WO2019136954A1

WO2019136954A1 - Method for detecting network compliance, apparatus, device and medium

Info

Publication number: WO2019136954A1
Application number: PCT/CN2018/096108
Authority: WO
Inventors: 戴昌; 涂大志; 王新成
Original assignee: 深圳市联软科技股份有限公司
Priority date: 2018-01-15
Filing date: 2018-07-18
Publication date: 2019-07-18
Also published as: CN108322452A

Abstract

Provided in the present invention are a method for detecting network compliance, an apparatus, a device and a medium; the method comprises: fully mirroring, onto a designated server network card, traffic information generated by all terminals within the intranet; according to the traffic information on the server network card, detecting whether each terminal is installed having designated software; and transmitting a non-compliance warning to terminals that do not have the designated software installed thereon so as to prompt a user to install the designated software. The method for detecting network compliance, apparatus, device and medium provided in the present invention achieve the detection of asset safety of a terminal, possible existing risk in the intranet, external attack behaviors, and non-compliance behavior of the terminal by means of network data analysis; existing risks for the terminal are detected when transparent to a terminal user and the terminal may be warned, thereby guaranteeing intranet safety.

Description

Network compliance detection method, device, device and medium

Technical field

The present invention relates to the field of network security technologies, and in particular, to a network compliance detection method, apparatus, device, and medium.

Background technique

Many of the existing terminal products (such as desktop operation and maintenance, security protection, and monitoring and auditing products) rely on the successful deployment and operation of the terminal. The operation of the functions depends on the successful deployment and operation of the intranet terminals, and the management effect depends on them. Deployment and operation of the intranet terminal. At present, the three main factors hindering the development of internal network management technology are: First, in most organizations, the intranet is heterogeneous - the hardware and software components contained in the intranet are manufactured by multiple companies. Second, technology is constantly changing, which means new devices and new services are constantly emerging. Third, most intranets are relatively large, which means that some parts of the intranet are far apart from other parts, and it may be particularly difficult to detect the cause of communication problems in remote devices.

However, the existing intranet management method is mainly performed by installing similar monitoring software to the terminal. It is difficult for administrators to guarantee the installation rate of software, and it is impossible to manage a large number of terminals in a unified manner. In other words, the existing intranet management methods are not sufficiently effective and flexible.

Summary of the invention

The technical problem to be solved by the present application is to provide a network compliance detection method, device, device and medium, which realizes asset security of the terminal, possible risks in the intranet, external attack behavior, and terminal disagreement through network data analysis. The behavior of the rule is detected. When the terminal user is transparent, the risk of the terminal is detected, and the terminal can be alerted to ensure the security of the internal network.

To solve the above technical problem, the technical solution provided by the present application is:

In a first aspect, the embodiment of the present application provides a network compliance detection method, where the method includes:

All the traffic information generated by all the terminals in the internal network is mirrored to the specified server network card;

Detect whether the specified software is installed on each terminal according to the traffic information on the server network card;

A non-compliant alarm is sent to the terminal that does not have the specified software installed to prompt the user to install the specified software.

Preferably, according to the traffic information on the server network card, detecting whether the specified software is installed on each terminal, includes:

Determining a software time window required for the terminal to communicate with a software server corresponding to the specified software;

When the terminal does not generate traffic that communicates with the software server in the software time window, it is determined that the specified software is not installed on the terminal.

Preferably, the software time window required for the terminal to communicate with the software server corresponding to the specified software is determined, including:

Counting, by the at least three terminals, the quantity value of the communication data packet respectively sent to the software server within the first time length;

Take the median of multiple quantity values;

Calculating an average number of communication packets sent by the terminal to the software server according to the median, calculating the average length of the second time interval;

When the average quantity value is greater than the preset first value, determining the second time length as a software time window;

When the average number value is less than the first value, the product of the smallest integer greater than the ratio of the first value to the average number value, and the second time length, is determined as the software time window.

Preferably, the method further comprises: detecting, according to the traffic information on the server network card, whether each terminal uses a proxy server for network communication.

Preferably, the method further comprises:

A non-compliant alarm is sent to a terminal that does not use a proxy server for network communication to prompt the user to use a proxy server for network communication to ensure network security.

Preferably, the method further comprises: detecting whether each terminal successfully logs into the active directory domain.

