CN104702424A - Network behavior monitoring method and device - Google Patents

Abstract

The invention discloses a network behavior monitoring method and device, relates to the field of communication technology, and can effectively monitor all user equipment in a home network. In the embodiment of the present invention, the network access device reads the data information carried in the data access request sent by the user equipment to the network side, and then the network access device compares the data information with the predefined illegal data. The data contains data information, and the network access device intercepts the data access request. The solutions provided by the embodiments of the present invention are suitable for monitoring network behaviors.

Description

Method and device for network behavior monitoring

technical field

The invention relates to the field of communication technology, in particular to a method and device for network behavior monitoring.

Background technique

With the widespread application of user equipment such as mobile phones and tablet computers, users can use these user equipment to access the network anytime and anywhere, especially some young users who are addicted to the online world, play games and watch videos online during the time when they should be in class or rest. , Browsing bad websites, etc., have caused adverse effects on the physical and mental health of young people.

At present, the monitoring of user network behavior is mainly to install prevention and control software in user equipment, and monitor the data generated by user network behavior through the prevention and control software. If it is monitored that the user is illegally accessing, the user's network behavior will be blocked.

In the process of existing network behavior monitoring, the inventor found at least the following problems in the prior art: First, the prevention and control software is installed on the user equipment. In the current home network, there are many kinds of user equipment, It is necessary to install prevention and control software on all user devices to realize the overall monitoring and deployment of the home network; in addition, the prevention and control software is installed on user devices, which is easy to be closed or deleted by users who are monitoring objects, and cannot really monitor network behavior. role.

Contents of the invention

Embodiments of the present invention provide a method and device for network behavior monitoring, which can effectively monitor all user equipment in a home network.

In a first aspect, an embodiment of the present invention provides a method for network behavior monitoring, including

The network access device obtains the data access request sent by the user equipment to the network side;

The network access device reads the data information carried in the data access request;

The network access device compares the data information with the predefined illegal data;

If the predefined illegal data includes the data information, the network access device intercepts the data access request.

In the second aspect, an embodiment of the present invention provides an apparatus for monitoring network behavior, the apparatus is located on the network access device side, and the apparatus includes:

an obtaining unit, configured to obtain a data access request sent by the user equipment to the network side;

a reading unit, configured to read the data information carried in the data access request obtained by the obtaining unit;

A comparing unit, configured to compare the data information read by the reading unit with predefined illegal data;

An intercepting unit, configured to intercept the data access request when the comparison result of the comparison unit is that the predefined illegal data contains the data information.

The network behavior monitoring method and device provided by the embodiments of the present invention can read the data information carried in the data access request sent by the user equipment to the network side, and then compare the data information with the predefined illegal data. If the illegal data contains data information, the data access request will be intercepted. Compared with the need to install prevention and control software on each user equipment in the prior art, it is possible to monitor the network behavior of all user equipment in the home network through the upper network access device, without installing anti-virus software on each user equipment. At the same time, it can prevent the user from closing or deleting the prevention and control software on the user equipment, so that effective monitoring of all user equipment under the home network can be realized.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only These are some embodiments of the present invention. For those skilled in the art, other drawings can also be obtained according to these drawings without any creative effort.

Fig. 1 is a flow chart of a method for network behavior monitoring provided by an embodiment of the present invention;

FIG. 2 is a flow chart of another method for network behavior monitoring provided by another embodiment of the present invention;

FIG. 3 is a block diagram of a network behavior monitoring device provided by an embodiment of the present invention;

Fig. 4 is a block diagram of another device for network behavior monitoring provided by another embodiment of the present invention.

Detailed ways

The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some, not all, embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without creative efforts fall within the protection scope of the present invention.

An embodiment of the present invention provides a method for network behavior monitoring. The execution subject of the method is a network access device, specifically a home gateway or a modem. As shown in FIG. 1 , the method includes:

Step 101, the network access device obtains the data access request sent by the user equipment to the network side.

At present, with the widespread use of user equipment such as mobile phones and tablet computers, there are many kinds of user equipment in the home network, and there may be many kinds of user equipment that access the network at the same time, that is, there are many kinds of user equipment that send data access to the network side at the same time. request phenomenon. The existing solution is to process the data access request through the prevention and control software installed on the user equipment. However, in the solution provided by the embodiment of the present invention, when multiple user equipments send data access requests to the network side at the same time, the network access device in the home network simultaneously acquires multiple data access requests sent by multiple user equipments to the network side, and Process the obtained data access request.

Step 102, the network access device reads the data information carried in the data access request.

