WO2019134333A1 - 端口监控方法、装置、计算机设备及存储介质 - Google Patents

端口监控方法、装置、计算机设备及存储介质 Download PDF

Info

Publication number
WO2019134333A1
WO2019134333A1 PCT/CN2018/088707 CN2018088707W WO2019134333A1 WO 2019134333 A1 WO2019134333 A1 WO 2019134333A1 CN 2018088707 W CN2018088707 W CN 2018088707W WO 2019134333 A1 WO2019134333 A1 WO 2019134333A1
Authority
WO
WIPO (PCT)
Prior art keywords
network address
request data
level
preset
risk level
Prior art date
Application number
PCT/CN2018/088707
Other languages
English (en)
French (fr)
Inventor
王元铭
Original Assignee
平安科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 平安科技（深圳）有限公司 filed Critical 平安科技（深圳）有限公司
Publication of WO2019134333A1 publication Critical patent/WO2019134333A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101—Access control lists [ACL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic

Definitions

  • the application relates to a port monitoring method, device, computer device and storage medium.
  • the intrusion device scans the port of the server first. When the port available in the server is found, the intrusion device sends a communication request to interact with the server. If the intrusion device does not detect the port scan request connection to the server in time, and then defends, the risk of the server being invaded may occur.
  • the server needs to manually monitor different ports on time to check whether there are intrusion devices scanning the ports of the server, thereby discovering the threats, resulting in untimely discovery and low efficiency.
  • a port monitoring method, apparatus, computer device, and storage medium are provided.
  • a method of port monitoring including:
  • the network address is marked;
  • the request data sent by the network address whose risk level is greater than the preset level is received, the request data is not responded.
  • a port monitoring device includes:
  • an extracting module configured to receive request data sent by the terminal, and extract a network address carried on the request data.
  • the marking module is configured to mark the network address when the network address is not queried in the network information repository.
  • the first obtaining module is configured to acquire a port that receives the request data.
  • a second obtaining module configured to acquire a risk level of the marked network address according to the type of the port and the request data.
  • a storage module configured to: when the risk level of the network address is greater than a preset level, store the network address whose risk level is greater than a preset level;
  • the forbidden response module is configured to not respond to the request data when receiving the request data sent by the network address whose risk level is greater than a preset level.
  • a computer device comprising a memory and one or more processors having stored therein computer readable instructions, the computer readable instructions being executable by the processor to cause the one or more processors to execute The following steps:
  • the network address is marked;
  • the request data sent by the network address whose risk level is greater than the preset level is received, the request data is not responded.
  • One or more non-transitory computer readable storage mediums storing computer readable instructions, when executed by one or more processors, cause one or more processors to perform the steps of:
  • the network address is marked;
  • the request data sent by the network address whose risk level is greater than the preset level is received, the request data is not responded.
  • FIG. 1 is an application scenario diagram of a port monitoring method according to one or more embodiments.
  • FIG. 2 is a flow diagram of a method of port monitoring in accordance with one or more embodiments.
  • FIG. 3 is a block diagram of a port monitoring device in accordance with one or more embodiments.
  • FIG. 4 is a block diagram of a computer device in accordance with one or more embodiments.
  • the port monitoring method provided by the present application can be applied to an application environment as shown in FIG. 1.
  • the terminal communicates with the server through the network.
  • the server receives the request data sent by the terminal, and extracts the network address carried in the request data.
  • the server does not query the network address in the network information storage
  • the terminal corresponding to the network address performs initial communication with the server.
  • the network address needs to be further identified and inquired to determine whether the terminal corresponding to the network address is an intruding device, and the server obtains the port that receives the request data sent by the terminal, according to the type of the port that receives the request data and the obtained request data. Obtaining a risk level of the marked network address.
  • the terminal can be, but is not limited to, various personal computers, notebook computers, smart phones, tablets, and portable wearable devices, and the server can be implemented by a separate server or a server cluster composed of multiple servers.
  • a port monitoring method is provided.
  • the method is applied to the server in FIG. 1 as an example, and includes the following steps:
  • S202 Receive request data sent by the terminal and extract a network address carried on the request data.
  • the request data refers to the to-be-response information before the server requests to exchange data
  • the request data is the pending response information sent to the server to confirm whether the terminal is ready to communicate with the server, for example, request data. It may be the first handshake information sent by the terminal to the server before requesting communication from the server.
  • the request data may be a TCP packet (Transmission Control Protocol), and the request data may also be a UDP packet (User Datagram Protocol). , User Datagram Protocol, etc.
  • a network address refers to a network address of a computer in a network, which can uniquely identify the computer device in the network.
  • the computer can use a network address as a communication identifier when communicating with other computers or servers, for example, a network address. It can be an IP (Internet Protocol) address or the like.
  • a network address can be an IP (Internet Protocol) address or the like.
  • the request data carries the network address corresponding to the terminal, and then directly extracts the network address carried on the request data for querying to identify whether the network address confirms the terminal corresponding to the network address. Perform data interaction, etc.
  • the server receives the first handshake information sent by the terminal, it needs to determine whether data interaction with the terminal can be performed, and the server extracts the network address carried on the request data sent by the received terminal, and identifies the request data.
  • the network address carried on the network to determine whether to interact with the terminal.
  • the network information storage means is configured on the server, and the different network addresses can be stored in the database.
  • the network information storage can store different IP addresses such as the first IP address and the second IP address.
  • the network address carried by the request data is a network address that needs to be continuously identified, thereby confirming whether it is a threatening network address, and thus confirming If the terminal corresponding to the network address is an intruding device, the network address carried in the request data is marked, and the tagged network address may be a tag added to the network address, and if the tag to be identified is added, the request data is The network address carried on is the network address that needs to be recognized.
  • the server matches the network address carried by the extracted request data with the network address to be matched stored in the network information repository, that is, the network address extracted by the server and the network information repository are to be matched.
  • the network addresses are matched one by one until all the data to be matched stored in the network information repository is traversed.
  • the server does not query the extraction in the network information repository.
  • the network address to be obtained, and the extracted network address, need to be further identified, and whether the terminal that sends the request data is an intruding device, the server takes the network address for marking, such as adding a to-be-identified tag to the network address.
  • S206 Acquire a port that receives the request data.
  • a port refers to an interface in a server that can communicate with different computer devices.
  • the port can be an interface that receives different types of data, and the port can also be a port configured with a different communication protocol; for example, the port can be a TCP port. It can also be a UDP port or the like.
  • the port when not queried in the network information repository, the port that receives the request data carrying the network address is acquired.
  • the server extracts the network address carried on the request data and does not query the network address in the network information repository, the network address is marked for subsequent identification, and the server obtains the received request data. port.
  • S208 Obtain a risk level of the marked network address according to the type of the port and the request data.
  • the server when the port is obtained, the type of the port is further queried, and the tagged network address is identified according to the type of the queried port and the request data, thereby obtaining the risk level of the tagged network address.
