the trigger event to the administrator with a visual effect, but also can intuitively give the trigger event for various types. Choose the appropriate response and perform the appropriate actions based on the administrator's choice. It can be seen that the above-mentioned physical location-based terminal monitoring method in the local area network can better meet the needs of different users in the enterprise intranet, lower the threshold of the professional background of the management personnel, and make the management and control of the intranet terminal tend to be administratively involved. Therefore, the user experience can also be improved, which is beneficial to the promotion of the terminal monitoring method.
  • the embodiment of the present invention further provides a physical location-based terminal monitoring system in a local area network.
  • the physical location-based terminal monitoring method in the local area network mainly includes: an information point definition unit 100, an association relationship establishing unit 200, and a trigger.
  • the information point definition unit 100 is configured to create a monitoring physical layer according to the physical location structure map, and define an information point corresponding to the terminal in the monitoring physical layer;
  • the association relationship establishing unit 200 is configured to establish the terminal and the information point. Association relationship;
  • trigger event display unit 300 is used to determine the end Whether a trigger event occurs on the terminal. When a trigger event occurs on the terminal, the trigger event is displayed on the location of the corresponding information point in the monitored physical layer.
  • a physical layer based on the physical location structure map is used as an interface for monitoring the intranet terminal of the enterprise, and various events that may occur in the terminal are displayed in real time on the physical layer.
  • the monitoring process for the intranet terminal of the enterprise is more visualized and simplified, and is suitable for monitoring the intranet of different users in the intranet, thereby lowering the threshold of the professional background of the relevant staff, and making the enterprise.
  • the monitoring of the intranet terminal tends to be administratively involved, which can improve the user experience and facilitate the application and promotion of the monitoring method.
  • the information point definition unit 100 is configured to create a monitoring physical layer according to the physical location structure map, and define an information point corresponding to the terminal in the monitoring physical layer.
  • the terminal monitoring system in the embodiment of the present invention is based on physical location information inside the enterprise, and implements monitoring of the intranet terminal on the monitoring physical layer based on the physical location structure map. Therefore, it is first necessary to import the internal structure plan of each floor in the company as a basic template. As shown in FIG. 2, the figure shows a plan view of the internal structure of a certain floor in the enterprise, and only illustrates the style of the plan view. In an actual application, the imported internal structure drawing may be a drawing file drawn by a drawing tool such as AutoCad, and the present invention is not limited thereto. Moreover, FIG.
  • the internal structure map can also match different vertical heights for different office equipment (eg, terminal, office seat, etc.).
  • office equipment eg, terminal, office seat, etc.
  • To form a layout view with a stereo effect e.g., terminal, office seat, etc.
  • a two-dimensional floor plan of multiple floors or a layout view with a stereo effect can be superimposed to form an entire office environment of the enterprise (for example, an office building or a multi-story office).
  • the floor is superimposed as a whole three-dimensional model perspective view.
  • the monitoring physical layer based on the internal structure diagram can be created on the management side (server side) according to the internal structure diagram, and the information point corresponding to the terminal is defined in the monitoring physical layer.
  • the information points include, but are not limited to, an area information point, an office building information point, a terminal information point, an enterprise service information point, an application information point, and a network device information point.
  • the terminal described here refers to various types of devices connected to the local area network that the user actually uses, and A series of physical devices such as mobile terminals and interfaces.
  • the process of establishing an association between a terminal and an information point mainly includes two ways: one is to establish an association through an agent; the other is to directly establish an association without a client.
  • the terminal monitoring system of the embodiment of the present invention performs the foregoing manner of establishing association by the client by using the association relationship establishing unit 200 as shown in FIG. 5.
  • the association establishing unit 200 includes an operation receiving module 201 and an association establishing module 202.
  • the operation receiving module 201 is configured to receive an association operation of the user on the terminal
  • the association relationship establishing module 202 is configured to: compare the physical location of the terminal with the location of the corresponding information point in the monitoring physical layer according to the establishment of the association operation. Correspondence to establish an association.
  • the premise that the association between the terminal and the information point is established by using the client to establish an association is that a corresponding application (application) is pre-installed on the intranet terminal of the enterprise, and the application can be displayed by the terminal device used by the user.
  • the device presents the user with a physical layer that is consistent with the monitored physical layer.
  • the user can click on the location corresponding to his workstation (specific floor, workstation, etc.) in the physical layer, and input the basic information of the user after clicking, including: user name, position, department Wait.
  • the operation receiving module 201 acquires the basic information of the user through the physical layer displayed by the application, the basic information of the user and the terminal information used by the user can be simultaneously uploaded to the management server through the intranet.
  • the association relationship establishing module 202 updates the basic information of the user and the terminal information used by the user to the monitoring physical layer at the same time, and the corresponding relationship between the terminal of the user and the information point is established.
  • the above is a process of establishing a relationship between a terminal and an information point for a user. For each employee in the enterprise, the association between the monitoring physical layer and the user terminal can be established through the above process, thereby implementing the control terminal and the Initialization of associations between terminals.
  • the terminal monitoring system in the embodiment of the present invention performs the above-mentioned manner in which the clientless directly establishes association by using the association relationship establishing unit 200 as shown in FIG. 6.
  • the association relationship establishing unit 200 mainly includes: a traffic usage detecting module 203, a new access terminal determining module 204, an association request pushing module 205, an association operation receiving module 206, an association establishing module 207, and the like.
  • the traffic usage detecting module 203 is configured to detect the traffic usage of the terminal.
  • the new access terminal determining module 204 is configured to further determine whether the terminal is a new access terminal when the terminal generates traffic usage, and establish an association request pushing module 205.
  • association operation receiving module 206 is configured to receive an association operation performed by the user according to the establishment of the association request
  • association relationship establishing module 207 is configured to establish an association operation according to the association operation.
  • the physical location of the terminal corresponds to the location of the corresponding information point in the monitoring physical layer to establish an association relationship.
  • the association relationship establishing unit 200 is configured by directly establishing association between the clientless clients described above. Establish an association between the terminal and the information point.
  • the main difference between the manner in which the method is associated with the client is that the user does not require the application to be installed in the user terminal, but the traffic usage detection module 203 (in practical applications, The traffic usage of the terminal is monitored by a network communication device (such as a switch) to which the terminal used by the user is connected.
  • the traffic usage detecting module 203 monitors the traffic, and collects traffic statistics by using an application such as a browser in the user terminal to generate traffic statistics, and transmits the traffic statistics to the management through the intranet.
  • the server, the management server obtains and analyzes the traffic information included in the traffic statistics, so as to obtain the traffic usage of the user terminal.
  • the new access terminal determining module 204 determines the unique identifier of the user terminal (for example, the mac address or the mid, etc., to uniquely identify the identifier of the user terminal, the invention is not limited thereto) and the management server
  • the unique identifier in the stored list of accessed terminals determines whether the user terminal is a terminal that newly accesses the intranet of the enterprise. If the unique identifier of the user terminal is the first time, it indicates that the user terminal is a terminal that newly accesses the intranet of the enterprise. At this time, an association request is pushed to the user terminal by the establishment association request pushing module 205.
  • the association request pushing module 205 is configured to receive webpage information of a current webpage of a browser of the user terminal, analyze the webpage information, obtain a web application label corresponding to the user, and match the web application label and the preset.
  • the network application mapping table so that the physical layer that is consistent with the monitoring physical layer is pushed to the browser of the user terminal, and the association request is displayed in the physical layer.
  • the physical layer may be pushed by pushing a web page into a browser of the user terminal. The user can select the location of the workstation in the physical layer (the specific floor, workstation, etc.) in the physical layer displayed on the web page, and input the basic information of the user after clicking. , including: user name, position, department, etc.
  • the association operation receiving module 206 acquires the basic information of the user through the web page
  • the basic information of the user and the terminal information used by the user may be simultaneously uploaded to the management server through the intranet, and the module is established through the association relationship.
  • the basic information of the user and the terminal information used by the user are simultaneously updated to the monitoring physical layer, and the corresponding relationship between the terminal of the user and the information point is established.
  • the terminal monitoring system of the embodiment of the present invention performs the above-mentioned manner in which the clientless directly establishes association by using the association relationship establishing unit 200 as shown in FIG. 7.