In this step, the data information may be data content information uploaded by the user equipment to the network side, or may be a Uniform Resource Locator (Uniform Resource Locator, URL) sent by the user equipment to the network side. The data content information may be text information input by the user to the user equipment; the URL is called a web page address, which is a standard resource address on the Internet.

Step 103, the network access device compares the data information with predefined illegal data.

Before step 101, network administrators may pre-set illegal data in the network access device, for example, set sensitive words, illegal URLs, and the like. After the setting is completed, the network access device saves the setting content of the network administrator for comparison in this step.

When the network access device reads the data information carried in the data access request, it compares the data information with predefined illegal data to determine whether the illegal data contains the data information. When the judging result is that the illegal data contains the data information, execute step 104, and when the judging result is that the illegal data does not contain the data information, continue to send the data access request to the network side.

Step 104, if the predefined illegal data contains data information, the network access device intercepts the data access request.

At present, the monitoring of user network behavior is mainly to install prevention and control software in user equipment, and monitor the data generated by user network behavior through the prevention and control software. If it is monitored that the user is conducting illegal access, the prevention and control software will block the user's network behavior. However, the prevention and control software is installed on the user equipment. In the current home network, there are many kinds of user equipment. It is necessary to install the prevention and control software on all the user equipment to realize the overall monitoring deployment of the home network. In addition, the prevention and control software is installed on the user's device, and it is easy to be closed or deleted by the user who is the monitoring target, and cannot really play the role of network behavior monitoring.

Compared with the existing technology that needs to install prevention and control software on each user equipment, and cannot avoid being closed or deleted by the user, the solution provided by the embodiment of the present invention can control all user equipment through network access. The device performs network monitoring, and at the same time, the network monitoring is not affected by the user, and can effectively monitor all user devices in the home network.

The network behavior monitoring method provided by the embodiment of the present invention can read the data information carried in the data access request sent by the user equipment to the network side, and then compare the data information with the predefined illegal data. If the data contains data information, the data access request is intercepted. This enables the embodiment of the present invention to perform effective network monitoring on all user equipment in the home network through the network access device.

An embodiment of the present invention provides a method for network behavior monitoring. The execution subject of the method is a network access device, specifically a home gateway or a modem. As shown in FIG. 2 , the method includes:

Step 201, the network access device obtains the data access request sent by the user equipment to the network side.

When the user equipment sends a data access request to the network side, the network access device intercepts the data access request, and obtains the data information and the time stamp carried in the data access request.

Step 202, the network access device reads the data information and the time stamp carried in the data access request.

Optionally, in this step, the data information may be data content information uploaded by the user equipment to the network side, or may be a URL sent by the user equipment to the network side. The data content information can be text information input by the user to the user device; the URL is called a webpage address, which is the address of a standard resource on the Internet; the time stamp is used to record the user's access time.

For example, when the network access device reads the data content information uploaded by the user equipment to the network side carried in the data access request, it also reads the time stamp recording the user's access time carried in the data access request. For example, when the network access device reads the URL sent by the user equipment to the network side carried in the data access request, it also reads the time stamp recording the user's access time carried in the data access request.

It should be noted that if the data access response obtained by the network access device is a data access response sent from the network side to the user equipment, the data access response may also be read.

Step 203, the network access device compares the data information and time stamp carried in the data access request with predefined illegal data.

Before step 201, network administrators may pre-set illegal data in the network access device, for example, set sensitive words, illegal URLs, and illegal access time periods. After the setting is completed, the network access device saves the setting content of the network administrator for comparison in this step.

Sensitive words refer to words of a bad nature such as obscenity and violence. Illegal URLs refer to all web addresses that are not conducive to work and study. For example, in a work environment, employees of the company should not browse video webpages during working hours, so all video webpages can be set as illegal URLs. For another example, some young users who are addicted to the Internet world play games, watch videos, and browse bad websites online during the time when they should be in class or rest, which have caused adverse effects on the physical and mental health of young people. In order to prevent the occurrence of this phenomenon, all web pages that are not conducive to the healthy development of young people's physical and mental health can be set as illegal URLs. In the solution provided by the embodiment of the present invention, there is no specific limitation on the illegal access period, and the illegal access period is set differently in different environments. For example, in the living environment of families and schools, illegal visit periods can be stipulated according to the study and rest time of young people.

When the network access device reads the data information and time stamp carried in the data access request, it compares the data information and time stamp information with the predefined illegal data to determine whether the predefined illegal data contains the Data information and timestamp information.

In this step, when the predefined illegal data does not include the data information and time stamp carried in the data access request, execute step 204; when the predefined illegal data includes the data information or time stamp carried in the data access request, Execute step 205.