  • the server queries the type of the port, and then identifies the marked network address according to the type of the queried port and the request data, for example, according to the port type of the received request data, the query is received according to the port type. Go to the number of ports requesting data, and then obtain the number of requested data, and then judge with the preset value, and then obtain the risk level of the marked network address.
  • the risk level is a security indicator for evaluating whether the network address is secure
  • the risk level may be a preset different level for evaluating whether the network address is secure.
  • the risk level may be set from low to high according to the level, and the risk level is higher. , indicating that the corresponding network address has a higher risk.
  • the risk level is set to level 1 to level 5, indicating that the risk corresponding to the network address is getting higher and higher.
  • a corresponding level is pre-set.
  • the risk level is greater than the network address of the preset level for storage.
  • the preset level may be set to 3.
  • the network address is a threatening network address
  • the middle segment corresponding to the network address may be
  • the server can store the network address in the corresponding database, and the network address is a network address that prohibits communication, and the terminal corresponding to the network address is a device that prohibits data interaction with the server.
  • the preset level may also be preset to level 2, level 4, level 5, etc. according to the actual situation in which the server needs to communicate.
  • the network address whose current risk level is greater than the preset level is a threatening network address
  • the terminal corresponding to the network address of the preset level is the intrusion device.
  • the network address is a network address that prohibits communication
  • the terminal corresponding to the network address is a device that prohibits data interaction with the server, and when the server receives the requested data that is sent by the network address whose stored risk level is greater than a preset level. If the terminal corresponding to the network address does not receive the response data of the server corresponding to the request data, the data cannot be exchanged with the server.
  • the server may receive the request data sent by the terminal and extract the network address carried on the request data.
  • the network address is performed. Marking, in turn, querying the number of times the terminal corresponding to the network address marked in the preset time period sends the request data to the server, for example, the preset time period may be sent 1000 times within 10 minutes, and the number of times the request data is sent exceeds
  • the terminal corresponding to the network address may be the opening of the port of the probe server, that is, the marked network address may be a threatening network address, and the terminal corresponding to the marked network address may be an intruding device.
  • the server obtains the port receiving the request data, and further obtains the risk level of the marked network address according to the type of the port and the request data, when the risk level of the marked network address is greater than a preset level,
  • the network address whose risk level is greater than the preset level is stored.
  • the preset time period may be 2 minutes, 3 minutes, 5 minutes, etc.
  • the preset number of times may be 10 times, 50 times, 100 times, 500 times, and the like.
  • the server when the server receives the request data sent by the device to be identified, the network address on the request data is extracted, and the network address is queried in the network information repository, thereby determining whether the network address is identified and determined to be the network for the first communication.
  • the address when it is the network address of the first communication, marking the network address, and then acquiring the risk level of the network address according to the port type of the port receiving the requested data and the request data, when the risk level is greater than the preset level, And storing the network address with the risk level greater than the preset level, that is, the terminal corresponding to the network address may be threatening, and when receiving the request data sent by the network address whose risk level is greater than the preset level, The request data is not responded.
  • Step S208 may include the following steps: Step S208, that is, the step of obtaining the risk level of the marked network address according to the type of the port and the request data, may include:
  • the port When the port is the first type of port, the number of ports that receive the requested data is obtained.
  • the first type of port is a port configured with a corresponding communication protocol, so that the first type of port can be used to receive or send common information
  • the first type of port can be a port configured with a UDP communication protocol, for example, the first type of port is UDP port.
  • the network address is marked, the network address needs to be continuously identified, and then the port that receives the request data is obtained.
  • the port that receives the request data is the first type port, the port that receives the request data is obtained.
  • Quantity For example, when the server marks the network address, the network address needs to be continuously identified, and the server obtains an interface for receiving the request data.
  • the received request data is UDP.
  • the data packet, and further, the risk level of the network address needs to be queried according to the number of ports receiving the UDP data packet, and the server acquires the number of UDP ports that receive the UDP data packet.
  • a valid port is an interface of the corresponding type of open and available data that can be exchanged with other computer devices, such as a terminal or server, in the server. Further, when the number of ports receiving the request data is acquired, the number of currently valid ports is obtained. For example, when the server obtains the number of UDP ports that receive UDP packets, the server obtains the number of ports on the server that all open and available UDP ports can exchange data.
  • the risk level of the network address is greater than a preset level; otherwise, the risk level of the network address is less than or equal to a preset level.
  • the ratio of the number of ports receiving the request data to the current effective port is determined according to the number of ports receiving the request data, and the ratio of the number of ports receiving the requested data to the number of currently valid ports is calculated.
  • the ratio is less than the preset value, all the first types are used.
  • the port receives the request data sent by the terminal corresponding to the network address, and not only the open available first type port receives the request data, that is, the terminal corresponding to the network address is the port of the probe server, and the network address is The risk level is greater than the preset level, and the terminal corresponding to the network address is an intruding device.
  • the ratio of the number of ports receiving the requested data to the number of currently valid ports is equal to or greater than a preset value, the tagged network is used.
  • the risk level of the address is less than the preset level.
  • the server determines the risk level according to the number of ports of the received UDP packet and the data volume of the currently opened UDP port, that is, Calculate the ratio of the number of UDP ports that receive UDP packets to the number of open UDP ports that are open. If the ratio is less than the preset value of 3, all UDP ports receive UDP packets, that is, marked. If the terminal corresponding to the network address is an available state for testing whether the UDP port is open, the risk level of the marked network address is greater than a preset level.
  • the risk level of the marked network address is less than the preset level.
  • the preset value of the ratio of the number of ports receiving the request data to the number of currently valid ports may also be set to 4 or 5 or the like.
  • the ratio of the number of the first type of ports receiving the request data to the number of the currently valid ports is used to obtain the risk level of the marked network address.
  • the method for obtaining the risk level is simple, and the risk level of the network address that is obtained by the corresponding type is selected according to the first type of port, and the selection is flexible and applicable.
  • the step S208 may include the following steps: Step S208, that is, the step of acquiring the risk level of the marked network address according to the type of the port and the request data, may further include:
  • the flag bit in the request data is obtained.
  • the second type of port refers to a port configured with a corresponding communication protocol, so that it can be used to receive or transmit important information
  • the second type of port can be a port configured with a TCP communication protocol, for example, the first type of port is a TCP port.
  • the flag bit indicates that the request data carries an identifier that identifies the current request data transmission status.
  • the flag bit may be an emergency flag bit (URG), a meaningful acknowledge flag bit (ACK), a reset connection flag bit (RST), Synchronous serial number flag (SYN), complete transmit data flag (FIN) or empty flag.
  • the network address needs to be continuously identified, and the port that receives the request data is obtained.
  • the port type is the second type port
  • the flag bit in the received request data is obtained.
  • the server marks the network address, the network address needs to be continuously identified, and the server obtains the port that receives the request data.