  • the association relationship establishing unit 200 mainly includes: a location determining module 208, an association request pushing module 209, an association operation receiving module 210, an association establishing module 211, and the like.
  • the location determining module 208 is configured to determine whether the location of the terminal is changed.
  • the association request pushing module 209 is configured to: when the location of the terminal changes, push an association request to the terminal; and establish an association operation receiving module 210 to receive the user. Establishing an association operation based on establishing an association request;
  • the association relationship establishing module 211 is configured to associate the physical location of the terminal with the location of the corresponding information point in the monitoring physical layer according to the establishment association operation to establish an association relationship.
  • the location determining module 208 determines whether the location of the user terminal has changed according to whether the port information of the network communication device to which the user terminal is connected changes.
  • the process of determining whether the location of the user terminal is changed in the embodiment of the present invention is described in detail by using the switch as the above-mentioned network communication device.
  • the present invention is not limited thereto.
  • the port numbers of the user terminals and the switches to which they are connected can be obtained, and a reference list (terminal and switch port correspondence list) is generated, and the correspondence between the number of ports of each user terminal and the switch to which it is connected is recorded.
  • the association request push module 209 is configured to receive webpage information of a current webpage of a browser of the user terminal, analyze the webpage information, obtain a web application label corresponding to the user, and match the web application label and the preset.
  • the network application mapping table so that the physical layer that is consistent with the monitoring physical layer is pushed to the browser of the user terminal, and the association request is displayed in the physical layer.
  • the physical layer may be pushed by pushing a web page into a browser of the user terminal.
  • the user can select the location of the workstation in the physical layer (the specific floor, workstation, etc.) in the physical layer displayed on the web page, and input the basic information of the user after clicking. , including: user name, position, department, etc.
  • the association operation receiving module 210 acquires the basic information of the user through the web page, the basic information of the user and the terminal information used by the user may be simultaneously uploaded to the management server through the intranet, and the module is established through the association relationship.
  • the basic information of the user and the terminal information used by the user are simultaneously updated to the monitoring physical layer, and the corresponding relationship between the terminal of the user and the information point is established, and the location of the user terminal is implemented. Corresponding update of the change.
  • the above is a process of establishing a relationship between a terminal and an information point for a user. For each employee in the enterprise, the association between the monitoring physical layer and the user terminal can be established through the above process, thereby implementing the control terminal and the Initialization of associations between terminals.
  • the trigger event display unit 300 is triggered to determine whether the terminal has a trigger event.
  • the trigger event is displayed at the location of the corresponding information point in the monitored physical layer.
  • the terminal management and control system of the embodiment of the present invention can be used to implement data leakage prevention for an intranet terminal of an enterprise.
  • Control such as security and enforcement of security policies.
  • real-time monitoring of various operations of various information points in the intranet such as: user login/logout, access network, outreach network, access to external devices, etc., wherein, for each information in the intranet
  • the trigger events of the key monitoring are shown in Table 1.
  • the trigger event display unit 300 highlights the information point corresponding to the terminal on which the trigger event occurs on the monitoring physical layer. For example, it may be displayed in a form of a highlighted form, a flashing form, an enlarged form, a separate pop-up form, or the like, which can highlight the physical position of the information point, and the present invention is not limited thereto.
  • the administrator of the control terminal can more easily and intuitively understand the location where the trigger event occurs.
  • the basic information of the user at the location and the operations performed by the triggered event may also be simultaneously displayed at the location.
  • trigger events described in Table 1 are only examples.
  • the events that can be detected by the physical location-based terminal monitoring system in the local area network according to the embodiment of the present invention are not limited to the trigger events listed in Table 1. It can also include operational events and related operations in various types of intranets.
  • the physical location-based terminal monitoring system in the local area network of the embodiment of the present invention uses the physical layer layer based on the physical location structure map as an interface for monitoring the intranet terminal of the enterprise, and displays various types of terminals that may occur in the physical layer on the physical layer.
  • the event makes the monitoring process of the intranet terminal of the enterprise more visual and simple, and is suitable for monitoring the intranet of different users in the intranet, which reduces the threshold of the professional background of the relevant staff, so that The monitoring of intranet terminals tends to be administratively involved, which can improve the user experience and facilitate the application and promotion of the monitoring system.
  • the terminal monitoring system of the embodiment of the present invention is not limited to the above-mentioned trigger event display prompt.
  • the trigger event display unit 300 displays the terminal that generates the trigger event after monitoring the physical layer
  • the measure display unit 400 and the countermeasure execution unit 500 display specific countermeasures for the trigger event, and perform corresponding countermeasures according to the user's selection, as shown in FIG. 8.
  • the countermeasure display unit 400 is configured to display a countermeasure for the trigger event at the location of the information point corresponding to the terminal where the trigger event occurs; the countermeasure execution unit 500 is configured to receive the user's selection, and perform corresponding according to the user's selection. Response.
  • the countermeasure display unit 400 may prompt whether to perform the countermeasure for disconnecting the network for the event, or may also prompt Whether to perform isolation or other operations, but the word “recommendation” can be given for the best response scheme to prompt the administrator to select the best response for this type of event; when it is detected that a terminal has "violation access"
  • the display of the countermeasures may be displayed to the manager through a pop-up window, a drop-down menu, etc., and the invention is not limited thereto.
  • the countermeasure execution unit 500 can perform corresponding operations such as isolation, network disconnection, and shutdown on the terminal where the trigger event occurs, and timely process the trigger event to prevent the trigger event from being brought. The harm is further spread.
  • the physical location-based terminal monitoring system in the local area network of the embodiment of the present invention can not only display the terminal having the trigger event to the administrator with a visual effect, but also Visually give an alternative response to each type of trigger event and perform the appropriate action based on the administrator's choice. It can be seen that the above-mentioned terminal monitoring system can better meet the usage requirements of different users in the intranet, reduce the threshold of the professional background of the management personnel, and make the management and control of the intranet terminal tend to be administratively involved, thereby also improving the user. The use experience is beneficial to the promotion and application of the terminal monitoring system.
  • the description is relatively simple, and the relevant parts can be referred to the description of the method embodiment.
  • modules in the devices of the embodiments can be adaptively changed and placed in one or more devices different from the embodiment.
  • the modules or units or components of the embodiments may be combined into one module or unit or component, and further they may be divided into a plurality of sub-modules or sub-units or sub-components.
  • at least some of the elements are mutually exclusive, and all of the features disclosed in the specification, including the accompanying claims, the abstract, and the drawings, and all processes or units of any method or apparatus so disclosed may be combined in any combination.
  • Each feature disclosed in this specification may be replaced by alternative features that provide the same, equivalent or similar purpose.
  • the various component embodiments of the present invention may be implemented in hardware, or in a software module running on one or more processors, or in a combination thereof.
  • a microprocessor or digital signal processor may be used in practice to implement some or all of some or all of the components of the background operation method and apparatus of the application in accordance with embodiments of the present invention.
  • the invention can also be implemented as a device or device program (e.g., a computer program and a computer program product) for performing some or all of the methods described herein.
  • a program implementing the invention may be stored on a computer readable medium or may be in the form of one or more signals.
  • Such signals may be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.
  • FIG. 9 illustrates a computing device that can implement a physical location based terminal monitoring method within a local area network in accordance with the present invention.
  • the computing device conventionally includes a processor 910 and a program product or readable medium in the form of a memory 920.
  • Memory 920 can be an electronic memory such as a flash memory, EEPROM (Electrically Erasable Programmable Read Only Memory), EPROM, or ROM.
  • Memory 920 has a memory space 930 for program code 931 for performing any of the method steps described above.
  • storage space 930 for program code may include various program code 931 for implementing various steps in the above methods, respectively.
  • These program codes can be read from or written to one or more program products.
  • These program products include program code carriers such as memory cards.
  • Such a program product is typically a portable or fixed storage unit as described with reference to FIG.
  • the storage unit may have storage segments, storage spaces, and the like that are similarly arranged to memory 920 in the computing device of FIG.
  • the program code can be compressed, for example, in an appropriate form.
  • the storage unit includes readable code 931', ie, code that can be read by a processor, such as 910, which, when executed by a computing device, causes the computing device to perform various steps in the methods described above. .