Preferably, detecting whether each terminal successfully logs into the active directory domain includes:

Obtaining an authentication package sent by the terminal to the domain controller;

Obtaining a response packet sent by the domain controller to the terminal for the authentication packet;

According to the information in the authentication package and the information in the response packet, it is determined whether the terminal successfully logs in to the active directory domain.

In a second aspect, the embodiment of the present application provides a network compliance detecting apparatus, where the apparatus includes:

a mirroring unit, configured to mirror all traffic information generated by all terminals in the internal network to a specified server network card;

a detecting unit, configured to detect, according to the traffic information on the server network card, whether the specified software is installed on each terminal;

The alarm unit is configured to send a non-compliant alarm to the terminal that does not have the specified software to prompt the user to install the specified software.

Preferably, the detecting unit is specifically configured to:

Preferably, the detecting unit is further configured to:

Take the median of multiple quantity values;

Preferably, the detecting unit is further configured to:

And detecting, according to the traffic information on the server network card, whether each of the terminals uses a proxy server for network communication.

Preferably, the alarm unit is further configured to:

Preferably, the detecting unit is further configured to: detect whether each terminal successfully logs in to the active directory domain.

Preferably, the detecting unit is further configured to:

In a third aspect, an embodiment of the present application provides a computer device, including: at least one processor, at least one memory, and computer program instructions stored in a memory, which are implemented when the computer program instructions are executed by the processor. The method of the first aspect.

In a fourth aspect, an embodiment of the present application provides a computer readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the method of the first aspect of the above embodiments.

The network compliance detection method, device, device and medium provided by the embodiments of the present invention detect network assets security, possible risks in the intranet, external attack behaviors, and terminal non-compliance behaviors through network data analysis. When the terminal user is transparent, the risk of the terminal is detected, and the terminal can be alerted to ensure the security of the internal network.

The beneficial effects of the application are:

1. No need to install any detection software in the terminal, and get rid of the dependence on the successful deployment and operation of the terminal software.

2. The detection mode of the managed terminal is transparent.

3. The terminal can be managed uniformly on the server side.

4. The software and hardware structure of the terminal can be ignored.

5. Simple deployment, wide detection range and high accuracy.

DRAWINGS

FIG. 1 is a flowchart of a network compliance detecting method according to an embodiment of the present invention;

2 is a block diagram of a network compliance detecting apparatus according to an embodiment of the present invention;

FIG. 3 is a schematic structural diagram of hardware of a computer device according to an embodiment of the present invention.

Detailed ways

The invention is further illustrated by the following examples, which are intended to be in no way intended to

Embodiment 1

With reference to FIG. 1, the network compliance detection method provided by this embodiment includes:

Step S1: Mirror all the traffic information generated by all the terminals in the internal network to the designated server network card;

Step S2: detecting, according to the traffic information on the server network card, whether the specified software is installed on each terminal;

In step S3, a non-compliant alarm is sent to the terminal that does not have the specified software to prompt the user to install the specified software.

The network compliance detection method provided by the embodiment of the present invention detects the non-compliance behavior of the terminal through network data analysis, detects the risk of the terminal when the terminal user is transparent, and can alarm the terminal. Guarantee the security of the internal network.

Specifically, the method of the present embodiment mainly relies on a pre-built network security prism system to operate. Specifically, on the switch of the internal network, all the traffic of the intranet is mirrored to the network card of the network security prism system server, and then the specific data or characteristics of the traffic of the server network card are captured and analyzed.

Further preferably, the software time window required for the terminal to communicate with the software server corresponding to the specified software is determined, including:

Take the median of multiple quantity values;

Specifically, in this embodiment, all traffic in the intranet of the enterprise is recorded in the server network card. In addition, in this embodiment, the software time window is used to determine whether the terminal is installed with the specified software, and specifically, after obtaining the software time window, whether the terminal has installed or not in the software time window to confirm whether the terminal is installed or not is installed. The software. The software time window is the communication interval between the terminal and the software server corresponding to the specified software.

Specifically, in order to obtain the software time window of the specified software, after defining the server IP and port of the software, by analyzing the traffic within a plurality of days, the number of communication packets in which each IP communicates with the software is recorded. Take the median of the number and then calculate how many communication packets the source IP sent to the software server every 15 minutes. If the number is greater than 3, the software time window is set to 15 minutes; when less than 3, the smallest integer a is greater than 3/the number of communication packets, and the software time window is set to a*15 minutes.

