WO2018035770A1 - 网络异常的处理方法及系统 - Google Patents
网络异常的处理方法及系统 Download PDFInfo
- Publication number
- WO2018035770A1 WO2018035770A1 PCT/CN2016/096600 CN2016096600W WO2018035770A1 WO 2018035770 A1 WO2018035770 A1 WO 2018035770A1 CN 2016096600 W CN2016096600 W CN 2016096600W WO 2018035770 A1 WO2018035770 A1 WO 2018035770A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- network
- network device
- instruction
- management system
- address
- Prior art date
Links
Images
Definitions
- the present application relates to the field of Internet communication technologies, and in particular, to a method and system for processing network anomalies.
- the Internet has become an important means for users to access various resources and query various information, making the network an important infrastructure in human social life and economic life. Due to the increasing reliance of users on the network, the traffic utilization rate in the network is increasing, the network load is increasing, and the traffic fluctuations are increasingly frequent.
- the present invention provides a method and system for processing network anomalies.
- the network management system automatically processes abnormal fluctuations of traffic generated by other devices actively attacking network devices in the network, thereby improving processing efficiency.
- the present application provides a method for processing a network abnormality, which is characterized in that it is executed on a network management system, and the method includes:
- disconnecting the network device from the other device includes:
- the method before the sending the first instruction to the network device, the method further includes:
- Sending the first instruction to the network device includes transmitting the first instruction to the network device over the established connection.
- the network device disconnects the connection between the network device and the other device according to the first instruction, including:
- the network device closes a port connected to the other device on the network device according to the first instruction, to disconnect the network device from the other device.
- the method before the sending the second instruction to the network device, the method further includes:
- Sending the second instruction to the network device includes: sending a second instruction to the network device according to an IP address of the network device.
- the embodiment of the present application further provides a network abnormality processing system, where the system includes a network management system, other devices, and network devices;
- the network management system is configured to disconnect a connection between the network device and the other device if detecting that another device actively attacks a network device in the network, causing traffic abnormality in the network.
- the network management system is specifically configured to: send a first instruction to the network device;
- the network device is configured to disconnect the network device from the other device according to the first instruction.
- the network management system is further configured to: send a second instruction to the network device before sending the first instruction to the network device;
- the network device is further configured to establish, according to the second instruction, the network management system Connection between
- the network management system is specifically configured to: send the first instruction to the network device by using the established connection.
- the network device is specifically configured to:
- the network management system is further configured to: obtain an IP address of the other device before sending the second instruction to the network device; and, according to the other device The IP address confirms the IP address of the network device;
- the method is specifically configured to: send, according to the IP address of the network device, a second instruction to the network device.
- the method and system for processing network anomalies provided by the embodiments of the present application, when it is determined that other devices actively attack network devices in the network, causing traffic abnormality in the network, the network management system disconnects the network device from other devices.
- the network management system automatically and timely processes, which improves the processing efficiency, thereby improving the security of the network, and solving the problem of using manual processing in the prior art and having low processing efficiency.
- Embodiment 1 is a schematic flowchart of Embodiment 2 of a method for processing a network abnormality according to the present application;
- Embodiment 2 is an application scenario diagram of Embodiment 2 of a method for processing network anomalies provided by the present application;
- Embodiment 3 is a schematic flowchart of Embodiment 3 of a method for processing a network abnormality according to the present application;
- FIG. 4 is a schematic flowchart of a method for obtaining an IP address of a network device by a network management system provided by the present application
- FIG. 5 is a schematic structural diagram of a network abnormality processing system provided by the present application.
- the method for processing the network abnormality may include: disconnecting the connection between the network device and other devices if the device detects that the network device in the network actively attacks the network device, causing traffic abnormality.
- FIG. 1 is a schematic flowchart of a second embodiment of a method for processing network anomalies according to the present application.
- FIG. 2 is a schematic diagram of an application scenario of a method for processing network anomalies according to the second embodiment of the present application.
- the processing method of the network exception provided by the embodiment may be performed on a network management system, and the method may include the following steps:
- the reason that the traffic abnormality occurs on the network is that the other device actively attacks the network device in the network.