Landscapes

  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)

Abstract

一种局域网内基于物理位置的终端监控方法及系统，该终端监控方法包括：根据物理位置结构图创建监控物理图层，在监控物理图层中定义与终端相对应的信息点；建立终端与信息点的关联关系；当终端发生触发事件时，将触发事件显示在监控物理图层中对应的信息点的位置。通过本发明实施例的终端监控方法及系统，在该监控物理图层上实时显示终端可能发生的各类事件，使得对企业内网终端进行的监控过程更加可视化、简单化，降低了对相关工作人员的专业背景的门槛，使得对企业内网终端的监控趋于行政化参与，可提高用户的使用体验。

Description

一种局域网内基于物理位置的终端监控方法及系统 技术领域
本发明是关于终端安全管控技术，具体地，是关于一种局域网内基于物理位置的终端监控方法及系统。
背景技术
随着企业规模的扩大，对企业内部的各个终端进行全方位的管控已成趋势。而现有的对终端进行管控的系统中所能够显示出的操作界面均为列表式，在列表中能够显示出局域网内部的各个终端的ID、用户名、使用状态等基础信息，以供管理员对局域网内部的终端进行监控。但是列表中的信息往往比较复杂，且专业性较强。因此，现有的对终端进行管控的系统大多需要较为专业的管理员来进行操作，这对企业内部终端管控提出了较高的要求。
发明内容
本发明实施例的主要目的在于提供一种局域网内基于物理位置的终端监控方法及系统，以使企业内网终端的管控更加简单、直观，从而降低企业内网终端管控的门槛。
为了实现上述目的，本发明实施例提供一种局域网内基于物理位置的终端监控方法，该终端监控方法包括：根据物理位置结构图创建监控物理图层，在监控物理图层中定义与终端相对应的信息点；建立终端与信息点的关联关系；当终端发生触发事件时，将触发事件显示在监控物理图层中对应的信息点的位置。
本发明实施例还提供一种局域网内基于物理位置的终端监控系统，该终端监控系统包括：信息点定义单元，用于根据物理位置结构图创建监控物理图层，在监控物理图层中定义与终端相对应的信息点；关联关系建立单元，用于建立终端与信息点的关联关系；触发事件显示单元，用于当终端发生触发事件时，将触发事件显示在监控物理图层中对应的信息点的位置。
本发明实施例还提供了一种程序，包括可读代码，当所述可读代码在计算设备上运行时，导致所述计算设备执行根据本发明实施例中的任一个所述的局域网内基于物理位置的终端监控方法。
本发明实施例还提供了一种可读介质，其中存储了如本发明实施例所述 的程序。
本发明实施例的有益效果在于，将一基于物理位置结构图的物理图层作为对企业内网终端进行监控的界面，在该物理图层上实时显示终端可能发生的各类事件，使得对企业内网终端进行的监控过程更加可视化、简单化，以适于企业内网中不同使用者来进行企业内网的监控，降低了对相关工作人员的专业背景的门槛，使得对企业内网终端的监控趋于行政化参与，可提高用户的使用体验，有利于该监控方法的应用及推广。
附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1为根据本发明实施例的局域网内基于物理位置的终端监控方法的流程图(一)；
图2为根据本发明实施例的企业内部结构示意图；
图3为根据本发明实施例的局域网内基于物理位置的终端监控方法的流程图(二)；
图4为根据本发明实施例的局域网内基于物理位置的终端监控系统的结构示意图(一)；
图5为根据本发明实施例的关联关系建立单元200的结构示意图(一)；
图6为根据本发明实施例的关联关系建立单元200的结构示意图(二)；
图7为根据本发明实施例的关联关系建立单元200的结构示意图(三)；
图8为根据本发明实施例的局域网内基于物理位置的终端监控系统的结构示意图(二)；
图9示出了用于执行根据本发明的局域网内基于物理位置的终端监控方法的计算设备的框图；
图10示出了用于保持或者携带实现根据本发明的局域网内基于物理位置的终端监控方法的程序代码的存储单元。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
本发明实施例提供一种局域网内基于物理位置的终端监控方法及系统。以下结合附图对本发明进行详细说明。
本发明实施例提供一种局域网内基于物理位置的终端监控方法，如图1所示，该终端监控方法主要包括以下各步骤：
S101：根据物理位置结构图创建监控物理图层，在监控物理图层中定义与终端相对应的信息点；
S102：建立终端与信息点的关联关系；
S103：判断终端是否发生触发事件，当终端发生触发事件时，将触发事件显示在监控物理图层中对应的信息点的位置。
通过上述步骤S101～步骤S103，将一基于物理位置结构图的物理图层作为对企业内网终端进行监控的界面，在该物理图层上实时显示终端可能发生的各类事件，使得对企业内网终端进行的监控过程更加可视化、简单化，以适于企业内网中不同使用者来进行企业内网的监控，降低了对相关工作人员的专业背景的门槛，使得对企业内网终端的监控趋于行政化参与，也可提高用户的使用体验，有利于该监控方法的应用及推广。
以下将结合具体实施例，对本发明实施例的局域网内基于物理位置的终端监控方法中的各个步骤进行详细的说明。
上述步骤S101，根据物理位置结构图创建监控物理图层，在监控物理图层中定义与终端相对应的信息点。本发明实施例的终端监控方法是基于企业内部的物理位置信息，并在基于物理位置结构图的监控物理图层上实现对企业内网终端进行监控的方法。因此，首先需要将企业内各个楼层的内部结构图作为基础性模板进行导入。如图2所示，该图所示出的为企业中某一楼层的内部结构平面图，仅为举例说明该平面图的样式。在实际应用中，导入的内部结构图可以通过例如是AutoCad等制图工具所绘制的绘图文件，本发明并不以此为限。并且，图2所示出的仅为其中一个楼层的二维平面布局图，在实际应用中，该内部结构图还可以针对不同的办公设备(例如终端、办公座椅等)匹配不同的纵高，从而形成一个具有立体效果的布局视图。并且，最终呈现的整体效果中，还可将多个楼层的二维平面布局图或是具有立体效果的布局视图相叠加，从而形成该企业整个办公环境(例如一栋办公大楼或是多层办公楼层相叠加)作为整体的三维立体模型透视图。
在导入了内部结构图之后，即可根据该内部结构图在管控端(服务器端)创建基于该内部结构图的监控物理图层，并在监控物理图层中定义与终端相对应的信息点。具体地，该信息点包括但不限于：区域信息点、办公楼信息点、终端信息点、企业服务信息点、应用程序信息点及网络设备信息点等。 通过定义上述各种信息点，使得监控物理图层中的各楼层信息、各类设备、终端、接口等的信息与实际物理空间中的各楼层信息、各类设备、终端、接口等的信息一一对应。在实际应用中，可以是通过在上述的内部结构图中的各楼层信息、各类设备、终端、接口等所对应的坐标信息的不同来定义其相应的信息点，并记录在管控端服务器中，以备后续的管控过程中进行调用。
然后，执行上述步骤S102，建立终端与信息点的关联关系。此处所述的终端，是指用户实际所使用的连接至局域网的各类设备、移动终端、接口等一系列物理设备。在一实施例中，上述建立终端与信息点之间的关联的过程主要包含有两种方式：一种是通过客户端(agent)建立关联；另一种是无客户端直接建立关联。
首先是通过客户端建立关联的方式，应用此种方式建立终端与信息点的关联的前提在于，在企业内网终端上预先安装有相应的应用程序(application)，该应用程序可以通过用户使用的终端设备的显示装置向用户展示与监控物理图层相一致的物理图层。用户可以在该物理图层中点选自己的工位所对应的位置(具体的楼层、工位等)，并在点选后可输入该用户的基本信息，包括：用户姓名、职位、所在部门等。在应用程序通过该物理图层获取了该用户的基本信息之后，可通过企业内网将该用户的基本信息及其所使用的终端信息同时上传至管控端服务器，并将该用户的基本信息及其所使用的终端信息同时更新至监控物理图层中，此时便建立了该用户的终端与信息点之间相对应的关联关系。以上所述为针对一名用户建立终端与信息点之间关联的过程，针对企业中的每一位员工，均可通过上述过程建立监控物理图层与用户终端的关联，从而实现对管控端与终端之间关联关系的初始化。