  • the port that receives the request data is a TCP port
  • the received request data is The TCP packet, in turn, needs to query the risk level of the network address according to the flag bit in the received TCP packet, and the server obtains the number of different flag bits in the received TCP packet, for example, obtaining the flag bit may be an emergency.
  • Flag bit UCG
  • meaningful acknowledge flag bit ACK
  • reset connection flag bit RST
  • sync sequence number flag bit SYN
  • complete transmit data flag bit FIN
  • the preset flag information refers to information set in advance indicating the state of the request data.
  • the preset flag information may be preset information indicating the status of the request data, such as obtaining a synchronization sequence number, completed transmission data, or an empty flag.
  • the number of preset flag information exists in the flag bit in the query request data.
  • the preset flag information may be that the data has been sent.
  • the number of data flag bits (FIN); or the preset flag information may be obtained by acquiring synchronization sequence number data.
  • the acquisition flag bit indicates that the synchronization sequence number data is acquired.
  • the number of bits may be the number of acquiring the synchronization sequence number flag (SYN); or the preset flag information may be an empty flag.
  • the server obtains different flag bits of the TCP packet the flag is obtained.
  • the number of flag bits indicating the empty flag in the medium that is, the number of empty flag bits can be obtained.
  • the server counts the number of received request data.
  • the received request data is a TCP packet, and the number of received TCP packets is counted.
  • the risk level of the network address is greater than a preset level; otherwise, the risk level of the network address is less than or equal to the preset level.
  • the ratio of the number of flag bits in which the preset flag information exists to the number of received data of the request data is calculated.
  • the risk level of the marked network address is greater than a preset level, when the ratio is equal to or smaller than the threshold.
  • the risk level of the tagged network address is less than the preset level.
  • the received request data is a TCP data packet, and the number of received TCP data packets is counted.
  • the preset flag information is completed, the data is obtained.
  • the number of flag bits for which data has been transmitted that is, the number of acquired complete data flag bits (FIN), thereby calculating the number of flag bits in the TCP packet indicated as completed data transmission and receiving the TCP packet.
  • the ratio of the number when the ratio exceeds 20%, considers that the terminal corresponding to the marked network address sends the first handshake information to all TCP ports of the server, that is, the port opened by the probe server to perform data with the port opened by the server.
  • the network address to be identified is a network address whose risk level is greater than a preset level
  • the terminal corresponding to the network address is an intruding device, but if the ratio is less than 20% or equal to 20%, the identified network address is performed.
  • the preset flag information may be obtained by acquiring synchronization sequence number data or an empty flag, etc., and the determining step is as above, and details are not described herein again.
  • the threshold value of the ratio of the number of flag bits of the preset flag information to the number of received data of the request data may be 10%, 12%, 15%, 21%, or the like.
  • the server can also obtain the number of ports that receive the requested data, and then obtain the current number of valid ports.
  • the number of ports receiving the requested data is the same as the number of currently valid ports.
  • the ratio is less than the preset value
  • the risk level of the network address is greater than the preset level. Otherwise, the risk level of the network address is less than or equal to the preset level.
  • the port is a TCP port
  • the received request data is a TCP packet
  • the server obtains the number of TCP ports that receive the TCP packet, and obtains the number of currently available TCP ports, when receiving the TCP data.
  • the risk level of the network address is greater than the preset level. Otherwise, the risk level of the network address is less than or equal to the preset level.
  • the preset value of the ratio of the number of ports receiving the request data to the number of currently valid ports may also be 4 or 5 or the like.
  • the flag bit in the request data is used for judging, the judging manner is various, the judgment is accurate, the selection is flexible, and the applicability is enhanced.
  • the above method may further include the following steps:
  • the network information repository includes a blacklist repository and a whitelist repository.
  • the blacklist repository refers to a database storing a network address for which communication is prohibited, and the network address for which communication is prohibited is a threatening network address;
  • the whitelist repository refers to a database storing a trusted network address, which is trusted.
  • the network address refers to the network address that the server can directly communicate with the terminal corresponding to the trusted network address without further identification.
  • the server may match the network address carried in the extracted request data with the network address stored in the blacklist repository one by one until all the network addresses in the blacklist repository are traversed. For example, the server will extract the network address carried on the requested data, and match the extracted network address with any network address in the blacklist repository according to characters. If the matching is not successful, continue with the blacklist repository. The next network address is matched by characters until all network addresses in the blacklist repository are traversed.
  • the extracted network address matches the network address in the blacklist repository successfully, the extracted network address is the communication network prohibition address.
  • the extracted network address matches the stored network address in the blacklist repository one by one, when the network address is successfully matched with any one of the network addresses, the extracted network address is a forbidden communication network address, then the network The address is a threatening network address, and thus the data corresponding to the terminal corresponding to the network address cannot be exchanged.
  • the network address extracted by the server and the network address stored in the blacklist repository are matched one by one. When the network address is successfully matched with any one of the network addresses, the extracted network address is the communication network prohibition address.
  • the extracted network address is matched with the network address stored in the whitelist repository. Specifically, when the extracted network address and the network address stored in the blacklist repository are matched one by one, when all the network addresses in the blacklist repository are traversed, the extracted network addresses are not stored in the blacklist repository. If the network address is successfully matched, the network identifier needs to be continuously identified, and the extracted network address is matched with the network address stored in the whitelist repository one by one until all the network addresses stored in the whitelist repository are traversed.
  • the server may match the extracted network address with the network address in the blacklist repository one by one. When traversing all the network addresses in the blacklist repository, the extracted network addresses are not stored in the blacklist repository.
  • the server matches the extracted network address with any network address stored in the whitelist repository.
  • the server extracts the network address and white. The next network address in the list repository is matched until the network address stored in the whitelist repository is traversed.
  • the network address is not queried in the network information repository.
  • the extracted network address matches the network address stored in the whitelist repository one by one, and the network address stored in the whitelist repository does not match successfully, the extracted network address is not a trusted network.
  • the address that is, the extracted network address is not queried in the network information repository.
  • the server may match the extracted network address with the network address in the whitelist repository one by one. When traversing all the network addresses in the whitelist repository, the extracted network addresses are not stored in the whitelist repository. When the network address is successfully matched, the network address is not queried in the network information repository, and the network address is further identified.
  • the server matches the extracted network address with the blacklist repository.
  • the server prohibits the communication network address, and the server does not perform data interaction with the terminal corresponding to the network address.
  • the extracted network address is queried in the repository, the extracted network address is matched with the network address stored in the whitelist repository. If the network address is not successfully matched, the network address is not a trusted network. The address needs to be further identified, that is, the network address is not queried in the network information repository. First check whether the communication network address or the trusted network address is prohibited, to avoid misidentification of subsequent identification, improve accuracy, and enhance applicability.