Further preferably, the method further comprises: detecting, according to the traffic information on the server network card, whether each terminal uses a proxy server for network communication.

In this embodiment, specifically, for detecting whether the terminal uses the proxy server function, the following characteristic parts of the communication traffic with the proxy server are utilized:

1) HTTP proxy: Common port 8080, using the HTTP protocol.

Before the terminal sends the data, the terminal sends an HTTP packet of the "CONNECT" type to the proxy server, and tells the proxy server terminal the destination address IP and port to be accessed. And the HTTP package contains proxy-related variables, such as "Proxy-Connection". Specifically, for example, an HTTP proxy is used to log in to QQ.

2) SOCKS proxy: commonly used port 1080, using the Socks protocol.

Before the terminal sends the data, the terminal sends a "Connect" type Scoks packet to the proxy server, and tells the proxy server terminal the destination address IP and port to be accessed. Specifically, for example, the QQ is registered using the SOCKS proxy.

Further preferably, the method further comprises:

In this embodiment, it should be noted that the full name of the proxy server in English is (Proxy Server), and its function is to proxy network users to obtain network information. The proxy server is a transit point for network information, just like a large Cache, which can significantly improve browsing speed and efficiency. More importantly: Proxy Server (Proxy Server) is an important security function provided by Internet link-level gateways. The main functions are: breaking through its own IP access restrictions, improving access speed, and hiding real IP from attacks.

Further preferably, detecting whether each terminal successfully logs into the active directory domain includes:

Based on the information in the authentication package and the information in the response packet, determine whether the terminal successfully logs into the Active Directory domain.

In this embodiment, when logging in to the Active Directory (AD) domain, the terminal sends an authentication packet to the domain controller, and the protocol of the authentication packet adopts kerberos. In the wireshark, the detailed information in the authentication packet can be viewed, and after parsing, The information of the authentication package includes information such as a user name and a domain name. In addition, the embodiment determines whether the terminal successfully logs in to the active directory domain according to the authentication package and the response packet.

Embodiment 2

With reference to FIG. 2, a network compliance detecting apparatus according to an embodiment of the present invention includes:

The mirroring unit 1 is configured to mirror all the traffic information generated by all the terminals in the internal network to the designated server network card;

The detecting unit 2 is configured to detect, according to the traffic information on the server network card, whether the specified software is installed on each terminal;

The alarm unit 3 is configured to send a non-compliant alarm to the terminal that does not have the specified software to prompt the user to install the specified software.

The network compliance detection apparatus provided by the embodiment of the present invention detects the non-compliance behavior of the terminal through network data analysis, detects the risk of the terminal when the terminal user is transparent, and can alarm the terminal. Guarantee the security of the internal network.

In particular, the present embodiment relies primarily on a pre-built network security prism system to operate. Specifically, all the traffic of the intranet is mirrored on the network card of the network security prism system server on the switch of the internal network, and then the specific data or characteristics of the traffic of the server network card are captured and analyzed.

Preferably, the detecting unit 2 is specifically configured to

Counting the number of communication packets sent by the at least three terminals to the software server respectively within the first time length;

Take the median of multiple quantity values;

Further preferably, the detecting unit 2 is further configured to: according to the traffic information on the server network card, detect whether each terminal uses a proxy server for network communication.

1) HTTP proxy: Common port 8080, using the HTTP protocol.

2) SOCKS proxy: commonly used port 1080, using the Socks protocol.

Further preferably, the alarm unit 3 is further used to:

Preferably, the detecting unit 2 is further configured to: detect whether each terminal successfully logs into the active directory domain.

Further preferably, the detecting unit 2 is further configured to:

Embodiment 3

The network compliance detection method of the embodiment of the present invention described in conjunction with FIG. 3 can be implemented by a computer device. FIG. 3 is a schematic diagram showing the hardware structure of a computer device according to an embodiment of the present invention.

A computer device implementing a network compliance detection method can include a processor 401 and a memory 402 storing computer program instructions.

Specifically, the processor 401 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present invention. .