上述的无客户端直接建立关联的方式，与通过客户端建立关联的方式的主要区别在于，此种方式并不要求用户的终端中安装有上述的应用程序，而是通过该用户使用的终端所连接的网络通信设备(例如交换机等)来监控终端的流量使用情况。对于流量进行监控，可通过对用户终端中例如浏览器的应用程序对其所使用的流量情况进行统计，从而生成流量统计数据，将流量统计数据通过企业内网上传至管控端服务器，管控端服务器获取并分析该流量统计数据中所包含的流量信息，从而获知该用户终端的流量使用情况。当监控到某一用户终端中产生流量使用的状况时，表明该用户终端已接入企业内网。此时，进一步根据该用户终端的唯一标识(例如是mac地址或mid等用以唯一识别该用户终端的标识，本发明并不以此为限)与管控端服务器所储存的已接入的终端列表中的唯一标识来判断该用户终端是否为新接入 企业内网的终端。如果该用户终端的唯一标识为首次出现，则表明该用户终端是新接入企业内网的终端。此时，管控端服务器接收用户终端的浏览器的当前网页的网页信息，对该网页信息进行分析，获得对应于该用户的网络应用标签；匹配该网络应用标签和预置的网络应用映射表，从而将与监控物理图层一致的物理图层推送至用户终端的浏览器。具体地，可通过向用户终端的浏览器中推送一web页面的形式来推送该物理图层。用户可以在该web页面所显示的物理图层中点选自己的工位在物理图层中所对应的位置(具体的楼层、工位等)，并在点选后可输入该用户的基本信息，包括：用户名、职位、所在部门等。在web页面中获取了该用户的基本信息之后，可通过企业内网将该用户的基本信息及其所使用的终端信息同时上传至管控端服务器，并将该用户的基本信息及其所使用的终端信息同时更新至监控物理图层中，此时便建立了该用户的终端与信息点之间相对应的关联关系。
在另一实施例中，当监控到某一用户终端已接入企业内网时，还可根据该用户终端所连接至的网络通信设备的端口信息是否发生变化来判断该用户终端的位置是否发生了改变。以下将以交换机作为上述的网络通信设备为例，对本发明实施例中判断该用户终端的位置是否发生改变的过程进行详细说明，但本发明并不以此为限。具体地，可获取各用户终端及其所连接的交换机的端口编号，并生成一参照列表(终端及交换机端口对应列表)，记录各用户终端与其所连接的交换机的端口的编号的对应关系。获取该用户终端当前连接的交换机的端口的编号，并将当前连接的端口的编号与上述的终端及交换机端口对应列表中该终端所对应的端口编号进行比对，来判断该用户终端所连接的交换机的端口是否发生了改变。当判定用户终端的位置发生改变，则管控端服务器接收用户终端的浏览器的当前网页的网页信息，对该网页信息进行分析，获得对应于该用户的网络应用标签；匹配该网络应用标签和预置的网络应用映射表，从而将与监控物理图层一致的物理图层推送至用户终端的浏览器。具体地，可通过向用户终端的浏览器中推送一web页面的形式来推送该物理图层。用户可以在该web页面所显示的物理图层中点选自己的工位在物理图层中所对应的位置(具体的楼层、工位等)，并在点选后可输入该用户的基本信息，包括：用户名、职位、所在部门等。在web页面中获取了该用户的基本信息之后，可通过企业内网将该用户的基本信息及其所使用的终端信息同时上传至管控端服务器，并将该用户的基本信息及其所使用的终端信息同时更新至监控物理图层中，此时便建立了该用户的终端与信息点之间相对应的关联关系，并实现了对用户终端位置变更的对应更新。
以上所述为针对一名用户建立终端与信息点之间关联的过程，针对企业 中的每一位员工，均可通过上述过程建立监控物理图层与用户终端的关联，从而实现对管控端与终端之间关联关系的初始化。
通过上述步骤S101及步骤S102，即实现了监控物理图层与终端的一一对应关系的建立，然后执行步骤S103，判断终端是否发生触发事件，当终端发生触发事件时，将触发事件显示在监控物理图层中对应的信息点的位置。
本发明实施例的终端管控方法可用于实现对企业内网终端的数据防泄密、执行安全策略等管控。具体地，可实时监控企业内网中各信息点的各种操作，例如：用户的登入/登出、接入网络，外联网络、接入外用设备等，其中，针对企业内网中各信息点重点监控的触发事件如表一所示。
表一
Figure PCTCN2016100362-appb-000001
Figure PCTCN2016100362-appb-000002
在实际应用中，当检测到触发事件时，在该监控物理图层上将发生该触发事件的终端对应的信息点突出显示出来。例如可以是通过高亮形式、闪烁形式、放大形式、单独弹窗形式等多种能够突出该信息点物理位置的形式进行显示，本发明并不以此为限。通过上述的显示方式，能够使管控端的管理员更加简单、直观地了解到发生触发事件的位置。并且，在一实施例中，还可在该位置上同时显示出该位置的用户的基本信息，以及发生的触发事件所执行的操作。
需要说明的是，上述表一所述的各类触发事件仅是举例说明，本发明实施例的局域网内基于物理位置的终端监控方法所能检测到的事件并不仅限于表一所列出的触发事件，也可包括各类企业内网中的运行事件及相关操作。
本发明实施例的局域网内基于物理位置的终端监控方法，将基于物理位置结构图的物理图层作为对企业内网终端进行监控的界面，在该物理图层上实时显示终端可能发生的各类事件，使得对企业内网终端进行的监控过程更 加可视化、简单化，以适于企业内网中不同使用者来进行企业内网的监控，降低了对相关工作人员的专业背景的门槛，使得对企业内网终端的监控趋于行政化参与，可提高用户的使用体验，有利于该监控方法的应用及推广。
在实际应用中，本发明实施例的终端监控方法并不仅限于上述的触发事件显示提示，当经过上述步骤S103将发生触发事件的终端显示在监控物理图层之后，还可进一步显示出针对该触发事件的具体应对措施，如图3所示，步骤S104：在发生触发事件的终端对应的信息点的位置显示针对该触发事件的应对措施；接收用户的选择，并根据用户的选择执行相应的应对措施。
例如，当检测某一终端出现“违规外联”时，由于有可能发生企业内部机密泄密的风险，可针对该类事件提示是否执行断网的应对措施，或者也可提示是否执行隔离或其他操作，但可针对最佳应对方案给出“推荐”字样，以提示管理员针对该类事件可选的最佳应对措施；当检测到某一终端出现“违规接入”的行为时，由于可能发生企业内部被来源不明的程序攻击或病毒感染的风险，可针对该类事件提示是否执行隔离及断网的应对措施，或者也可提示是否执行停机或其他操作，但可针对最佳应对方案给出“推荐”字样，以提示管理员针对该类事件可选的最佳应对措施。在实际应用中，应对措施的显示可以是通过弹窗、下拉菜单等形式展示给管理者，本发明并不以此为限。
在管理者根据提示选择了相应的应对措施后，可对发生触发事件的终端进行隔离、断网、停机等相应的操作，以及时处理该触发事件，防止触发事件所带来的危害进一步扩散。
通过上述的步骤S104，本发明实施例的局域网内基于物理位置的终端监控方法不仅能够将发生触发事件的终端以可视化的效果展现给管理员，并且也能够针对各类触发事件直观地给出可供选择的应对措施，并根据管理员的选择执行相应的操作。可见，上述的局域网内基于物理位置的终端监控方法，更能够满足企业内网中不同使用者的使用需求，降低了管理人员专业背景的门槛，使得对企业内网终端的管控趋于行政化参与，因而也可提高用户的使用体验，有利于该终端监控方法的推广。
本发明实施例还提供一种局域网内基于物理位置的终端监控系统，如图4所示，该局域网内基于物理位置的终端监控方法主要包括：信息点定义单元100、关联关系建立单元200及触发事件显示单元300等。
其中，上述的信息点定义单元100用于根据物理位置结构图创建监控物理图层，在监控物理图层中定义与终端相对应的信息点；关联关系建立单元200用于建立终端与信息点的关联关系；触发事件显示单元300用于判断终 端是否发生触发事件，当终端发生触发事件时，将触发事件显示在监控物理图层中对应的信息点的位置。
通过上述的局域网内基于物理位置的终端监控系统，将一基于物理位置结构图的物理图层作为对企业内网终端进行监控的界面，在该物理图层上实时显示终端可能发生的各类事件，使得对企业内网终端进行的监控过程更加可视化、简单化，以适于企业内网中不同使用者来进行企业内网的监控，降低了对相关工作人员的专业背景的门槛，使得对企业内网终端的监控趋于行政化参与，可提高用户的使用体验，有利于该监控方法的应用及推广。
以下将结合具体实施例，对本发明实施例的局域网内基于物理位置的终端监控系统中的各个部分进行详细的说明。
上述的信息点定义单元100，用于根据物理位置结构图创建监控物理图层，在监控物理图层中定义与终端相对应的信息点。本发明实施例的终端监控系统是基于企业内部的物理位置信息，并在基于物理位置结构图的监控物理图层上实现对企业内网终端进行监控。因此，首先需要将企业内各个楼层的内部结构平面图作为基础性模板进行导入。如图2所示，该图所示出的为企业中某一楼层的内部结构平面图，仅为举例说明该平面图的样式。在实际应用中，导入的内部结构图可以通过例如是AutoCad等制图工具所绘制的绘图文件，本发明并不以此为限。并且，图2所示出的仅为其中一个楼层的二维平面布局图，在实际应用中，该内部结构图还可以针对不同的办公设备(例如终端、办公座椅等)匹配不同的纵高，从而形成一个具有立体效果的布局视图。并且，最终呈现的整体效果中，还可将多个楼层的二维平面布局图或是具有立体效果的布局视图相叠加，从而形成该企业整个办公环境(例如一栋办公大楼或是多层办公楼层相叠加)作为整体的三维立体模型透视图。