- a network abnormality processing method that can be applied to a network management system is provided, so that the network management system can be used to discover other devices to actively attack network devices in the network, and then automatically perform processing.
- the network management system may include a network real-time status monitoring system, a network analysis system, and a DPI (Deep Packet Inspection) system.
- the network real-time status monitoring system can monitor all network devices in the network, obtain information of all network devices, real-time traffic of physical links, and network topology.
- the DPI system can identify the data flow in the physical link in the network to obtain the flow of traffic and traffic, and can also perform service or type analysis.
- the network analysis system can monitor whether the number of users changes, IP address utilization changes, traffic history data, and so on.
- the data information is obtained through the network management system, and the obtained data information is analyzed and calculated, and the analysis and calculation results can reflect the real-time running state of the network, thereby detecting whether an abnormality occurs in the network.
- the DPI system analyzes the abnormal traffic data packets, and according to the characteristics of other device IPs, the IP addresses of other devices are captured, and other devices are displayed.
- the physical information such as the directly connected device (that is, the network device that is attacked) and the port completes the information acquisition of other devices that are actively attacked and the network device that is attacked.
- the network real-time status monitoring system is used to process the traffic abnormality occurring in the network, which may be after acquiring the physical information of the attacked network device, and the network management system may perform the network device with the attack. connection.
- the method for disconnecting the connection between the network device and the other device may be:
- the network management system disconnects the network device from the other device through the network.
- the management system automatically and timely processes, improves the processing efficiency, thereby improving the security of the network, and solving the problem of using manual processing in the prior art and having low processing efficiency.
- FIG. 3 is a schematic flowchart of a method for processing a network abnormality according to Embodiment 3 of the present application. As shown in FIG. 3, the method for processing a network abnormality provided by the embodiment of the present application may include the following steps:
- the network management system sends a second instruction to the network device.
- the network management system after the network management system detects that the other device is actively attacking the network device in the network, the network management system issues a second instruction, where the second instruction carries the IP address of the network device, and therefore the network corresponding to the IP address The device can receive the second command.
- the network management system can send the second command Telnet 192.168.0.1, where 192.168.0.1 is the IP address of the network device and the network device with the IP address 192.168.0.1
- the second instruction can be received.
- the network management system establishes a connection with the network device by using the second instruction.
- the network device After receiving the second command sent by the network management device, the network device automatically establishes a connection with the network management system, so that the network management system can communicate with the network device through the connection.
- the network management system sends a first instruction to the network device.
- the network real-time status monitoring system acquires the physical port of the network device, and the network management system sends the first instruction to the network device through the established connection, so that the other device cannot be Connect to the network device through the physical port of the network device.
- the network management system can send a shutdown command to the network device to shut down a physical port of the network device.
- the network device disconnects the network device from the other device according to the first instruction.
- the network device closes the port connected to the other device on the network device according to the first instruction, so as to disconnect the network device from the other device.
- the physical port of the network device may be one or more, and the physical port connected to the other device may be obtained by using the network real-time state monitoring system. After the network device receives the first instruction, the network device Execute the contents of the first instruction and close the physical port connected to other devices without affecting the operation of the network device.
- the network management system establishes a connection with the network device by sending a second instruction to the network device, and sends a first instruction to the network device through the connection, disconnecting the network device from the other device.
- the technical solution provided by the embodiment of the present application automatically determines the location of other devices actively attacked by the data detected by the network management system, and processes the information in time, and the determination is accurate, the positioning accuracy is improved, the processing efficiency is improved, and the processing efficiency is improved.
- the security of the network solves the problem that the manual processing method is used in the prior art, and the processing efficiency is low.
- FIG. 4 is a schematic flowchart of a method for obtaining an IP address of a network device by the network management system provided by the present application. As shown in FIG. 4, the method for obtaining the IP address of the network device by the network management system provided by the embodiment of the present application may include the following steps. :
- the network management system acquires an IP address of another device.
- the DPI system in the network management system obtains the IP address of the other device by analyzing the data packet in the physical link.