Step 204, the network access device transmits a data access request to the network side.

Optionally, when the predefined illegal data does not include the data information and time stamp carried in the data access request, it means that the user is accessing the network within a legal time period, and the accessed data content information does not include sensitive words, or The accessed URL is not an illegal URL. At this time, the network access device will not intercept the data access request information, and transmit the data access request to the network side for normal access.

Step 205, the network access device intercepts the data access request.

In this step, the interception of the data access request includes three situations: first, when the predefined illegal data includes the data information and time stamp carried in the data access request, the data access request is intercepted; secondly, when the predefined When the illegal data includes the data information carried in the data access request, but does not include the time stamp carried in the data access request, the data access request is intercepted; again, when the predefined illegal data includes the time stamp carried in the data access request , but does not include the data information carried in the data access request, intercept the data access request.

It should be noted that in this step, the data information may be data content information or URL.

At present, the monitoring of user network behavior is mainly to install prevention and control software in user equipment, and monitor the data generated by user network behavior through the prevention and control software. If it is monitored that the user is conducting illegal access, the prevention and control software will block the user's network behavior. However, the prevention and control software is installed on the user equipment. In the current home network, there are many kinds of user equipment. It is necessary to install the prevention and control software on all the user equipment to realize the overall monitoring deployment of the home network. In addition, the prevention and control software is installed on the user's device, and it is easy to be closed or deleted by the user who is the monitoring target, and cannot really play the role of network behavior monitoring.

Compared with the existing technology that needs to install prevention and control software on each user equipment, and cannot avoid being closed or deleted by the user, the solution provided by the embodiment of the present invention can control all user equipment through network access. The device performs network monitoring, and at the same time, the network monitoring is not affected by the user, and can effectively monitor all user devices in the home network.

In step 206, the network access device inquires whether an alarm notification is preset in the network access device.

In this step, when the alarm notification is not preset in the network access device, step 207 is performed, and when the alarm notification is preset in the network access device, step 208 is performed.

Step 207, the network access device writes the interception information into the backup log.

Optionally, when the alarm notification is not pre-set in the network access device, the network access device directly writes the interception information into the backup log, so that when the network management personnel need to query which user device has illegally accessed, they can use the backup log. Diary query. The interception information in this step may be the data access request information sent by the user equipment to the network side.

Step 208, the network access device sends an alarm notification to the network management device, and writes the interception information and the alarm notification into the backup log.

In the case where the alarm notification is pre-set in the network access device, the network access device can send the alarm information to the mobile phone number in the form of a text message according to the pre-configured email address or mobile phone number for sending the alarm information, or send The alarm notification is sent to the email address in the form of email. At the same time, the interception information and alarm notification are written into the backup log.

The network behavior monitoring method provided by the embodiment of the present invention can effectively monitor all user equipment in a home network through a network access device. At the same time, the embodiment of the present invention can also send alarm information to the network management equipment according to the alarm notification preset in the network access device, so that the network management personnel can know in time which specific user equipment is illegally accessing according to the alarm notification.

An embodiment of the present invention provides a network behavior monitoring device, which can be located in a network access device, as shown in Figure 3, the device includes: an acquisition unit 301, a reading unit 302, a comparison unit 303, and an interception unit 304.

The obtaining unit 301 is configured to obtain a data access request sent by the user equipment to the network side.

The reading unit 302 is configured to read the data information carried in the data access request obtained by the obtaining unit 301 .

The comparing unit 303 is configured to compare the data information read by the reading unit 302 with predefined illegal data.

The interception unit 304 is configured to intercept the data access request when the comparison result of the comparison unit 303 is that the predefined illegal data contains the data information.

Further optionally, when the data information read by the reading unit 302 is data content information uploaded by the user equipment to the network side, the comparison unit 303 is further configured to perform semantic analysis on the data content information. Analyzing and processing to determine whether the data content information contains predefined sensitive words.

When the data information read by the reading unit 302 is the Uniform Resource Locator URL sent by the user equipment to the network side, the comparison unit 303 is further configured to determine whether the Uniform Resource Locator belongs to a predetermined URL. Illegal Uniform Resource Locator defined.

Further optionally, the reading unit 302 is further configured to read the time stamp carried in the data access request, and the time stamp is used to record the user's access time.

The comparison unit 303 is further configured to determine whether the time stamp carried in the data access request read by the reading unit 302 falls within a predefined illegal access period.

Further optionally, as shown in FIG. 4 , the device further includes: a sending unit 305 and a writing unit 306 .