在导入了内部结构图之后，即可根据该内部结构图在管控端(服务器端)创建基于该内部结构图的监控物理图层，并在监控物理图层中定义与终端相对应的信息点。具体地，该信息点包括但不限于：区域信息点、办公楼信息点、终端信息点、企业服务信息点、应用程序信息点及网络设备信息点等。通过定义上述各种信息点，使得监控物理图层中的各楼层信息、各类设备、终端、接口等的信息与实际物理空间中的各楼层信息、各类设备、终端、接口等的信息一一对应。在实际应用中，可以是通过在上述的内部结构图中的各楼层信息、各类设备、终端、接口等所对应的坐标信息的不同来定义其相应的信息点，并记录在管控端服务器中，以备后续的管控过程中进行调用。
然后，通过上述的关联关系建立单元200，建立终端与信息点的关联关系。此处所述的终端，是指用户实际所使用的连接至局域网的各类设备、移 动终端、接口等一系列物理设备。在一实施例中，上述建立终端与信息点之间的关联的过程主要包含有两种方式：一种是通过客户端(agent)建立关联；另一种是无客户端直接建立关联。
在一实施例中，本发明实施例的终端监控系统是通过如图5所示的关联关系建立单元200来执行上述通过客户端建立关联的方式。具体地，该关联关系建立单元200包括：操作接收模块201及关联关系建立模块202。该操作接收模块201用于接收用户在终端上一应用程序的建立关联操作；关联关系建立模块202则用于根据建立关联操作将终端的物理位置与监控物理图层中相应的信息点的位置相对应，以建立关联关系。
通过客户端建立关联，应用此种方式建立终端与信息点的关联的前提在于，在企业内网终端上预先安装有相应的应用程序(application)，该应用程序可以通过用户使用的终端设备的显示装置向用户展示与监控物理图层相一致的物理图层。用户可以在该物理图层中点选自己的工位所对应的位置(具体的楼层、工位等)，并在点选后可输入该用户的基本信息，包括：用户姓名、职位、所在部门等。在操作接收模块201通过该应用程序所显示的该物理图层获取了该用户的基本信息之后，可通过企业内网将该用户的基本信息及其所使用的终端信息同时上传至管控端服务器，并通过关联关系建立模块202将该用户的基本信息及其所使用的终端信息同时更新至监控物理图层中，此时便建立了该用户的终端与信息点之间相对应的关联关系。以上所述为针对一名用户建立终端与信息点之间关联的过程，针对企业中的每一位员工，均可通过上述过程建立监控物理图层与用户终端的关联，从而实现对管控端与终端之间关联关系的初始化。
在一实施例中，本发明实施例的终端监控系统是通过如图6所示的关联关系建立单元200来执行上述无客户端直接建立关联的方式。具体地，该关联关系建立单元200主要包括：流量使用情况检测模块203、新接入终端判断模块204、建立关联请求推送模块205、建立关联操作接收模块206及关联关系建立模块207等。其中，该流量使用情况检测模块203用于检测终端的流量使用情况；新接入终端判断模块204用于当终端产生流量使用时，进一步判断终端是否为新接入终端；建立关联请求推送模块205用于当用户为新用户时，向终端推送一建立关联请求；建立关联操作接收模块206用于接收用户根据建立关联请求所进行的建立关联操作；关联关系建立模块207用于根据建立关联操作将终端的物理位置与监控物理图层中相应的信息点的位置相对应，以建立关联关系。
该关联关系建立单元200是通过上述的无客户端直接建立关联的方式来 建立终端与信息点之间的关联。此种方式与通过客户端建立关联的方式的主要区别在于，此种方式并不要求用户的终端中安装有上述的应用程序，而是通过流量使用情况检测模块203(在实际应用中，可以是通过该用户使用的终端所连接的网络通信设备，例如交换机等)来监控终端的流量使用情况。流量使用情况检测模块203对于流量进行监控，可通过对用户终端中例如浏览器的应用程序对其所使用的流量情况进行统计，从而生成流量统计数据，将流量统计数据通过企业内网上传至管控端服务器，管控端服务器获取并分析该流量统计数据中所包含的流量信息，从而获知该用户终端的流量使用情况。当监控到某一用户终端中产生流量使用的状况时，表明该用户终端已接入企业内网。此时，进一步通过新接入终端判断模块204根据该用户终端的唯一标识(例如mac地址或mid等用以唯一识别该用户终端的标识，本发明并不以此为限)与管控端服务器所储存的已接入的终端列表中的唯一标识来判断该用户终端是否为新接入企业内网的终端。如果该用户终端的唯一标识为首次出现，则表明该用户终端是新接入企业内网的终端。此时，通过建立关联请求推送模块205向用户终端推送一建立关联请求。具体地，该建立关联请求推送模块205用于接收用户终端的浏览器的当前网页的网页信息，对该网页信息进行分析，获得对应于该用户的网络应用标签；匹配该网络应用标签和预置的网络应用映射表，从而将与监控物理图层一致的物理图层推送至用户终端的浏览器，并在该物理图层中显示出建立关联请求。具体实施时，可以是通过向用户终端的浏览器中推送一web页面的形式来推送该物理图层。用户可以在该web页面所显示的物理图层中点选自己的工位在物理图层中所对应的位置(具体的楼层、工位等)，并在点选后可输入该用户的基本信息，包括：用户名、职位、所在部门等。在建立关联操作接收模块206通过web页面获取了该用户的基本信息之后，可通过企业内网将该用户的基本信息及其所使用的终端信息同时上传至管控端服务器，并通过关联关系建立模块207将该用户的基本信息及其所使用的终端信息同时更新至监控物理图层中，此时便建立了该用户的终端与信息点之间相对应的关联关系。
在另一实施例中，本发明实施例的终端监控系统是通过如图7所示的关联关系建立单元200来执行上述无客户端直接建立关联的方式。具体地，该关联关系建立单元200主要包括：位置判断模块208、建立关联请求推送模块209、建立关联操作接收模块210及关联关系建立模块211等。其中，该位置判断模块208用于判断终端的位置是否变更；建立关联请求推送模块209用于当终端的位置发生变更时，向终端推送一建立关联请求；建立关联操作接收模块210用于接收用户根据建立关联请求所进行的建立关联操作； 关联关系建立模块211用于根据建立关联操作将终端的物理位置与监控物理图层中相应的信息点的位置相对应，以建立关联关系。
具体地，首先通过位置判断模块208根据该用户终端所连接至的网络通信设备的端口信息是否发生变化来判断该用户终端的位置是否发生了改变。以下将以交换机作为上述的网络通信设备为例，对本发明实施例中判断该用户终端的位置是否发生改变的过程进行详细说明，但本发明并不以此为限。具体地，可获取各用户终端及其所连接的交换机的端口编号，并生成一参照列表(终端及交换机端口对应列表)，记录各用户终端与其所连接的交换机的端口的编号的对应关系。获取该用户终端当前连接的交换机的端口的编号，并将当前连接的端口的编号与上述的终端及交换机端口对应列表中该终端所对应的端口编号进行比对，来判断该用户终端所连接的交换机的端口是否发生了改变。当判定用户终端的位置发生改变，则通过建立关联请求推送模块209向用户终端推送一建立关联请求。具体地，该建立关联请求推送模块209用于接收用户终端的浏览器的当前网页的网页信息，对该网页信息进行分析，获得对应于该用户的网络应用标签；匹配该网络应用标签和预置的网络应用映射表，从而将与监控物理图层一致的物理图层推送至用户终端的浏览器，并在该物理图层中显示出建立关联请求。具体实施时，可以是通过向用户终端的浏览器中推送一web页面的形式来推送该物理图层。用户可以在该web页面所显示的物理图层中点选自己的工位在物理图层中所对应的位置(具体的楼层、工位等)，并在点选后可输入该用户的基本信息，包括：用户名、职位、所在部门等。在建立关联操作接收模块210通过web页面获取了该用户的基本信息之后，可通过企业内网将该用户的基本信息及其所使用的终端信息同时上传至管控端服务器，并通过关联关系建立模块211将该用户的基本信息及其所使用的终端信息同时更新至监控物理图层中，此时便建立了该用户的终端与信息点之间相对应的关联关系，并实现了对用户终端位置变更的对应更新。
以上所述为针对一名用户建立终端与信息点之间关联的过程，针对企业中的每一位员工，均可通过上述过程建立监控物理图层与用户终端的关联，从而实现对管控端与终端之间关联关系的初始化。
通过上述的信息点定义单元100及关联关系建立单元200，实现了监控物理图层与终端的一一对应关系的建立，然后触发上述的触发事件显示单元300，判断终端是否发生触发事件，当终端发生触发事件时，将触发事件显示在监控物理图层中对应的信息点的位置。