- the network real-time status monitoring system obtains the IP address and physical port of the IP address of the other device, that is, the IP address and physical port of the network device, based on the IP address of the other device analyzed by the DPI system and the physical link topology information.
- the method for obtaining the IP address of the network device by the network management system provided by the embodiment of the present application, after obtaining the IP address of the other device through the network management system, using the uniqueness of the data packet transmission line in the physical link, and obtaining the connection of other devices.
- the IP address of the network device so that the network management system can establish a connection with the network device through the second instruction through the IP address of the network device, and send the first instruction to the network device, close the interface of the network device, and then disconnect other devices and networks.
- the connection of the device improves the timeliness, improves the positioning accuracy, and improves the processing efficiency.
- FIG. 5 is a schematic structural diagram of a network abnormality processing system provided by the present application.
- the network abnormality processing system provided by the embodiment of the present application includes: a network management system 11, other devices 12, and a network device 13.
- the network management system 11 is configured to disconnect the network device 13 from the other device 12 if it detects that the other device 12 actively attacks the network device 13 in the network, causing traffic abnormality in the network.
- the network management system 11 is specifically configured to: send a first instruction to the network device 13;
- the network device 13 is configured to disconnect the network device 13 from the other device 12 according to the first instruction.
- the network management system 11 is further configured to: send a second instruction to the network device 13 before sending the first instruction to the network device 13;
- the network device 13 is further configured to establish a connection with the network management system 11 according to the second instruction;
- the network management system 11 is specifically configured to: send a first instruction to the network device 13 through the established connection.
- network device 13 is specifically configured to:
