Illegal external-connection detection method and device, equipment and storage medium

Abstract

The invention discloses an illegal external-connection detection method. The illegal external-connection detection method is applied to probe equipment deployed on an Intranet link. The method comprises the following steps: generating a redirection request message if a first host is in accordance with an illegal external-connection detection condition when a first request message which is launchedby the first host specific to a HTTP (Hyper Text Transport Protocol) service server is monitored on the Intranet link, wherein the redirecting request message at least includes http redirection information directing to an Internet monitoring server deployed on Internet; and sending the redirection request message to the first host in order to determine that the first host is an illegal external-connection host when the Internet monitoring server receives a second request message transmitted by the first host. According to the technical scheme provided by the embodiment of the invention, the influence on the Intranet network environment and the normal running of Intranet normal services is lowered, and the Intranet security is improved. The invention also provides an illegal external-connection detection device, equipment and a storage medium, which have corresponding technical effects.

Description

technical field [0001] The invention relates to the field of computer application technology, in particular to an illegal outreach detection method, device, equipment and storage medium. Background technique [0002] With the rapid development of computer technology, the development of network is getting faster and faster, and the security of network is getting more and more attention. For security reasons, enterprises and institutions will monitor and restrict the online behavior of employees. In some scenarios, such as production networks, office networks, private networks, etc., due to security regulations or anti-leakage requirements, intranet hosts are prohibited from connecting to the Internet, and data that needs to be connected to the Internet often passes through security Switching equipment for data exchange. In some scenarios, a unified Internet access environment will be configured. After verification, the intranet hosts can rely on the unified exit to access t...

AI Technical Summary

Problems solved by technology

[0005] This method has certain disadvantages. The scanning server actively sends scanning detection packets to all hosts in the intranet, which will occupy the bandwidth of the intranet and may be falsely reported as an attack. If the ARP detection method is used, it is easy to form an ARP storm and affect the intranet. The network environment and the normal operation of intranet business

Images