Memory 402 can include mass storage for data or instructions. By way of example and not limitation, the memory 402 can include a Hard Disk Drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a Universal Serial Bus (USB) drive, or two or more. A combination of more than one of these. Memory 402 may include removable or non-removable (or fixed) media, where appropriate. Memory 402 may be internal or external to the data processing device, where appropriate. In a particular embodiment, memory 402 is a non-volatile solid state memory. In a particular embodiment, memory 402 includes a Read-Only Memory (ROM). Where appropriate, the ROM may be a mask-programmed ROM, a Programmable Read-only Memory (PROM), an Erasable Programmable ROM (EPROM), or an electrically erasable PROM (Electrically Erasable Programmable). Read Only Memory (EEPROM), electrically rewritable ROM (EAROM) or flash memory or a combination of two or more of these.

The processor 401 implements any of the network compliance detection methods of the above embodiments by reading and executing computer program instructions stored in the memory 402.

In one example, the computer device can also include a communication interface 403 and a bus 410. As shown in FIG. 3, the processor 401, the memory 402, and the communication interface 403 are connected by the bus 410 and complete communication with each other.

The communication interface 403 is mainly used to implement communication between modules, devices, units and/or devices in the embodiments of the present invention.

Bus 410 includes hardware, software, or both that couples components of the computer device to each other. By way of example and not limitation, the bus may include Accelerated Graphic Ports (AGP) or other graphics bus, Enhanced Industry Standard Architecture (ESA) bus, Front Side Bus (FSB), Super HyperTransport (HT) interconnect, Industry Standard Architecture (ISA) bus, infinite bandwidth interconnect, Low Pin Count (LPC) bus, memory bus, MicroChannel Architecture (MCA) ) Bus, Peripheral Component Interconnect (PCI) bus, PCI-Express (PCI-X) bus, Serial Advanced Technology Attachment (SATA) bus, Video Electronics Standards Association (VESA local bus) , VLB) bus or other suitable bus or a combination of two or more of these. Bus 410 may include one or more buses, where appropriate. Although specific embodiments of the present invention are described and illustrated, the present invention contemplates any suitable bus or interconnect.

Embodiment 4

In addition, in conjunction with the network compliance detection method in the foregoing embodiment, the embodiment of the present invention may be implemented by providing a computer readable storage medium. The computer readable storage medium stores computer program instructions; when the computer program instructions are executed by the processor, the network compliance detection method of any of the above embodiments is implemented.

It is to be understood that the invention is not limited to the specific configurations and processes described above and illustrated in the drawings. For the sake of brevity, a detailed description of known methods is omitted here. In the above embodiments, several specific steps have been described and illustrated as examples. However, the method of the present invention is not limited to the specific steps described and illustrated, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after the spirit of the invention.

The functional blocks shown in the block diagrams described above may be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), suitable firmware, plug-ins, function cards, and the like. When implemented in software, the elements of the present invention are programs or code segments that are used to perform the required tasks. The program or code segments can be stored in a machine readable medium or transmitted over a transmission medium or communication link through a data signal carried in the carrier. A "machine-readable medium" can include any medium that can store or transfer information. Examples of machine readable media include electronic circuitry, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, optical media, radio frequency (RF) links, and the like. The code segments can be downloaded via a computer network such as the Internet, an intranet, and the like.

It should also be noted that the exemplary embodiments referred to in the present invention describe some methods or systems based on a series of steps or devices. However, the present invention is not limited to the order of the above steps, that is, the steps may be performed in the order mentioned in the embodiment, or may be different from the order in the embodiment, or several steps may be simultaneously performed.

The above is only a specific embodiment of the present invention, and those skilled in the art can clearly understand that for the convenience and brevity of the description, the specific working processes of the system, module and unit described above can refer to the foregoing method embodiments. The corresponding process in the description will not be repeated here. It should be understood that the scope of the present invention is not limited thereto, and any equivalent modifications or substitutions may be easily conceived by those skilled in the art without departing from the scope of the present invention. It is within the scope of the invention.

While the invention has been described in detail, it is obvious that various changes in the various conditions can be made without departing from the spirit and scope of the invention. It is to be understood that the invention is not limited to the embodiments, but is intended to be included within the scope of the appended claims.