- the port to which the network device 13 is connected to the other device 12 is turned off to disconnect the network device 13 from the other device 12.
- the network management system 11 is further configured to: obtain an IP address of the other device 12 before sending the second instruction to the network device 13; and confirm the IP address of the network device 13 according to the IP address of the other device 12;
- the network management system 11 is specifically configured to: send a second instruction to the network device 13 according to the IP address of the network device 13.
- the device provided in this embodiment may be used to implement the technical solution of the method embodiment shown in FIG. 1 , FIG. 3 or FIG. 4 , and the implementation principle and technical effects are similar, and details are not described herein again.
- the aforementioned program can be stored in a computer readable storage medium.
- the program when executed, performs the steps including the foregoing method embodiments; and the foregoing storage medium includes various media that can store program codes, such as a ROM, a RAM, a magnetic disk, or an optical disk.
- the device embodiments described above are merely illustrative, wherein the units illustrated as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, ie may be located in one place. Or it can be distributed to at least two network elements. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of the embodiment. Those of ordinary skill in the art can understand and implement without deliberate labor.
Landscapes
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
本申请实施例提供一种网络异常的处理方法及系统。本申请实施例提供的网络异常的处理方法，执行在网络管理系统上，该方法包括：若检测到其他设备主动攻击网络中的网络设备导致网络发生流量异常，断开所述网络设备与所述其他设备之间的连接。本申请实施例提供的技术方案通过网络管理系统检测到的数据自动确定主动攻击的其他设备的位置并及时进行处理，判断准确，提升了定位精度，提高了处理效率，进而提高了网络的安全性。
Description
本申请涉及互联网通信技术领域，尤其涉及一种网络异常的处理方法及系统。
随着科学技术的飞速发展，互联网已经成为用户获取各种资源、查询各种信息等的重要手段，使得网络已经成为人类社会生活和经济生活中重要的基础设施。由于用户对网络的依赖日益见长，使得网络中的流量利用率不断升高，网络负荷不断增大，流量的波动日渐频繁。
网络中流量的波动是频繁发生的，流量的波动一般分为正常波动和异常波动。正常波动通常是因为网络中用户的增加或者业务使用量的增加产生的。这种波动比较平稳，并且呈现上升趋势。只要处理及时，流量的正常波动不会危害网络的稳定性和安全性。然而，当网络中的流量在较短时间内出现异常波动，会产生巨大的流量，甚至导致网络拥塞。
现有技术中，异常波动多为其他设备主动攻击网络中的网络设备所造成，对于这种流量的异常波动，目前多采用人工处理的方式解决来解决，因此处理效率比较低。
申请内容
本申请提供一种网络异常的处理方法及系统，网络管理系统自动处理其他设备主动攻击网络中的网络设备所产生的流量异常波动，提高了处理效率。
本申请提供一种网络异常的处理方法，其特征在于，执行在网络管理系统上，所述方法包括：
若检测到其他设备主动攻击网络中的网络设备导致网络发生流量异常，断开所述网络设备与所述其他设备之间的连接。进一步地，上述方法中，断开所述网络设备与所述其他设备之间的连接，包括：
向所述网络设备发送第一指令，以便于所述网络设备根据所述第一指令，断开所述网络设备与所述其他设备之间的连接。
进一步地，上述方法中，向所述网络设备发送第一指令之前，所述方法还包括：
向所述网络设备发送第二指令，以便于所述网络设备根据所述第二指令建立与所述网络管理系统之间的连接；