  • the step S212 that is, when the request data sent by the network address with the risk level greater than the preset level is received, the step of not responding to the request data may include:
  • the frequency at which the terminal corresponding to the network address whose risk level is greater than the preset level sends the request data to the port. Specifically, when the network address whose risk level is greater than the preset level is stored, querying the stored risk level is greater than the frequency of the terminal sending the request data corresponding to the network address of the preset level, where the server may have a risk level greater than the pre- After the network address of the level is stored, the time period in which the terminal corresponding to the network address corresponding to the preset level is sent to the port is obtained, and the terminal corresponding to the network address whose risk level is greater than the preset level is obtained at the time.
  • the port may be a TCP port
  • the request data may be a TCP packet.
  • the time period of the TCP packet, and the number of times the terminal corresponding to the network address whose risk level is greater than the preset level sends the TCP packet to the TCP port in the time period, and then calculates the number of times the TCP packet is sent and the time when the TCP packet is sent.
  • the ratio of the segments obtains the frequency at which the terminal corresponding to the network address whose risk level is greater than the preset level sends the request data to the TCP port.
  • the port may also be a UDP port, and the request data may also be a UDP data packet, and the frequency of the UDP data packet sent by the terminal corresponding to the network address whose risk level is greater than the preset level to the UDP port is not described here.
  • the network address with the risk level greater than the preset level is added to the blacklist repository, and the network address added to the blacklist repository is not greater than the preset level.
  • Send request data to respond Specifically, when the frequency corresponding to the network address corresponding to the preset level is obtained, the terminal compares the frequency with the preset frequency, and when the frequency is greater than the preset frequency, the risk level is greater than the pre- The network address of the level is forbidden to the communication network address, and the network address is added to the blacklist storage library, that is, when the terminal corresponding to the network address sends the request data to the server, the server does not respond to the request data, and the server is no longer The terminal corresponding to the network address performs data interaction.
  • the terminal compares the frequency with the preset frequency, and when the frequency is greater than the preset frequency, the risk level is greater than
  • the terminal corresponding to the network address of the preset level is a port that is opened by the probe terminal, and is a threatening network address, and the terminal corresponding to the network address is an intruding device, and the server has the risk level greater than the network address of the preset level.
  • the device is added to the blacklist repository, and when the terminal corresponding to the network address sends the request data to the server, the server does not respond to the request data, and the server does not perform data interaction with the terminal corresponding to the network address.
  • the preset frequency may be 5, 10, 12, 13, 15, and the like.
  • the frequency of the request data sent by the terminal corresponding to the network address whose query risk level is greater than the preset level is compared with the preset frequency, and when the value is greater than the preset frequency, the risk level is greater than the preset. If the network address of the level is added to the blacklist repository, the network address request request data with the risk level greater than the preset level added to the blacklist repository is not responded, and the network with the risk level greater than the preset level is determined.
  • the method of prohibiting the communication network address is simple, the judgment efficiency is high, and the efficiency of identifying the server port by the invading device is high.
  • the step S212 that is, when the request data sent by the network address with the risk level greater than the preset level is received, the step of not responding to the request data may further include:
  • Extracting the time when the terminal corresponding to the network address whose stored risk level is greater than the preset level sends the request data to the port. Specifically, when the network address whose risk level is greater than the preset level is stored, the time when the terminal corresponding to the network address whose stored risk level is greater than the preset level sends the request data to the port is extracted.
  • the server may store the network address with the risk level greater than the preset level, and then query the time when the port receives the request data, and then extract the time.
  • a suspicious tag is added to the network address whose risk level is greater than the preset level.
  • the suspicious tag refers to an identifier of the risk level of the network address whose risk level is greater than the preset level, and the suspicious tag may be an identifier indicating that the network address whose risk level is greater than the preset level needs to be further determined whether the communication network address is prohibited.
  • the server extracts the time when the terminal corresponding to the network address whose risk level is greater than the preset level sends the request data to the port within a preset time period, the terminal corresponding to the network address whose risk level is greater than the preset level is special.
  • the request data is sent to the server port, and then the data interaction with the server is requested, and the suspicious risk level is greater than the preset level network address, and the server adds a suspicious tag to the network address whose risk level is greater than the preset level.
  • the preset time period may be a special time period in which the server does not normally perform data interaction with the terminal, and the preset time period may be a certain time period in the morning, for example, the preset time period may be 23 Between 0:00 am, the preset time period can be between 1 am and 1:30 am.
  • the server sends the request data to the port according to the stored network with the risk level greater than the preset level, and the time required to send the request data to the port is within a preset time period.
  • a suspicious tag is added, and a preset time period, for example, a special time, can be monitored, and a network address with a risk level greater than a preset level is identified in a different manner, thereby identifying a corresponding intrusion device, the query is accurate, and the applicability is enhanced in time.
  • the step of adding a suspicious tag to the network address whose risk level is greater than the preset level may further include:
  • the number of times the terminal corresponding to the network address corresponding to the preset level is sent to request data in the preset time period is queried. Specifically, the server queries the number of times that the terminal corresponding to the network address whose suspicious tag is greater than the preset level sends the request data within the preset time period.
  • the server may query the number of times the terminal corresponding to the network address corresponding to the preset level is sent to the server port by the terminal corresponding to the network address of the preset level, for example, it may be counted at a special time, 1 am to 1 am.
  • the number of times that a suspicious tag is added between 30 points is greater than the number of times the terminal corresponding to the network address of the preset level sends a TCP packet to the TCP port. It is also possible to add a suspicious tag between 1 am and 1:30 am at a special time.
  • the risk level is greater than the number of times the terminal corresponding to the network address of the preset level sends a UDP packet to the UDP port.
  • the network address to which the suspicious tag is added is added to the blacklist repository, and the network address that is added to the blacklist repository with the risk level greater than the preset level is not sent. Request data to respond.
  • the terminal corresponding to the network address whose risk level is greater than the preset level in the preset time period is the port opened by the probe server, and the risk level is greater than the preset level.
  • the server does not perform data interaction with the terminal corresponding to the network address, and the network address is added to the blacklist storage library, that is, when the terminal corresponding to the network address sends the request data to the server. If the request data is not responded, the server no longer performs data interaction with the terminal corresponding to the network address.
  • the preset number of times may be 10 times.
  • the server does not perform data interaction with the terminal corresponding to the network address, and the network address is added to the blacklist repository, that is, when the terminal corresponding to the network address sends a request to the server.
  • the server no longer performs data interaction with the terminal corresponding to the network address.
  • the preset number of times may be 11 times, 21 times, 30 times, 50 times, and the like.
  • the terminal corresponding to the network address whose risk level is greater than the preset level is queried to send the request data to the port, and when the time is within the preset time period, the risk level is greater than the preset level.
  • the suspicious tag is added to the network address, that is, the first-level identification is performed, and the network address with the risk level of the suspicious tag added to the preset level is further identified, and the network address corresponding to the preset level is identified.
  • the network address is added to the blacklist storage library, that is, the second level identification is performed, and finally the network address is determined to be prohibited communication.
  • the network address is identified accurately by two-level analysis, and then the terminal corresponding to the network address whose recognition risk level is greater than the preset level is accurate and timely for the intrusion device.