The sending unit 305 is configured to send an alarm notification to the network management device after the intercepting unit 304 intercepts the data access request.

The writing unit 306 is configured to write the interception information and the alarm notification sent by the sending unit 305 into a backup log.

It should be noted that, in the devices shown in Figure 3 and Figure 4, the specific implementation process of each module and the information interaction between each module, etc., are based on the same inventive concept as the method embodiment of the present invention, please refer to the method Embodiments are not described here one by one.

The network behavior monitoring device provided by the embodiment of the present invention can read the data information carried in the data access request sent by the user equipment to the network side, and then compare the data information with the predefined illegal data. If the data contains data information, the data access request is intercepted. This enables the embodiment of the present invention to perform effective network monitoring on all user equipment in the home network through the network access device. At the same time, the embodiment of the present invention can also send alarm information to the network management equipment according to the alarm notification preset in the network access device, so that the network management personnel can know in time which specific user equipment is illegally accessing according to the alarm notification.

It should be noted that the device embodiments described above are only illustrative, and the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physically separated. A unit can be located in one place, or it can be distributed to multiple network units. Part or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. It can be understood and implemented by those skilled in the art without creative effort.

Through the description of the above embodiments, those skilled in the art can clearly understand that the present invention can be realized by means of software plus necessary general-purpose hardware. However, in many cases, the former is a better implementation. Based on this understanding, the essence of the technical solution of the present invention or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product is stored in a readable storage medium, such as a floppy disk of a computer , U disk, mobile hard disk, read-only memory, random access memory, magnetic disk or optical disk, etc., including several instructions to make a computer device (which can be a personal computer, server, or network device, etc.) execute various implementations of the present invention The method described in the example.

Each embodiment in this specification is described in a progressive manner, the same and similar parts of each embodiment can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device and system embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and for relevant parts, refer to part of the description of the method embodiments.

The above is only a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Anyone skilled in the art can easily think of changes or substitutions within the technical scope disclosed in the present invention. Should be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims (10)

1. A method for network behavior monitoring, characterized in that, comprising: The network access device obtains the data access request sent by the user equipment to the network side; The network access device reads the data information carried in the data access request; The network access device compares the data information with the predefined illegal data; If the predefined illegal data includes the data information, the network access device intercepts the data access request. 2. The method according to claim 1, wherein the data information is data content information uploaded by the user equipment to the network side; The network access device compares the data information with predefined illegal data, including: The network access device performs semantic analysis and processing on the data content information to determine whether the data content information contains predefined sensitive words. 3. The method according to claim 1, wherein the data information is a Uniform Resource Locator (URL) sent by the user equipment to the network side; The network access device compares the data information with predefined illegal data, including: The network access device judges whether the uniform resource locator belongs to a predefined illegal uniform resource locator. 4. The method according to claim 1, wherein the method further comprises: The network access device reads the timestamp carried in the data access request, and the timestamp is used to record the user's access time; The network access device compares the data information with predefined illegal data, including: The network access device judges whether the time stamp belongs to a predefined illegal access period. 5. The method according to claim 1, characterized in that, after the network access device intercepts the data access request, the method further comprises: The network access device sends an alarm notification to the network management device; The network access device writes the interception information and the alarm notification into the backup log. 6. A device for network behavior monitoring, characterized in that the device is located on the side of the network access device, and the device includes: an obtaining unit, configured to obtain a data access request sent by the user equipment to the network side; a reading unit, configured to read the data information carried in the data access request obtained by the obtaining unit; A comparing unit, configured to compare the data information read by the reading unit with predefined illegal data; An intercepting unit, configured to intercept the data access request when the comparison result of the comparison unit is that the predefined illegal data contains the data information. 7. The device according to claim 6, wherein the data information read by the reading unit is data content information uploaded by the user equipment to the network side; The comparison unit is further configured to perform semantic analysis on the data content information to determine whether the data content information contains predefined sensitive words. 8. The device according to claim 6, wherein the data information read by the reading unit is a Uniform Resource Locator (URL) sent by the user equipment to the network side; The comparing unit is further configured to judge whether the uniform resource locator belongs to a predefined illegal uniform resource locator. 9. The apparatus of claim 6, wherein: The reading unit is further configured to read the time stamp carried in the data access request, and the time stamp is used to record the user's access time; The comparing unit is further configured to determine whether the time stamp carried in the data access request read by the reading unit falls within a predefined illegal access period. 10. The device according to claim 6, further comprising: a sending unit, configured to send an alarm notification to the network management device after the intercepting unit intercepts the data access request; A writing unit, configured to write the interception information and the alarm notification sent by the sending unit into a backup log.