本发明实施例的终端管控系统可用于实现对企业内网终端的数据防泄 密、执行安全策略等管控。具体地，可实时监控企业内网中各信息点的各种操作，例如：用户的登入/登出、接入网络，外联网络、接入外用设备等，其中，针对企业内网中各信息点重点监控的触发事件如表一所示。
在实际应用中，当检测到触发事件时，通过触发事件显示单元300在该监控物理图层上将发生该触发事件的终端对应的信息点突出显示出来。例如可以是通过高亮形式、闪烁形式、放大形式、单独弹窗形式等多种能够突出该信息点物理位置的形式进行显示，本发明并不以此为限。通过上述的显示方式，能够使管控端的管理员更加简单、直观地了解到发生触发事件的位置。并且，在一实施例中，还可在该位置上同时显示出该位置的用户的基本信息，以及发生的触发事件所执行的操作。
需要说明的是，表一所述的各类触发事件仅是举例说明，本发明实施例的局域网内基于物理位置的终端监控系统所能检测到的事件并不仅限于表一所列出的触发事件，也可包括各类企业内网中的运行事件及相关操作。
本发明实施例的局域网内基于物理位置的终端监控系统，将基于物理位置结构图的物理图层作为对企业内网终端进行监控的界面，在该物理图层上实时显示终端可能发生的各类事件，使得对企业内网终端进行的监控过程更加可视化、简单化，以适于企业内网中不同使用者来进行企业内网的监控，降低了对相关工作人员的专业背景的门槛，使得对企业内网终端的监控趋于行政化参与，可提高用户的使用体验，有利于该监控系统的应用及推广。
在实际应用中，本发明实施例的终端监控系统并不仅限于上述的触发事件显示提示，当通过上述的触发事件显示单元300将发生触发事件的终端显示在监控物理图层之后，还可通过应对措施显示单元400及应对措施执行单元500显示出针对该触发事件的具体应对措施，并根据用户的选择执行相应的应对措施，如图8所示。其中，该应对措施显示单元400用于在发生触发事件的终端对应的信息点的位置显示针对该触发事件的应对措施；应对措施执行单元500用于接收用户的选择，并根据用户的选择执行相应的应对措施。
例如，当检测某一终端出现“违规外联”时，由于有可能发生企业内部机密泄密的风险，可通过应对措施显示单元400针对该类事件提示是否执行断网的应对措施，或者也可提示是否执行隔离或其他操作，但可针对最佳应对方案给出“推荐”字样，以提示管理员针对该类事件可选的最佳应对措施；当检测到某一终端出现“违规接入”的行为时，由于可能发生企业内部被来源不明的程序攻击或病毒感染的风险，可针对该类事件提示是否执行隔离及断网的应对措施，或者也可提示是否执行停机或其他操作，但可针对最佳应对方案给出“推荐”字样，以提示管理员针对该类事件可选的最佳应对措施。 在实际应用中，应对措施的显示可以是通过弹窗、下拉菜单等形式展示给管理者，本发明并不以此为限。
在管理者根据提示选择了相应的应对措施后，应对措施执行单元500可对发生触发事件的终端进行隔离、断网、停机等相应的操作，以及时处理该触发事件，防止触发事件所带来的危害进一步扩散。
通过上述的步骤应对措施显示单元400及应对措施执行单元500，本发明实施例的局域网内基于物理位置的终端监控系统不仅能够将发生触发事件的终端以可视化的效果展现给管理员，并且也能够针对各类触发事件直观地给出可供选择的应对措施，并根据管理员的选择执行相应的操作。可见，上述的终端监控系统，更能够满足企业内网中不同使用者的使用需求，降低了管理人员专业背景的门槛，使得对企业内网终端的管控趋于行政化参与，因而也可提高用户的使用体验，有利于该终端监控系统的推广及应用。
对于装置实施例而言，由于其与方法实施例基本相似，所以描述的比较简单，相关之处参见方法实施例的部分说明即可。
在此提供的算法和显示不与任何特定计算机、虚拟系统或者其它设备固有相关。各种通用系统也可以与基于在此的示教一起使用。根据上面的描述，构造这类系统所要求的结构是显而易见的。此外，本发明也不针对任何特定编程语言。应当明白，可以利用各种编程语言实现在此描述的本发明的内容，并且上面对特定语言所做的描述是为了披露本发明的最佳实施方式。
在此处所提供的说明书中，说明了大量具体细节。然而，能够理解，本发明的实施例可以在没有这些具体细节的情况下实践。在一些实例中，并未详细示出公知的方法、结构和技术，以便不模糊对本说明书的理解。
类似地，应当理解，为了精简本公开并帮助理解各个发明方面中的一个或多个，在上面对本发明的示例性实施例的描述中，本发明的各个特征有时被一起分组到单个实施例、图、或者对其的描述中。然而，并不应将该公开的方法解释成反映如下意图：即所要求保护的本发明要求比在每个权利要求中所明确记载的特征更多的特征。更确切地说，如下面的权利要求书所反映的那样，发明方面在于少于前面公开的单个实施例的所有特征。因此，遵循具体实施方式的权利要求书由此明确地并入该具体实施方式，其中每个权利要求本身都作为本发明的单独实施例。
本领域那些技术人员可以理解，可以对实施例中的设备中的模块进行自适应性地改变并且把它们设置在与该实施例不同的一个或多个设备中。可以把实施例中的模块或单元或组件组合成一个模块或单元或组件，以及此外可以把它们分成多个子模块或子单元或子组件。除了这样的特征和/或过程或者 单元中的至少一些是相互排斥之外，可以采用任何组合对本说明书(包括伴随的权利要求、摘要和附图)中公开的所有特征以及如此公开的任何方法或者设备的所有过程或单元进行组合。除非另外明确陈述，本说明书(包括伴随的权利要求、摘要和附图)中公开的每个特征可以由提供相同、等同或相似目的的替代特征来代替。
此外，本领域的技术人员能够理解，尽管在此所述的一些实施例包括其它实施例中所包括的某些特征而不是其它特征，但是不同实施例的特征的组合意味着处于本发明的范围之内并且形成不同的实施例。例如，在下面的权利要求书中，所要求保护的实施例的任意之一都可以以任意的组合方式来使用。
本发明的各个部件实施例可以以硬件实现，或者以在一个或者多个处理器上运行的软件模块实现，或者以它们的组合实现。本领域的技术人员应当理解，可以在实践中使用微处理器或者数字信号处理器(DSP)来实现根据本发明实施例的应用的后台运行方法及装置设备中的一些或者全部部件的一些或者全部功能。本发明还可以实现为用于执行这里所描述的方法的一部分或者全部的设备或者装置程序(例如，计算机程序和计算机程序产品)。这样的实现本发明的程序可以存储在计算机可读介质上，或者可以具有一个或者多个信号的形式。这样的信号可以从因特网网站上下载得到，或者在载体信号上提供，或者以任何其他形式提供。
例如，图9示出了可以实现根据本发明的局域网内基于物理位置的终端监控方法的计算设备。该计算设备传统上包括处理器910和以存储器920形式的程序产品或者可读介质。存储器920可以是诸如闪存、EEPROM(电可擦除可编程只读存储器)、EPROM或者ROM之类的电子存储器。存储器920具有用于执行上述方法中的任何方法步骤的程序代码931的存储空间930。例如，用于程序代码的存储空间930可以包括分别用于实现上面的方法中的各种步骤的各个程序代码931。这些程序代码可以从一个或者多个程序产品中读出或者写入到这一个或者多个程序产品中。这些程序产品包括诸如存储卡之类的程序代码载体。这样的程序产品通常为如参考图10所述的便携式或者固定存储单元。该存储单元可以具有与图9的计算设备中的存储器920类似布置的存储段、存储空间等。程序代码可以例如以适当形式进行压缩。通常，存储单元包括可读代码931’，即可以由例如诸如910之类的处理器读取的代码，这些代码当由计算设备运行时，导致该计算设备执行上面所描述的方法中的各个步骤。
应该注意的是上述实施例对本发明进行说明而不是对本发明进行限制， 并且本领域技术人员在不脱离所附权利要求的范围的情况下可设计出替换实施例。在权利要求中，不应将位于括号之间的任何参考符号构造成对权利要求的限制。单词“包含”不排除存在未列在权利要求中的元件或步骤。位于元件之前的单词“一”或“一个”不排除存在多个这样的元件。本发明可以借助于包括有若干不同元件的硬件以及借助于适当编程的计算机来实现。在列举了若干装置的单元权利要求中，这些装置中的若干个可以是通过同一个硬件项来具体体现。单词第一、第二、以及第三等的使用不表示任何顺序。可将这些单词解释为名称。
本领域普通技术人员可以理解实现上述实施例方法中的全部或部分步骤可以通过程序来指令相关的硬件来完成，该程序可以存储于一计算机可读取存储介质中，比如ROM/RAM、磁碟、光盘等。
以上所述的具体实施例，对本发明的目的、技术方案和有益效果进行了进一步详细说明，所应理解的是，以上所述仅为本发明的具体实施例而已，并不用于限定本发明的保护范围，凡在本发明的精神和原则之内，所做的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。