  • steps in the flowchart of FIG. 2 are sequentially displayed as indicated by the arrows, these steps are not necessarily performed in the order indicated by the arrows. Except as explicitly stated herein, the execution of these steps is not strictly limited, and the steps may be performed in other orders. Moreover, at least some of the steps in FIG. 2 may include a plurality of sub-steps or stages, which are not necessarily performed at the same time, but may be executed at different times, the execution of these sub-steps or stages The order is also not necessarily sequential, but may be performed alternately or alternately with other steps or at least a portion of the sub-steps or stages of the other steps.
  • the port monitoring device 300 can include an extracting module 310, a marking module 320, a first obtaining module 330, a second obtaining module 340, and a storage module. 350, where:
  • the extracting module 310 is configured to receive request data sent by the terminal and extract a network address carried on the request data.
  • the marking module 320 is configured to mark the network address when the network address is not queried in the network information repository.
  • the first obtaining module 330 is configured to acquire a port that receives the request data.
  • the second obtaining module 340 is configured to obtain a risk level of the marked network address according to the type of the port and the request data.
  • the storage module 350 is configured to store, when the risk level of the network address is greater than the preset level, the network address whose risk level is greater than the preset level.
  • the forbidden response module 360 is configured to not respond to the request data when receiving the request data sent by the network address whose risk level is greater than the preset level.
  • the second obtaining module 340 can include:
  • the first quantity obtaining unit is configured to acquire the number of ports of the received request data when the port is the first type of port.
  • the second quantity obtaining unit is configured to acquire the number of currently valid ports.
  • the first determining unit is configured to: when the ratio of the number of the ports that receive the request data to the current number of valid ports is less than a preset value, the risk level of the network address is greater than a preset level; otherwise, the risk level of the network address is less than or equal to Set the level.
  • the second obtaining module 340 may further include:
  • the flag bit obtaining unit is configured to acquire a flag bit in the request data when the port is a port of the second type.
  • the flag bit quantity obtaining unit is configured to acquire the number of flag bits in which the preset flag information exists.
  • a statistical unit that counts the number of received requests for data.
  • the second determining unit when the ratio of the number of the flag bits of the preset flag information to the received quantity of the request data exceeds the threshold, the risk level of the network address is greater than the preset level; otherwise, the risk level of the network address is less than or equal to the preset grade.
  • the port monitoring device 300 may further include:
  • the first matching module is configured to match the extracted network address with a network address in the blacklist repository.
  • the communication network address extraction module is prohibited, and when the extracted network address matches the network address in the blacklist repository, the extracted network address is the communication network prohibition address.
  • a second matching module configured to: when the extracted network address is not successfully matched with the network address in the blacklist repository, match the extracted network address with the network address stored in the whitelist repository;
  • the query module is configured to: when the extracted network address does not match the network address stored in the whitelist repository, the network address is not queried in the network information repository.
  • the forbidden access module 360 may further include:
  • the frequency query module is configured to query the frequency at which the terminal corresponding to the network address whose risk level is greater than the preset level sends the request data to the port.
  • a first adding module configured to: when the frequency is greater than the preset frequency, add a network address whose risk level is greater than the preset level to the blacklist repository, and the risk level added to the blacklist repository is not The network address transmission request data larger than the preset level responds.
  • the forbidden access module 360 may further include:
  • the time extraction module is configured to extract a time when the terminal corresponding to the network address whose stored risk level is greater than the preset level sends the request data to the port.
  • the suspicious tag adding module is configured to add a suspicious tag to a network address whose risk level is greater than a preset level when the time for sending the request data is within a preset time period.
  • the forbidden access module 360 may further include:
  • the number querying module is configured to query the number of times the terminal corresponding to the network address with the risk level of the suspicious tag is greater than the preset level to send the request data within the preset time period.
  • a second adding module when the number of times is greater than or equal to a preset value, adding a network address to which the suspicious tag is added to the blacklist repository, where the risk level added to the blacklist repository is not greater than The preset level network address sends the request data to respond.
  • each of the above-described port monitoring devices may be implemented in whole or in part by software, hardware, and combinations thereof.
  • Each of the above modules may be embedded in or independent of the processor in the computer device, or may be stored in a memory in the computer device in a software form, so that the processor invokes the operations corresponding to the above modules.
  • a computer device which may be a server, and its internal structure diagram may be as shown in FIG.
  • the computer device includes a processor, memory, network interface, and database connected by a system bus.
  • the processor of the computer device is used to provide computing and control capabilities.
  • the memory of the computer device includes a non-volatile storage medium, an internal memory.
  • the non-volatile storage medium stores an operating system, computer readable instructions, and a database.
  • the internal memory provides an environment for operation of an operating system and computer readable instructions in a non-volatile storage medium.
  • the database of the computer device is used to store port monitoring data.
  • the network interface of the computer device is used to communicate with an external terminal via a network connection.
  • the computer readable instructions are executed by the processor to implement a port monitoring method.
  • FIG. 4 is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation of the computer device to which the solution of the present application is applied.
  • the specific computer device may It includes more or fewer components than those shown in the figures, or some components are combined, or have different component arrangements.
  • a computer device comprising a memory and one or more processors having stored therein computer readable instructions, the computer readable instructions being executed by the processor such that the one or more processors perform the steps of: computer readable instructions: Receiving the request data sent by the terminal and extracting the network address carried on the request data. When the network address is not queried in the network information repository, the network address is marked. Get the port that receives the request data. The risk level of the tagged network address is obtained based on the type of port and the request data. When the risk level of the network address is greater than the preset level, the network address whose risk level is greater than the preset level is stored. And when receiving the request data sent by the network address whose risk level is greater than the preset level, the request data is not responded.
  • the step of implementing the computer readable instructions when the processor executes the computer readable instructions and the risk level of the network address of the requested data acquisition token may include: when the port is the first type of port, the acquisition is received The number of ports that request data. Get the number of currently valid ports. And when the ratio of the number of the ports receiving the request data to the number of the currently valid ports is less than the preset value, the risk level of the network address is greater than the preset level; otherwise, the risk level of the network address is less than or equal to the preset level.
  • the step of implementing the computer readable instructions when the processor executes the computer readable instructions and the requesting the data to obtain the risk level of the marked network address may further include: when the port is the second type of port, obtaining the request The flag bit in the data. Get the number of flag bits with preset flag information. Count the number of requests for data received. And when the ratio of the number of the flag bits of the preset flag information to the received quantity of the request data exceeds the threshold, the risk level of the network address is greater than the preset level; otherwise, the risk level of the network address is less than or equal to the preset level.
  • the processor may also implement the step of matching the extracted network address to a network address in the blacklist repository when the processor executes the computer readable instructions.
  • the extracted network address matches the network address in the blacklist repository successfully, the extracted network address is the communication network prohibition address.
  • the extracted network address does not match the network address in the blacklist repository, the extracted network address is matched with the network address stored in the whitelist repository. And when the extracted network address does not match the network address stored in the whitelist repository, the network address is not queried in the network information repository.