向所述网络设备发送第一指令，包括：通过建立的连接向所述网络设备发送所述第一指令。
进一步地，上述方法中，所述网络设备根据所述第一指令，断开所述网络设备与所述其他设备之间的连接，包括：
所述网络设备根据所述第一指令，关闭所述网络设备上与所述其他设备连接的端口，以断开所述网络设备与所述其他设备之间的连接。
进一步地，上述方法中，向所述网络设备发送第二指令之前，所述方法还包括：
获取所述其他设备的IP地址；以及，根据所述其他设备的IP地址确认所述网络设备的IP地址；
向所述网络设备发送第二指令，包括：根据所述网络设备的IP地址，向所述网络设备发送第二指令。
本申请实施例还提供一种网络异常的处理系统，所述系统包括网络管理系统、其他设备和网络设备；其中，
所述网络管理系统，用于若检测到其他设备主动攻击网络中的网络设备导致网络发生流量异常，断开所述网络设备与所述其他设备之间的连接。
进一步地，上述系统中，所述网络管理系统，具体用于：向所述网络设备发送第一指令；
所述网络设备，用于根据所述第一指令，断开所述网络设备与所述其他设备之间的连接。
进一步地，上述系统中，所述网络管理系统，还用于：向所述网络设备发送第一指令之前，向所述网络设备发送第二指令；
所述网络设备，还用于根据所述第二指令建立与所述网络管理系统之
间的连接；
所述网络管理系统，具体用于：通过建立的连接向所述网络设备发送所述第一指令。
进一步地，上述系统中，所述网络设备，具体用于：
根据所述第一指令，关闭所述网络设备与所述其他设备连接的端口，以断开所述网络设备与所述其他设备之间的连接。
进一步地，上述系统中，所述网络设备，所述网络管理系统，还用于：向所述网络设备发送第二指令之前，获取所述其他设备的IP地址；以及，根据所述其他设备的IP地址确认所述网络设备的IP地址；
所述网络管理系统用于向所述网络设备发送第二指令时，具体用于：根据所述网络设备的IP地址，向所述网络设备发送第二指令。
本申请实施例提供的网络异常的处理方法及系统，当确定是由其他设备主动攻击网络中的网络设备而导致网络发生流量异常时，网络管理系统断开网络设备与其他设备之间的连接，通过网络管理系统自动且及时的进行处理，提高了处理效率，进而提高了网络的安全性，解决了现有技术中使用人工处理的方式，处理效率低的问题。
为了更清楚地说明本申请实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作一简单地介绍，显而易见地，下面描述中的附图是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1为本申请提供的网络异常的处理方法实施例二的流程示意图；
图2为本申请提供的网络异常的处理方法实施例二的应用场景图；
图3为本申请提供的网络异常的处理方法实施例三的流程示意图；
图4为本申请提供的网络管理系统获得网络设备的IP地址的方法的流程示意图；
图5为本申请提供的网络异常的处理系统的结构示意图。
为使本申请实施例的目的、技术方案和优点更加清楚，下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
实施例一
本申请实施例提供的网络异常的处理方法可以包括：若检测到其他设备主动攻击网络中的网络设备导致网络发生流量异常，断开网络设备与其他设备之间的连接。
实施例二
图1为本申请提供的网络异常的处理方法实施例二的流程示意图，图2为本申请提供的网络异常的处理方法实施例二的应用场景图，如图1和图2所示，本申请实施例提供的网络异常的处理方法，可以执行在网络管理系统上，该方法可以包括如下步骤：
201、确定导致网络发生流量异常的原因为其他设备主动攻击网络中的网络设备。
202、若检测到其他设备主动攻击网络中的网络设备导致网络发生流量异常，断开网络设备与其他设备之间的连接。
在本申请实施例中提供一种可以应用于网络管理系统的网络异常的处理方法，以实现依靠网络管理系统及时发现其他设备主动攻击网络中的网络设备，进而自动进行处理。
在本申请实施例中，网络管理系统可以包含网络实时状态监控系统、网络分析系统和DPI(Deep Packet Inspection，深度包检测)系统。其中，网络实时状态监控系统可以对网络中的所有网络设备进行监控，获取所有网络设备的信息、物理链路的实时流量、网络拓扑等。DPI系统可以对网络中物理链路中数据流进行识别，以获得流量的来源与流量的流向，还可以进行业务或类型分析等。网络分析系统可以监测用户数量是否发生变化、IP地址利用率变化、流量历史数据等。
本申请实施例中，通过网络管理系统获取数据信息，并对获取到的数据信息进行分析与计算，分析与计算的结果能够反映出网络的实时运行状态，进而对网络是否发生异常进行检测。
当网络管理系统确定其他设备主动攻击网络中的网络设备后，利用DPI系统对异常流量数据包进行分析，根据其他设备IP固定的这一特点，捕获到其他设备的IP地址，并显示其他设备所直连的设备(即遭受攻击的网络设备)、端口等物理信息，完成对主动攻击的其他设备以及遭受攻击的网络设备的信息获取。
获取到相应的网络设备信息后，利用网络实时状态监控系统对网络中发生的流量异常进行处理，其可以是获取遭受攻击的网络设备的物理信息后，网络管理系统可以与遭受攻击的网络设备进行连接。
举例说明，在本申请实施例中，断开网络设备与其他设备之间的连接的实现方法可以是：
向网络设备发送第一指令，以便于网络设备根据第一指令，断开网络设备与其他设备之间的连接。
本申请实施例提供的网络异常的处理方法，当确定是由其他设备主动攻击网络中的网络设备而导致网络发生流量异常时，网络管理系统断开网络设备与其他设备之间的连接，通过网络管理系统自动且及时的进行处理，提高了处理效率，进而提高了网络的安全性，解决了现有技术中使用人工处理的方式，处理效率低的问题。
实施例三
图3为本申请提供的网络异常的处理方法实施例三的流程示意图，如图3所示，本申请实施例提供的网络异常的处理方法，可以包括如下步骤：