Claims (24)

  1. 一种局域网内基于物理位置的终端监控方法，其特征在于，所述的终端监控方法包括：
    根据物理位置结构图创建监控物理图层，在所述监控物理图层中定义与终端相对应的信息点；
    建立终端与所述信息点的关联关系；
    当所述终端发生触发事件时，将所述触发事件显示在所述监控物理图层中对应的信息点的位置。
  2. 根据权利要求1所述的局域网内基于物理位置的终端监控方法，其特征在于，所述的终端监控方法还包括：
    在发生所述触发事件的终端对应的信息点的位置显示针对所述触发事件的应对措施；
    接收用户的选择，并根据用户的选择执行相应的应对措施。
  3. 根据权利要求1所述的局域网内基于物理位置的终端监控方法，其特征在于，建立终端与所述信息点的关联关系，进一步包括：
    接收用户在所述终端上一应用程序的建立关联操作；
    根据所述建立关联操作将所述终端的物理位置与所述监控物理图层中相应的信息点的位置相对应，以建立所述的关联关系。
  4. 根据权利要求1所述的局域网内基于物理位置的终端监控方法，其特征在于，建立终端与所述信息点的关联关系，进一步包括：
    检测所述终端的流量使用情况；
    当所述终端产生流量使用时，进一步判断所述终端是否为新接入终端；
    当所述终端是新接入终端时，向所述终端推送一建立关联请求；
    接收用户根据所述建立关联请求所进行的建立关联操作；
    根据所述建立关联操作将所述终端的物理位置与所述监控物理图层中相应的信息点的位置相对应，以建立所述的关联关系。
  5. 根据权利要求4所述的局域网内基于物理位置的终端监控方法，其特征在于，判断所述终端是否为新接入终端，包括：
    获取所述终端的唯一标识；
    将所述唯一标识与已接入终端的唯一标识列表进行比对，以判断所述唯一标识是否为所述唯一标识列表中已接入的唯一标识；
    如果是，则所述终端不是新接入终端；否则，所述终端是新接入终端。
  6. 根据权利要求1所述的局域网内基于物理位置的终端监控方法，其特征在于，建立终端与所述信息点的关联关系，进一步包括：
    判断所述终端的位置是否变更；
    当所述终端的位置发生变更时，向所述终端推送一建立关联请求；
    接收用户根据所述建立关联请求所进行的建立关联操作；
    根据所述建立关联操作将所述终端的物理位置与所述监控物理图层中相应的信息点的位置相对应，以建立所述的关联关系。
  7. 根据权利要求6所述的局域网内基于物理位置的终端监控方法，其特征在于，判断所述终端的位置是否变更，包括：
    获取所述终端当前连接的网络通信设备的端口的编号；
    将所述端口的编号与终端及网络通信设备端口对应列表中的所述终端所对应的端口编号进行比对；
    判断所述终端连接的网络通信设备的端口是否变更。
  8. 根据权利要求1所述的局域网内基于物理位置的终端监控方法，其特征在于，所述的物理位置结构图为建筑内部各层的二维平面结构图。
  9. 根据权利要求1所述的局域网内基于物理位置的终端监控方法，其特征在于，所述的物理位置结构图为建筑内部三维立体结构模型图。
  10. 根据权利要求1所述的局域网内基于物理位置的终端监控方法，其特征在于，所述的信息点至少包括：区域信息点、办公楼信息点、终端信息点、企业服务信息点、应用程序信息点及网络设备信息点。
  11. 根据权利要求1所述的局域网内基于物理位置的终端监控方法，其特征在于，将所述触发事件显示在所述监控物理图层中对应的信息点的位置的方式包括：以高亮形式、闪烁形式、放大形式、单独弹窗形式的至少其中之一将所述信息点的位置在所述监控物理图层中突出显示。
  12. 一种局域网内基于物理位置的终端监控系统，其特征在于，所述的终端监控系统包括：
    信息点定义单元，用于根据物理位置结构图创建监控物理图层，在所述监控物理图层中定义与终端相对应的信息点；
    关联关系建立单元，用于建立终端与所述信息点的关联关系；
    触发事件显示单元，用于当所述终端发生触发事件时，将所述触发事件显示在所述监控物理图层中对应的信息点的位置。
  13. 根据权利要求12所述的局域网内基于物理位置的终端监控系统，其特征在于，所述的终端监控系统还包括：
    应对措施显示单元，用于在发生所述触发事件的终端对应的信息点的位置显示针对所述触发事件的应对措施；
    应对措施执行单元，用于接收用户的选择，并根据用户的选择执行相应 的应对措施。
  14. 根据权利要求12所述的局域网内基于物理位置的终端监控系统，其特征在于，所述的关联关系建立单元包括：
    操作接收模块，用于接收用户在所述终端上一应用程序的建立关联操作；
    关联关系建立模块，用于根据所述建立关联操作将所述终端的物理位置与所述监控物理图层中相应的信息点的位置相对应，以建立所述的关联关系。
  15. 根据权利要求12所述的局域网内基于物理位置的终端监控系统，其特征在于，所述的关联关系建立单元包括：
    流量使用情况检测模块，用于检测所述终端的流量使用情况；
    新接入终端判断模块，用于当所述终端产生流量使用时，进一步判断所述终端是否为新接入终端；
    建立关联请求推送模块，用于当所述用户为新用户时，向所述终端推送一建立关联请求；
    建立关联操作接收模块，用于接收用户根据所述建立关联请求所进行的建立关联操作；
    关联关系建立模块，用于根据所述建立关联操作将所述终端的物理位置与所述监控物理图层中相应的信息点的位置相对应，以建立所述的关联关系。
  16. 根据权利要求15所述的局域网内基于物理位置的终端监控系统，其特征在于，所述的新接入终端判断模块具体用于：
    获取所述终端的唯一标识；
    将所述唯一标识与已接入终端的唯一标识列表进行比对，以判断所述唯一标识是否为所述唯一标识列表中已接入的唯一标识；
    如果是，则所述终端不是新接入终端；否则，所述终端是新接入终端。
  17. 根据权利要求12所述的局域网内基于物理位置的终端监控系统，其特征在于，所述的关联关系建立单元包括：
    位置判断模块，用于判断所述终端的位置是否变更；
    建立关联请求推送模块，用于当所述终端的位置发生变更时，向所述终端推送一建立关联请求；
    建立关联操作接收模块，用于接收用户根据所述建立关联请求所进行的建立关联操作；
    关联关系建立模块，用于根据所述建立关联操作将所述终端的物理位置 与所述监控物理图层中相应的信息点的位置相对应，以建立所述的关联关系。
  18. 根据权利要求17所述的局域网内基于物理位置的终端监控系统，其特征在于，所述的位置判断模块具体用于：
    获取所述终端当前连接的网络通信设备的端口；
    将所述端口与终端及网络通信设备端口对应列表中的所述终端所对应的端口编号进行比对；
    判断所述终端连接的网络通信设备的端口是否变更。
  19. 根据权利要求12所述的局域网内基于物理位置的终端监控系统，其特征在于，所述的物理位置结构图为建筑内部各层的二维平面结构图。
  20. 根据权利要求12所述的局域网内基于物理位置的终端监控系统，其特征在于，所述的物理位置结构图为建筑内部三维立体结构模型图。
  21. 根据权利要求12所述的局域网内基于物理位置的终端监控系统，其特征在于，所述的信息点至少包括：区域信息点、办公楼信息点、终端点、企业服务信息点、应用程序信息点及网络设备信息点。
  22. 根据权利要求12所述的局域网内基于物理位置的终端监控系统，其特征在于，所述的触发事件显示单元显示所述触发事件的方式包括：以高亮形式、闪烁形式、放大形式、单独弹窗形式的至少其中之一将所述信息点的位置在所述监控物理图层中突出显示。
  23. 一种程序，包括可读代码，当所述可读代码在计算设备上运行时，导致所述计算设备执行根据权利要求1-11中的任一个所述的局域网内基于物理位置的终端监控方法。
  24. 一种可读介质，其中存储了如权利要求23所述的程序。
PCT/CN2016/100362 2015-09-28 2016-09-27 一种局域网内基于物理位置的终端监控方法及系统 WO2017054705A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510627205.7 2015-09-28
CN201510627205.7A CN105281950B (zh) 2015-09-28 2015-09-28 一种局域网内基于物理位置的终端监控方法及系统