Claims

A network compliance detecting method, the method comprising:

All the traffic information generated by all the terminals in the internal network is mirrored to the specified server network card;

Determining, according to the traffic information on the server network card, whether the specified software is installed on each of the terminals;

Sending a non-compliant alarm to the terminal that does not install the specified software to prompt the user to install the specified software.
The network compliance detection method according to claim 1, wherein the detecting, according to the traffic information on the server network card, whether the specified software is installed on each of the terminals, includes:

Determining a software time window required for the terminal to communicate with a software server corresponding to the specified software;

When the terminal does not generate traffic that communicates with the software server in the software time window, it is determined that the specified software is not installed on the terminal.
The network compliance detection method according to claim 2, wherein the determining a software time window required for the terminal to communicate with the software server corresponding to the specified software comprises:

Counting, by the at least three terminals, a quantity value of the communication data packet respectively sent to the software server within a first time length;

Take the median of multiple quantity values;

Calculating, according to the median, an average number of communication packets sent by the terminal to the software server, for an average interval of the second time interval;

When the average quantity value is greater than a preset first value, determining the second time length as a software time window;

When the average quantity value is less than the first value, a product of a minimum integer greater than a ratio of the first value to the average quantity value and a second time length is determined as a software time window.
The network compliance detecting method according to claim 1, wherein the method further comprises: detecting, according to the traffic information on the server network card, whether each of the terminals uses a proxy server for network communication.
The network compliance detecting method according to claim 4, wherein the method further comprises:

The terminal that does not use the proxy server to perform network communication sends a non-compliant alarm to prompt the user to use the proxy server for network communication to ensure network security.
The network compliance detecting method according to claim 1, wherein the method further comprises: detecting whether each of the terminals successfully logs in to the active directory domain.
The network compliance detection method according to claim 6, wherein the detecting whether each of the terminals successfully logs into an active directory domain comprises:

Obtaining an authentication package sent by the terminal to the domain controller;

Obtaining a response packet sent by the domain controller to the terminal for the authentication packet;

Determining whether the terminal successfully logs in to the active directory domain according to the information in the authentication package and the information in the response packet.
A network compliance detecting apparatus, comprising:

a mirroring unit, configured to mirror all traffic information generated by all terminals in the internal network to a specified server network card;

a detecting unit, configured to detect, according to the traffic information on the server network card, whether the specified software is installed on each of the terminals;

And an alarm unit, configured to send a non-compliant alarm to the terminal that does not install the specified software, to prompt the user to install the specified software.
The network compliance monitoring device according to claim 8, wherein the detecting unit is specifically configured to:

Determining a software time window required for the terminal to communicate with a software server corresponding to the specified software;

When the terminal does not generate traffic that communicates with the software server in the software time window, it is determined that the specified software is not installed on the terminal.
The network compliance monitoring device according to claim 9, wherein the detecting unit is further configured to:

Counting, by the at least three terminals, the quantity value of the communication data packet respectively sent to the software server within the first time length;

Take the median of multiple quantity values;

Calculating an average number of communication packets sent by the terminal to the software server according to the median, calculating the average length of the second time interval;

When the average quantity value is greater than the preset first value, determining the second time length as a software time window;

When the average number value is less than the first value, the product of the smallest integer greater than the ratio of the first value to the average number value, and the second time length, is determined as the software time window.
The network compliance monitoring device according to claim 8, wherein the detecting unit is further configured to:

And detecting, according to the traffic information on the server network card, whether each of the terminals uses a proxy server for network communication.
The network compliance monitoring device according to claim 11, wherein the alarm unit is further configured to:

A non-compliant alarm is sent to a terminal that does not use a proxy server for network communication to prompt the user to use a proxy server for network communication to ensure network security.
The network compliance monitoring apparatus according to claim 12, wherein the detecting unit is further configured to: detect whether each terminal successfully logs into the active directory domain.
The network compliance monitoring device according to claim 13, wherein the detecting unit is further configured to:

Obtaining an authentication package sent by the terminal to the domain controller;

Obtaining a response packet sent by the domain controller to the terminal for the authentication packet;

According to the information in the authentication package and the information in the response packet, it is determined whether the terminal successfully logs in to the active directory domain.
A computer apparatus, comprising: at least one processor, at least one memory, and computer program instructions stored in the memory, when the computer program instructions are executed by the processor, implementing claim 1 The method of any of 7.
A computer readable storage medium having stored thereon computer program instructions, wherein the method of any one of claims 1-7 is implemented when the computer program instructions are executed by a processor.