301、网络管理系统向网络设备发送第二指令。
在本申请实施例中，网络管理系统检测到其他设备正在主动攻击网络中的网络设备后，网络管理系统发出第二指令，第二指令中携带网络设备的IP地址，因此该IP地址对应的网络设备可以接收到第二指令。
例如，网络管理系统可以发送第二指令Telnet 192.168.0.1，其中192.168.0.1为网络设备的IP地址，IP地址为192.168.0.1的网络设备
可以接收到该第二指令。
302、网络管理系统通过第二指令与网络设备建立连接。
网络设备在接收到由网络管理设备发送的第二指令后，自动与网络管理系统建立连接，使得网络管理系统可以通过该连接与网络设备进行通信。
303、网络管理系统向网络设备发送第一指令。
在本申请实施例中，网络管理系统与网络设备建立连接后，利用网络实时状态监控系统获取到网络设备的物理端口，网络管理系统通过建立的连接向网络设备发送第一指令，使得其他设备无法通过网络设备的物理端口与网络设备进行连接。例如，网络管理系统可以向网络设备发送关闭命令，以关闭网络设备的某一个物理端口。
304、网络设备根据第一指令，断开网络设备与其他设备之间的连接。
网络设备根据第一指令，关闭网络设备上与其他设备连接的端口，以断开网络设备与其他设备之间的连接。
在本申请实施例中，网络设备的物理端口可以有一个，也可以有多个，与其他设备连接的物理端口可以利用网络实时状态监控系统获取到，网络设备接收到第一指令后，网络设备执行第一指令的内容，关闭与其他设备连接的物理端口，且不会影响该网络设备的运行。
本申请实施例提供的网络异常的处理方法，网络管理系统通过向网络设备发送第二指令与网络设备建立连接，并通过该连接向网络设备发送第一指令，断开与网络设备与其他设备之间的连接，本申请实施例提供的技术方案，通过网络管理系统检测到的数据自动确定主动攻击的其他设备的位置并及时进行处理，判断准确，提升了定位精度，提高了处理效率，进而提高了网络的安全性，解决了现有技术中使用人工处理的方式，处理效率较低的问题。
实施例四
图4为本申请提供的网络管理系统获得网络设备的IP地址的方法的流程示意图，如图4所示，本申请实施例提供的网络管理系统获得网络设备的IP地址的方法，可以包括如下步骤：
401、网络管理系统获取其他设备的IP地址。
在本申请实施例中，网络管理系统中的DPI系统通过对物理链路中的数据包进行分析，获取到其他设备的IP地址。
402、根据其他设备的IP地址确认网络设备的IP地址。
网络实时状态监控系统根据DPI系统分析得到的其他设备的IP地址，结合物理链路拓扑信息，获得其他设备的IP地址所连接的IP地址以及物理端口，即网络设备的IP地址以及物理端口。
本申请实施例提供的网络管理系统获得网络设备的IP地址的方法，通过网络管理系统获取其他设备的IP地址后，利用物理链路中数据包发送线路具有单一性的特点，获得其他设备所连接的网络设备的IP地址，使得网络管理系统可以通过网络设备的IP地址通过第二指令与网络设备建立连接，并向网络设备发送第一指令，关闭网络设备的接口，进而断开其他设备与网络设备的连接，提高了时效性，提升了定位精度，提高了处理效率。
实施例五
图5为本申请提供的网络异常的处理系统的结构示意图。如图5所示，本申请实施例提供的网络异常的处理系统包括：网络管理系统11、其他设备12和网络设备13。
其中，网络管理系统11，用于若检测到其他设备12主动攻击网络中的网络设备13导致网络发生流量异常，断开网络设备13与其他设备12之间的连接。
进一步地，网络管理系统11，具体用于：向网络设备13发送第一指令；
网络设备13，用于根据第一指令，断开网络设备13与其他设备12之间的连接。
进一步地，网络管理系统11，还用于：向网络设备13发送第一指令之前，向网络设备13发送第二指令；
网络设备13，还用于根据第二指令建立与网络管理系统11之间的连接；
网络管理系统11，具体用于：通过建立的连接向网络设备13发送第一指令。
进一步地，网络设备13，具体用于：
根据第一指令，关闭网络设备13与其他设备12连接的端口，以断开网络设备13与其他设备12之间的连接。
进一步地，网络管理系统11，还用于：向网络设备13发送第二指令之前，获取其他设备12的IP地址；以及，根据其他设备12的IP地址确认网络设备13的IP地址；
网络管理系统11用于向网络设备13发送第二指令时，具体用于：根据网络设备13的IP地址，向网络设备13发送第二指令。
本实施例所提供的装置，可以用于执行图1、图3或图4所示方法实施例的技术方案，其实现原理和技术效果类似，此处不再赘述。
本领域普通技术人员可以理解：实现上述各方法实施例的全部或部分步骤可以通过程序指令相关的硬件来完成。前述的程序可以存储于一计算机可读取存储介质中。该程序在执行时，执行包括上述各方法实施例的步骤；而前述的存储介质包括：ROM、RAM、磁碟或者光盘等各种可以存储程序代码的介质。
以上所描述的装置实施例仅仅是示意性的，其中作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到至少两个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。本领域普通技术人员在不付出创造性的劳动的情况下，即可以理解并实施。
最后应说明的是：以上各实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述各实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分或者全部技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的范围。
Claims (10)
- 一种网络异常的处理方法，其特征在于，执行在网络管理系统上，所述方法包括：若检测到其他设备主动攻击网络中的网络设备导致网络发生流量异常，断开所述网络设备与所述其他设备之间的连接。