Publications (1)

Publication Number Publication Date
WO2017054705A1 true WO2017054705A1 (zh) 2017-04-06

Family

ID=55150322

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/100362 WO2017054705A1 (zh) 2015-09-28 2016-09-27 一种局域网内基于物理位置的终端监控方法及系统

Country Status (2)

Country Link
CN (1) CN105281950B (zh)
WO (1) WO2017054705A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111538777A (zh) * 2020-03-20 2020-08-14 贵州电网有限责任公司 一种企业内网信息安全可视化展现管理平台
CN114584352A (zh) * 2022-02-21 2022-06-03 北京北信源软件股份有限公司 多网络互联的网络违规外联检测方法、装置及系统
CN114598503A (zh) * 2022-02-21 2022-06-07 北京北信源软件股份有限公司 违规外联检测方法、装置、系统及电子设备

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105281950B (zh) * 2015-09-28 2019-05-28 北京奇虎科技有限公司 一种局域网内基于物理位置的终端监控方法及系统
CN107592506B (zh) * 2017-09-26 2020-06-30 英华达（上海）科技有限公司 一种监控方法以及监控装置、监控系统

Citations (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20090157418A1 (en) * 2007-12-12 2009-06-18 At&T Delaware Intellectual Property, Inc. Method And System For Obtaining Geographic Location Information
CN102117206A (zh) * 2009-12-30 2011-07-06 捷达世软件（深圳）有限公司 图标控件动态生成系统及方法
CN104125279A (zh) * 2014-07-25 2014-10-29 西安诺瓦电子科技有限公司 Led显示终端监控系统
CN105162637A (zh) * 2015-09-30 2015-12-16 北京奇虎科技有限公司 一种局域网可视化管理方法和装置
CN105187254A (zh) * 2015-09-28 2015-12-23 北京奇虎科技有限公司 一种局域网内基于物理位置的位置变更更新方法及系统
CN105183618A (zh) * 2015-09-28 2015-12-23 北京奇虎科技有限公司 一种可视化异常事件通知方法及装置
CN105207820A (zh) * 2015-09-30 2015-12-30 北京奇虎科技有限公司 一种局域网中的终端设备管理方法和装置
CN105227360A (zh) * 2015-09-28 2016-01-06 北京奇虎科技有限公司 一种管控物理图层与管控虚拟图层的显示方法及系统
CN105281950A (zh) * 2015-09-28 2016-01-27 北京奇虎科技有限公司 一种局域网内基于物理位置的终端监控方法及系统
CN105306546A (zh) * 2015-09-28 2016-02-03 北京奇虎科技有限公司 一种终端位置的可视化方法及装置
CN105306263A (zh) * 2015-09-30 2016-02-03 北京奇虎科技有限公司 一种局域网可视化管理方法和装置
CN105357028A (zh) * 2015-09-28 2016-02-24 北京奇虎科技有限公司 一种局域网内建立物理位置与终端的对应关系的方法及系统

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN100429890C (zh) * 2005-09-05 2008-10-29 北京启明星辰信息技术有限公司 网络安全事件的可视化定位方法及系统
CN101478343B (zh) * 2008-01-03 2013-04-17 华为技术有限公司 一种实现集成管理中继装置的方法、装置和系统
KR101127794B1 (ko) * 2011-08-17 2012-03-23 주식회사 씽크풀 네트워크 식별자 위치판단 시스템 및 그 방법
CN103761176A (zh) * 2013-12-11 2014-04-30 中国广核集团有限公司 一种电脑巡检的方法和装置
CN104376092A (zh) * 2014-11-21 2015-02-25 广东省电子技术研究所 一种基于地图优化设备管理的方法及系统
CN104729499A (zh) * 2015-02-12 2015-06-24 北京云迹科技有限公司 一种室内机器人基于蓝牙技术定位移动终端的方法
CN104836699A (zh) * 2015-04-16 2015-08-12 深圳中兴网信科技有限公司 设备状态处理方法与设备状态处理系统

Patent Citations (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20090157418A1 (en) * 2007-12-12 2009-06-18 At&T Delaware Intellectual Property, Inc. Method And System For Obtaining Geographic Location Information
CN102117206A (zh) * 2009-12-30 2011-07-06 捷达世软件（深圳）有限公司 图标控件动态生成系统及方法
CN104125279A (zh) * 2014-07-25 2014-10-29 西安诺瓦电子科技有限公司 Led显示终端监控系统
CN105187254A (zh) * 2015-09-28 2015-12-23 北京奇虎科技有限公司 一种局域网内基于物理位置的位置变更更新方法及系统
CN105183618A (zh) * 2015-09-28 2015-12-23 北京奇虎科技有限公司 一种可视化异常事件通知方法及装置
CN105227360A (zh) * 2015-09-28 2016-01-06 北京奇虎科技有限公司 一种管控物理图层与管控虚拟图层的显示方法及系统
CN105281950A (zh) * 2015-09-28 2016-01-27 北京奇虎科技有限公司 一种局域网内基于物理位置的终端监控方法及系统
CN105306546A (zh) * 2015-09-28 2016-02-03 北京奇虎科技有限公司 一种终端位置的可视化方法及装置
CN105357028A (zh) * 2015-09-28 2016-02-24 北京奇虎科技有限公司 一种局域网内建立物理位置与终端的对应关系的方法及系统
CN105162637A (zh) * 2015-09-30 2015-12-16 北京奇虎科技有限公司 一种局域网可视化管理方法和装置
CN105207820A (zh) * 2015-09-30 2015-12-30 北京奇虎科技有限公司 一种局域网中的终端设备管理方法和装置
CN105306263A (zh) * 2015-09-30 2016-02-03 北京奇虎科技有限公司 一种局域网可视化管理方法和装置

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111538777A (zh) * 2020-03-20 2020-08-14 贵州电网有限责任公司 一种企业内网信息安全可视化展现管理平台
CN114584352A (zh) * 2022-02-21 2022-06-03 北京北信源软件股份有限公司 多网络互联的网络违规外联检测方法、装置及系统
CN114598503A (zh) * 2022-02-21 2022-06-07 北京北信源软件股份有限公司 违规外联检测方法、装置、系统及电子设备
CN114584352B (zh) * 2022-02-21 2023-07-07 北京北信源软件股份有限公司 多网络互联的网络违规外联检测方法、装置及系统
CN114598503B (zh) * 2022-02-21 2023-12-12 北京北信源软件股份有限公司 违规外联检测方法、装置、系统及电子设备

Also Published As

Publication number Publication date
CN105281950A (zh) 2016-01-27
CN105281950B (zh) 2019-05-28

Similar Documents

Publication Publication Date Title
WO2017054705A1 (zh) 一种局域网内基于物理位置的终端监控方法及系统
US20160212172A1 (en) Visually intuitive interactive network management
CN103999091B (zh) 地理映射系统安全事件
CN106027328B (zh) 一种基于应用容器部署的集群监控的方法及系统
CN110162976B (zh) 风险评估方法、装置及终端
CN110365721A (zh) 一种基于用户场景感知触发服务的方法、终端设备及系统
CN112511660B (zh) 一种边缘终端设备的管理系统、方法、装置及存储介质
CN106502840B (zh) 一种数据备份方法、装置及系统
EP3095013B1 (en) Method and system for use in connection with an industrial control system
US10965521B2 (en) Honeypot asset cloning
CN113808728A (zh) 医疗设备管理方法、装置、计算机设备和存储介质
CN110705726A (zh) 工业设备的运维审计方法、系统和装置
CN110704097A (zh) 一种数据收集方法、装置及电子设备和存储介质
CN113037545A (zh) 网络仿真方法、装置、设备和存储介质
CN108920037B (zh) 一种房屋的虚拟三维空间的显示方法及装置
US9787662B1 (en) Dynamic presentation of user account information for a social network
JP7255636B2 (ja) 端末管理装置、端末管理方法、およびプログラム
CN110430253A (zh) 一种提供小说更新通知信息的方法与设备
CN109491733A (zh) 基于可视化的界面显示方法及相关设备
JP2018032356A (ja) 制御プログラム、制御方法および情報処理装置
CN110149371A (zh) 设备连接方法、装置及终端设备
CN112395351A (zh) 可视化的识别群诉风险方法、装置、计算机设备及介质
CN105227360B (zh) 一种管控物理图层与管控虚拟图层的显示方法及系统
CN110162565A (zh) 预警显示方法、装置及终端设备
CN110887485A (zh) 一种高层建筑中的设备定位方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16850329

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16850329

Country of ref document: EP

Kind code of ref document: A1