  • the step of not responding to the request data may further include: querying the risk level.
  • the step of not responding to the request data may further include: extracting the stored The risk level is greater than the time when the terminal corresponding to the network address of the preset level sends the request data to the port. And when the time for sending the request data is within a preset time period, a suspicious tag is added to the network address whose risk level is greater than the preset level.
  • the step of adding the suspicious tag to the network address with the risk level greater than the preset level may further include: The number of times the terminal corresponding to the network address corresponding to the preset level is sent to request data in the preset time period is queried. And when the number of times is greater than or equal to the preset value, the network address to which the suspicious tag is added is added to the blacklist repository, and the network address sending request data added to the blacklist repository is greater than the preset level. response.
  • One or more non-transitory computer readable storage mediums storing computer readable instructions, when executed by one or more processors, cause one or more processors to perform the steps of: receiving by a terminal Request data and extract the network address carried on the request data.
  • the network address is marked. Get the port that receives the request data.
  • the risk level of the tagged network address is obtained based on the type of port and the request data.
  • the network address whose risk level is greater than the preset level is stored.
  • the request data sent by the network address whose risk level is greater than the preset level is received, the request data is not responded.
  • the step of implementing, by the processor, the risk level of the network address of the tagged data according to the type of the port and the requesting data may include: obtaining the receiving when the port is the first type of port The number of ports to request data. Get the number of currently valid ports. When the ratio of the number of ports receiving the requested data to the number of currently valid ports is less than a preset value, the risk level of the network address is greater than a preset level; otherwise, the risk level of the network address is less than or equal to a preset level.
  • the step of implementing, by the processor, the risk level of the network address of the tagged data according to the type of the port and the requesting data may further include: when the port is the second type of port, acquiring The flag bit in the request data. Get the number of flag bits with preset flag information. Count the number of requests for data received. When the ratio of the number of flag bits of the preset flag information to the number of received data of the request data exceeds a threshold, the risk level of the network address is greater than a preset level; otherwise, the risk level of the network address is less than or equal to the preset level.
  • the computer readable instructions when executed by the processor, can also implement the step of matching the extracted network address to a network address in the blacklist repository.
  • the extracted network address matches the network address in the blacklist repository successfully, the extracted network address is the communication network prohibition address.
  • the extracted network address does not match the network address in the blacklist repository, the extracted network address is matched with the network address stored in the whitelist repository.
  • the network address is not queried in the network information repository.
  • the step of not responding to the request data may further include: querying the risk The frequency at which the terminal corresponding to the network address of the preset level sends the request data to the port.
  • the frequency is greater than the preset frequency
  • the network address with the risk level greater than the preset level is added to the blacklist repository, and the network address sending request data with the risk level added to the blacklist repository is greater than the preset level is not performed. response.
