Network access anomaly identification method and network access anomaly identification device

Abstract

The invention provides a network access anomaly identification method and a network access anomaly identification device. The network access anomaly identification method comprises steps: when an application process accesses the network, the statistical value of each identifier in at least one identifier used for identifying the network usage of the application process is acquired according to the predetermined cycle; the statistical value of each identifier is compared with the predetermined value corresponding to each identifier and the times of situations where the statistical value exceeds the corresponding predetermined value is determined; when the times is larger than or equal to the predetermined number, the application process network access anomaly can be judged. Through the technical scheme of the invention, the application process with abnormal flow consumption can be timely found out, the network connection of the application process is disconnected, a role of protection is thus achieved before the flow exceeds the standard, and the application process normally used by a user is not disturbed.

Description

technical field [0001] The present invention relates to the technical field of terminals, in particular to a method for identifying abnormal network access and a device for identifying abnormal network access. Background technique [0002] With the popularization and use of 4G (the4Generation mobile communication, fourth-generation mobile communication technology) network, when the terminal uses the mobile network, the speed of accessing the network has been greatly improved. Surfing the Internet or downloading files is not the same as using 2G (2-Generation wireless Telephonetechnology, second-generation mobile phone communication technical specification) / 3G (3rd-Generation, third-generation mobile communication technology) network, the time-consuming is greatly reduced, but when the network access rate is improved, there is also a problem: rogue When the software (trojan program) sends and receives data through the 4G network, it may use a large amount of traffic in a shor...

AI Technical Summary

Problems solved by technology

[0002] With the popularization and use of 4G (the4Generation mobile communication, fourth-generation mobile communication technology) network, when the terminal uses the mobile network, the speed of accessing the network has been greatly improved. Surfing the Internet or downloading files is not the same as using 2G (2-Generation wireless Telephonetechnology, second-generation mobile phone communication technical specification) / 3G (3rd-Generation, third-generation mobile communication technology) network, the time-consuming is greatly reduced, but when the network access rate is improved, there is also a problem: rogue When the software (Trojan program) sends and receives data through the 4G network, it may use a large amount of data in a short period of time, and even use the user's data when it exceeds the total data of the package, resulting in high fees

But this solution has obvious deficiencies: (1) prevents the normal use of the application

On the one hand, even if the traffic usage reaches the upper limit, the user may still have the need to surf the Internet. For example, the chat tool does not require a large amount of traffic. Even if the traffic usage is greater than or equal to the preset upper limit, the user may still use the chat tool; On the one hand, it restricts the terminal's access to the network, many applications on the terminal cannot be used, and various applications installed on the device cannot be used normally, which affects the user experience

(2) Failure to stop traffic waste in time

However, the timeliness of this scheme is relatively poor. For new rogue software (trojan horse programs), there is no record in the process list, and then it is impossible to identify whether the application process is abnormal in network access by means of comparison and matching. Once it is used, it will cause a large amount of traffic. Traffic waste, that is, this method requires users to consume a large amount of traffic before it can be determined that an application process is a rogue software (Trojan horse program), which fails to effectively protect the user's traffic

Images