- 根据权利要求1所述的方法，其特征在于，断开所述网络设备与所述其他设备之间的连接，包括：向所述网络设备发送第一指令，以便于所述网络设备根据所述第一指令，断开所述网络设备与所述其他设备之间的连接。
- 根据权利要求2所述的方法，其特征在于，向所述网络设备发送第一指令之前，所述方法还包括：向所述网络设备发送第二指令，以便于所述网络设备根据所述第二指令建立与所述网络管理系统之间的连接；向所述网络设备发送第一指令，包括：通过建立的连接向所述网络设备发送所述第一指令。
- 根据权利要求2所述的方法，其特征在于，所述网络设备根据所述第一指令，断开所述网络设备与所述其他设备之间的连接，包括：所述网络设备根据所述第一指令，关闭所述网络设备上与所述其他设备连接的端口，以断开所述网络设备与所述其他设备之间的连接。
- 根据权利要求3所述的方法，其特征在于，向所述网络设备发送第二指令之前，所述方法还包括：获取所述其他设备的IP地址；以及，根据所述其他设备的IP地址确认所述网络设备的IP地址；向所述网络设备发送第二指令，包括：根据所述网络设备的IP地址，向所述网络设备发送第二指令。
- 一种网络异常的处理系统，其特征在于，所述系统包括网络管理系统、其他设备和网络设备；其中，所述网络管理系统，用于若检测到其他设备主动攻击网络中的网络设备导致网络发生流量异常，断开所述网络设备与所述其他设备之间的连接。
- 根据权利要求6所述的系统，其特征在于，所述网络管理系统，具体用于：向所述网络设备发送第一指令；所述网络设备，用于根据所述第一指令，断开所述网络设备与所述其他设备之间的连接。
- 根据权利要求7所述的系统，其特征在于，所述网络管理系统，还用于：向所述网络设备发送第一指令之前，向所述网络设备发送第二指令；所述网络设备，还用于根据所述第二指令建立与所述网络管理系统之间的连接；所述网络管理系统，具体用于：通过建立的连接向所述网络设备发送所述第一指令。
- 根据权利要求8所述的系统，其特征在于，所述网络设备，具体用于：根据所述第一指令，关闭所述网络设备与所述其他设备连接的端口，以断开所述网络设备与所述其他设备之间的连接。
- 根据权利要求8所述的系统，其特征在于，所述网络管理系统，还用于：向所述网络设备发送第二指令之前，获取所述其他设备的IP地址；以及，根据所述其他设备的IP地址确认所述网络设备的IP地址；所述网络管理系统用于向所述网络设备发送第二指令时，具体用于：根据所述网络设备的IP地址，向所述网络设备发送第二指令。
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| PCT/CN2016/096600 WO2018035770A1 (zh) | 2016-08-24 | 2016-08-24 | 网络异常的处理方法及系统 |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| PCT/CN2016/096600 WO2018035770A1 (zh) | 2016-08-24 | 2016-08-24 | 网络异常的处理方法及系统 |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| WO2018035770A1 true WO2018035770A1 (zh) | 2018-03-01 |
Family
ID=61245963
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| PCT/CN2016/096600 WO2018035770A1 (zh) | 2016-08-24 | 2016-08-24 | 网络异常的处理方法及系统 |
Country Status (1)
| Country | Link |
|---|---|
| WO (1) | WO2018035770A1 (zh) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109194539A (zh) * | 2018-08-13 | 2019-01-11 | 中国平安人寿保险股份有限公司 | 数据管控方法、装置、计算机设备及存储介质 |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1441365A (zh) * | 2002-02-28 | 2003-09-10 | 北京中电网安科技有限公司 | 大中型内部网络安全防护系统及方法 |
| CN1791021A (zh) * | 2005-12-21 | 2006-06-21 | 杭州华为三康技术有限公司 | 一种入侵检测系统与网络设备联动的系统及方法 |
| CN1988439A (zh) * | 2006-12-08 | 2007-06-27 | 亿阳安全技术有限公司 | 实现网络安全的装置及方法 |
| CN102088455A (zh) * | 2010-12-03 | 2011-06-08 | 成都飞鱼星科技开发有限公司 | Asn防攻击安全联动系统及其实现方法 |
| CN102710627A (zh) * | 2012-05-25 | 2012-10-03 | 北京神州绿盟信息安全科技股份有限公司 | 一种蠕虫检测方法及装置 |
-
2016
- 2016-08-24 WO PCT/CN2016/096600 patent/WO2018035770A1/zh active Application Filing
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1441365A (zh) * | 2002-02-28 | 2003-09-10 | 北京中电网安科技有限公司 | 大中型内部网络安全防护系统及方法 |