  • the step of not responding to the request data may further include: extracting the The stored risk level is greater than the time at which the terminal corresponding to the network address of the preset level sends the request data to the port.
  • extracting the The stored risk level is greater than the time at which the terminal corresponding to the network address of the preset level sends the request data to the port.
  • a suspicious tag is added to the network address whose risk level is greater than the preset level.
  • the method when the computer readable instructions are executed by the processor, when the time for sending the request data is a preset time, after the suspicious tag step is added to the network address whose risk level is greater than the preset level, the method may further include The number of times the terminal corresponding to the network address corresponding to the preset level is sent to request data in the preset time period is queried. When the number of times is greater than or equal to the preset value, the network address to which the suspicious tag is added is added to the blacklist repository, and the network address request request data whose risk level added to the blacklist repository is greater than the preset level is not responded. .
  • Non-volatile memory can include read only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory.
  • Volatile memory can include random access memory (RAM) or external cache memory.
  • RAM is available in a variety of formats, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronization chain.
  • SRAM static RAM
  • DRAM dynamic RAM
  • SDRAM synchronous DRAM
  • DDRSDRAM double data rate SDRAM
  • ESDRAM enhanced SDRAM
  • Synchlink DRAM SLDRAM
  • Memory Bus Radbus
  • RDRAM Direct RAM
  • DRAM Direct Memory Bus Dynamic RAM
  • RDRAM Memory Bus Dynamic RAM

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

一种端口监控方法，包括：当在网络信息存储库中未查询到网络地址时，则对网络地址进行标记。获取接收请求数据的端口。根据端口的类型以及请求数据获取标记的网络地址的风险等级。当网络地址的风险等级大于预设等级时，则将风险等级大于预设等级的网络地址进行存储。当接收到风险等级大于预设等级的网络地址发送的请求数据时，则不对请求数据进行响应。

Description

端口监控方法、装置、计算机设备及存储介质
相关申请的交叉引用
本申请要求于2018年1月8日提交中国专利局，申请号为2018100162818，申请名称为“端口监控方法、装置、计算机设备及存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及一种端口监控方法、装置、计算机设备及存储介质。
背景技术
随着互联网科技的发展，人们可以在互联网上进行各种活动，因此，人们越来越关注是否会有入侵设备请求与服务器进行连接从而进行数据的传输，通常，入侵设备是先扫描服务器的端口，当寻找到服务器中可用的端口时，入侵设备则发送通信请求与服务器进行交互，若不及时发现有入侵设备对服务器进行端口扫描请求连接，进而进行防御，则会出现服务器被入侵的风险。
传统地，服务器需要对不同的端口都按时进行人工监控，从而排查是否有入侵设备对服务器的端口进行扫描，从而发现威胁，导致发现不及时，且发现效率低。
发明内容
根据本申请公开的各种实施例，提供一种端口监控方法、装置、计算机设备及存储介质。
一种端口监控的方法，包括：
接收终端发送的请求数据并提取所述请求数据上携带的网络地址；
当在网络信息存储库中未查询到所述网络地址时，则对所述网络地址进行标记；
获取接收所述请求数据的端口；
根据所述端口的类型以及所述请求数据获取标记的网络地址的风险等级；
当所述网络地址的风险等级大于预设等级时，则将所述风险等级大于预设等级的网络地址进行存储；及
当接收到所述风险等级大于预设等级的网络地址发送的所述请求数据时，则不对所述请求数据进行响应。
一种端口监控装置，包括：
提取模块，用于接收终端发送的请求数据并提取所述请求数据上携带的网络地址。
标记模块，用于当在网络信息存储库中未查询到所述网络地址时，则对所述网络地址进行标记。
第一获取模块，用于获取接收所述请求数据的端口。
第二获取模块，用于根据所述端口的类型以及所述请求数据获取标记的网络地址的风险等级。
存储模块，用于当所述网络地址的风险等级大于预设等级时，则将所述风险等级大于预设等级的网络地址进行存储；及
禁止响应模块，用于当接收到所述风险等级大于预设等级的网络地址发送的所述请求数据时，则不对所述请求数据进行响应。
一种计算机设备，包括存储器和一个或多个处理器，所述存储器中储存有计算机可读指令，所述计算机可读指令被所述处理器执行时，使得所述一个或多个处理器执行以下步骤：
接收终端发送的请求数据并提取所述请求数据上携带的网络地址；
当在网络信息存储库中未查询到所述网络地址时，则对所述网络地址进行标记；
获取接收所述请求数据的端口；
根据所述端口的类型以及所述请求数据获取标记的网络地址的风险等级；
当所述网络地址的风险等级大于预设等级时，则将所述风险等级大于预设等级的网络地址进行存储；及
当接收到所述风险等级大于预设等级的网络地址发送的所述请求数据时，则不对所述请求数据进行响应。
一个或多个存储有计算机可读指令的非易失性计算机可读存储介质，计算机可读指令被一个或多个处理器执行时，使得一个或多个处理器执行以下步骤：
接收终端发送的请求数据并提取所述请求数据上携带的网络地址；
当在网络信息存储库中未查询到所述网络地址时，则对所述网络地址进行标记；
获取接收所述请求数据的端口；
根据所述端口的类型以及所述请求数据获取标记的网络地址的风险等级；
当所述网络地址的风险等级大于预设等级时，则将所述风险等级大于预设等级的网络地址进行存储；及
当接收到所述风险等级大于预设等级的网络地址发送的所述请求数据时，则不对所述请求数据进行响应。
本申请的一个或多个实施例的细节在下面的附图和描述中提出。本申请的其它特征和优点将从说明书、附图以及权利要求书变得明显。
附图说明
为了更清楚地说明本申请实施例中的技术方案，下面将对实施例中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其它的附图。
图1为根据一个或多个实施例中端口监控方法的应用场景图。
图2为根据一个或多个实施例中端口监控方法的流程示意图。
图3为根据一个或多个实施例中端口监控装置的框图。
图4为根据一个或多个实施例中计算机设备的框图。
具体实施方式
为了使本申请的技术方案及优点更加清楚明白，以下结合附图及实施例，对本申请进行进一步详细说明。应当理解，此处描述的具体实施例仅仅用以解释本申请，并不用于限定本申请。
本申请提供的端口监控方法，可以应用于如图1所示的应用环境中。终端通过网络与服务器进行通信。服务器接收终端发送的请求数据，进而提取请求数据上携带的网络地址，当服务器在网络信息存储库中未查询到网络地址时，则该网络地址对应的终端为与服务器进行初次通信，则此时需要对该网络地址进行进一步识别查询，从而确定该网络地址对应的终端是否是入侵设备，进而服务器获取接收到终端发送请求数据的端口，根据接收到请求数据的端口的类型以及获取到的请求数据获取标记的网络地址的风险等级，当网络地址的风险等级大于预设等级时，则将该风险等级大于预设等级的网络地址进行存储，当接收到所述风险等级大于预设等级的网络地址发送的所述请求数据时，则不对所述请求数据进行响应，也即风险等级大于预设等级的网络地址对应的终端为入侵设备，则服务器不与该终端进行通信。终端可以但不限于是各种个人计算机、笔记本电脑、智能手机、平板电脑和便携式可穿戴设备，服务器可以用独立的服务器或者是多个服务器组成的服务器集群来实现。