| CN1791021A (zh) * | 2005-12-21 | 2006-06-21 | 杭州华为三康技术有限公司 | 一种入侵检测系统与网络设备联动的系统及方法 |
| CN1988439A (zh) * | 2006-12-08 | 2007-06-27 | 亿阳安全技术有限公司 | 实现网络安全的装置及方法 |
| CN102088455A (zh) * | 2010-12-03 | 2011-06-08 | 成都飞鱼星科技开发有限公司 | Asn防攻击安全联动系统及其实现方法 |
| CN102710627A (zh) * | 2012-05-25 | 2012-10-03 | 北京神州绿盟信息安全科技股份有限公司 | 一种蠕虫检测方法及装置 |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109194539A (zh) * | 2018-08-13 | 2019-01-11 | 中国平安人寿保险股份有限公司 | 数据管控方法、装置、计算机设备及存储介质 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US20190014137A1 (en) | IoT DEVICE SECURITY | |
| US9369434B2 (en) | Whitelist-based network switch | |
| US20070260721A1 (en) | Physical server discovery and correlation | |
| US10263975B2 (en) | Information processing device, method, and medium | |
| JP6711710B2 (ja) | 監視装置、監視方法および監視プログラム | |
| CN107078946A (zh) | 业务流处理策略的处理方法、装置和系统 | |
| US20230275818A1 (en) | Increasing data availability | |
| US12009986B2 (en) | Proactive inspection technique for improved classification | |
| US11310098B2 (en) | Diagnosing intermediary network nodes | |
| US20230261940A1 (en) | Network Intention Monitoring Method, Network Intention Monitoring System, and Storage Medium | |
| WO2016197782A2 (zh) | 一种服务端口管理的方法、装置和计算机可读存储介质 | |
| CN107241307B (zh) | 一种基于报文内容的自学习的网络隔离安全装置和方法 | |
| WO2020132949A1 (zh) | 用于工业控制系统的监测方法、装置、系统和计算机可读介质 | |
| WO2018035765A1 (zh) | 网络异常的检测方法及装置 | |
| US20230421466A1 (en) | Generating network system maps based on network traffic | |
| US20230308370A1 (en) | Agentless network traffic mapping | |
| WO2018035770A1 (zh) | 网络异常的处理方法及系统 | |
| US20210367829A1 (en) | Iot application learning | |
| CN113114588B (zh) | 数据处理方法、装置、电子设备和存储介质 | |
| JP5925287B1 (ja) | 情報処理装置、方法およびプログラム | |
| JP2010239392A (ja) | サービス不能攻撃制御システム、装置、および、プログラム | |
| US10992644B2 (en) | Network security system and method thereof | |
| US10523702B2 (en) | Methods and apparatus to control network connections | |
| US10742480B2 (en) | Network management as a service (MaaS) using reverse session-origination (RSO) tunnel | |
| US20220417268A1 (en) | Transmission device for transmitting data |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| 121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 16913793 Country of ref document: EP Kind code of ref document: A1 |
|
| NENP | Non-entry into the national phase |
Ref country code: DE |
|
| 122 | Ep: pct application non-entry in european phase |
Ref document number: 16913793 Country of ref document: EP Kind code of ref document: A1 |