在其中一个实施例中，如图2所示，提供了一种端口监控方法，以该方法应用于图1中的服务器为例进行说明，包括以下步骤：
S202：接收终端发送的请求数据并提取请求数据上携带的网络地址。
具体地，请求数据是指与服务器请求交换数据前的待响应信息，可以是，请求数据是终端在与服务器请求通信之前，向服务器发送的确认是否做好准备的待响应信息，例如，请求数据可以是终端向服务器请求通信之前，向服务器发送的第一次握手信息，如，请求数据可以是TCP数据包(Transmission Control Protocol，传输控制协议)，请求数据也可以是UDP数据包(User Datagram Protocol，用户数据报协议)等。网络地址是指处于某网络中的计算机的网络地址，该网络地址可以唯一地标识网络中的该计算机设备，该计算机与其他计算机或者服务器进行通信时可以采用网络地址作为通信标识，例如，网络地址可以是IP(Internet Protocol，互联网协议)地址等。进一步地，当接收到终端发送的请求数据时，请求数据上携带有终端对应的网络地址，进而直接提取请求数据上携带的网络地址进行查询从而识别该网络地址确认是否与该网络地址对应的终端进行数据交互等。例如，当服务器接收到终端发送的第一次握手信息时，则需要确定是否可以与该终端进行数据交互等，进而服务器提取接收到的终端发送的请求数据上携带的网络地址，通过识别请求数据上携带的网络地址从而判断是否与该终端进行信息交互。
S204：当在网络信息存储库中未查询到网络地址时，则对网络地址进行标记。
具体地，网络信息存储库是指配置在服务器上，可以存储有不同的网络地址的是数据 库，网络信息存储库中可以存储有第一IP地址、第二IP地址等不同的IP地址。进一步地，当接收到终端发送的请求数据并提取到请求数据携带的网络地址时，则与网络信息存储库中存储的待匹配网络地址进行匹配，当请求数据携带的网络地址未与待匹配网络地址匹配成功时，也即在网络信息存储库中未查询到该网络地址，则该请求数据携带的网络地址为需要继续识别的网络地址，从而确认是否为具有威胁性的网络地址，进而可以确认该网络地址对应的终端是否为入侵设备，则对请求数据上携带的网络地址进行标记，标记网络地址可以是对网络地址上添加有对应的标签，如可以是添加有待识别标签，则该请求数据上携带的网络地址为需要继续识别的网络地址。例如，服务器将提取到的请求数据携带的网络地址与存储在网络信息存储库中待匹配网络地址进行匹配，也即，可以是服务器将提取到的网络地址与网络信息存储库中存储的待匹配网络地址逐一匹配，直至遍历完网络信息存储库中存储的所有待匹配数据，当服务器提取到的网络地址与待匹配网络地址未匹配成功时，则服务器未在网络信息存储库中查询到该提取到的网络地址，进而该提取到的网络地址需要进一步识别，确认发送该请求数据的终端是否为入侵设备，则服务器取到网络地址进行标记，如对该网络地址添加待识别标签等。
S206：获取接收请求数据的端口。
具体地，端口是指服务器中可以与不同的计算机设备进行通信的接口，端口可以是接收不同类型的数据的接口，端口也可以是配置有不同的通信协议的端口；例如，端口可以是TCP端口，也可以是UDP端口等。进一步地，当提取到了网络地址时，并经过上述方法进行查询，当未在网络信息存储库中查询到则获取接收到携带有该网络地址的请求数据的端口。可以是，当服务器提取到请求数据上携带的网络地址时，并在网络信息存储库中未查询到该网络地址时，则对该网络地址进行标记进行后续识别，进而服务器获取接收到请求数据的端口。
S208：根据端口的类型以及请求数据获取标记的网络地址的风险等级。
具体地，根据上述步骤，当获取到端口时，进而查询端口的类型，根据查询到的端口的类型以及请求数据，识别进行标记的网络地址，进而获取标记的网络地址的风险等级。可以是，当服务器获取到端口时，查询该端口的类型，进而根据查询到的端口类型以及请求数据，识别进行标记的网络地址，如可以根据接收到请求数据的端口类型，根据端口类型查询接收到请求数据的端口数量，进而再获取请求数据的数量，从而与预设值进行判断，进而获取标记的网络地址的风险等级。
S210：当网络地址的风险等级大于预设等级时，则将风险等级大于预设等级的网络地址进行存储。
具体地，风险等级是用于评价网络地址是否安全的安全指标，风险等级可以是预设的评价网络地址是否安全的不同级别，例如，风险等级可以按照级别从低到高设置，风险等级越高，则表示对应的网络地址存在的风险越高，如，风险等级设置为1级到5级，表示网络地址对应的风险越来越高。进一步地，预设有相应的等级，当网络地址的风险等级大于相应的等级时，则该网络地址为具有威胁性的网络地址，该网络地址对应的终端可以看作为入侵设备，进而，将查询的风险等级大于预设等级的网络地址进行存储，例如，预设 等级可以设置为3，当风险等级大于3级时，则该网络地址为具有威胁性的网络地址，该网络地址对应的中段可以看作为入侵设备，进而，服务器可以将该网络地址存储在相应的数据库里，则该网络地址为禁止通信的网络地址，则该网络地址对应的终端为禁止与服务器进行数据交互的设备。需要说明的是，预设等级还可以根据服务器需要进行通信的实际情况，预设为2级、4级、5级等。
S212：当接收到风险等级大于预设等级的网络地址发送的请求数据时，则不对请求数据进行响应。
具体地，当网络地址的风险等级大于预设等级时，则当前风险等级大于预设等级的网络地址为有威胁性的网络地址，该风险等级大于预设等级的网络地址对应的终端为入侵设备，则该网络地址为禁止通信的网络地址，进而该网络地址对应的终端为禁止与服务器进行数据交互的设备，则当服务器接收到已存储的风险等级大于预设等级的网络地址发送的请求数据时，则不响应该请求数据，进而，该网络地址对应的终端未收到请求数据对应的服务器的响应数据时，则无法与服务器进行数据交互。
需要说明的是，本实施例中，也可以是服务器接收到终端发送的请求数据并提取请求数据上携带的网络地址，当在网络信息存储库中未查询到网络地址时，则对网络地址进行标记，进而查询在预设的时间段内标记的网络地址对应的终端向服务器发送的请求数据的次数，例如，预设时间段可以是10分钟内发送了1000次，当发送请求数据的次数超过预设值时，则该网络地址对应的终端可能是在试探服务器的端口的打开情况，也即标记的网络地址可能是具有威胁性的网络地址，则标记的网络地址对应的终端可能为入侵设备，则继续对标记的网络地址进行识别，服务器获取接收请求数据的端口，进而根据端口的类型以及请求数据获取标记的网络地址的风险等级，当标记的网络地址的风险等级大于预设等级时，将该风险等级大于预设等级的网络地址进行存储。其他可选的，预设时间段可以为2分钟、3分钟、5分钟等，预设的次数可以是10次、50次、100次、500次等。
上述实施例中，当服务器接收到待识别设备发送的请求数据时，提取请求数据上的网络地址，在网络信息存储库中查询该网络地址，从而判断网络地址进行识别判断是否为首次通信的网络地址，当为首次通信的网络地址时，对该网络地址进行标记，进而根据接收到该请求数据的端口的端口类型以及请求数据获取该网络地址的风险等级，当风险等级大于预设等级时，则将风险等级大于预设等级的网络地址进行存储，也即该网络地址对应的终端可能具有威胁性，当接收到所述风险等级大于预设等级的网络地址发送的所述请求数据时，则不对所述请求数据进行响应。无需人工随时进行监控，可以自动根据端口的类型以及请求数据识别网络地址，从而识别出该网络地址对应的终端为入侵设备，避免在监控中由于人工的监控导致有遗漏，且避免人工分析的耗时，提高发现效率以及可以及时发现风险。
在其中一个实施例中，步骤S208可以包括如下的流程，步骤S208，即根据端口的类型以及请求数据获取标记的网络地址的风险等级的步骤，可以包括：
当端口为第一类型端口时，则获取接收到的请求数据的端口数量。具体地，第一类型端口是指配置有相应的通信协议，从而可以用于接收或发送普通的信息的端口，第一类型 端口可以是配置有UDP通信协议的端口，例如，第一类型端口为UDP端口。进一步地，当对网路地址进行标记时，则需要对网络地址继续识别，进而获取接收请求数据的端口，当收到请求数据的端口为第一类型端口时，进而获取接收到请求数据的端口数量。例如，当服务器对网络地址进行标记时，则需要对网络地址继续识别，则服务器获取接收请求数据的接口，如获取到接收该请求数据的端口为UDP端口时，则接收到的请求数据为UDP数据包，进而，需要根据接收到UDP数据包的端口的数量查询该网络地址的风险等级，则服务器获取接收到该UDP数据包的UDP端口的数量。
获取当前有效端口的数量。有效端口是指在服务器中对应类型的已打开且可用的可以与其他计算机设备，如终端或服务器进行数据交互的接口。进一步地，当获取到接收到请求数据的端口数量时，进而获取当前有效端口的数量。例如，服务器获取到接收UDP数据包的UDP端口的数量时，服务器获取服务器中所有的已打开且可用的UDP端口可以进行数据交互的端口的数量。
当接收到请求数据的端口数量与当前有效端口的数量的比值小于预设值时，则网络地址的风险等级大于预设等级，否则，网络地址的风险等级小于等于预设等级。具体地，根据接收请求数据的端口数量与当前有效端口，从而确定风险等级，计算接收到请求数据的端口数量与当前有效端口的数量的比值，当比值小于预设值时，则所有第一类型端口都接收到了网络地址对应的终端发送的请求数据，而不仅仅是打开的可用的第一类型端口接收到请求数据，也即网络地址对应的终端为试探服务器的端口是否打开，则网络地址的风险等级大于预设等级，进而该网络地址对应的终端为入侵设备，当计算接收到请求数据的端口数量与当前有效端口的数量的比值等于或大于预设值时，则该进行了标记的网络地址的风险等级小于预设等级。例如，当为第一类型端口时，则为UDP端口时，请求数据为UDP数据包，则服务器根据接收到的UDP数据包的端口数量与当前打开的UDP端口的数据量确定风险等级，也即计算接收到UDP数据包的UDP端口数量与已打开的可用的UDP端口的数量的比值，如当比值小于预设值3时，则所有的UDP端口都接收到了UDP数据包，也即进行标记的网络地址对应的终端是试探UDP端口是否为打开的可用的状态，则该进行标记的网络地址的风险等级大于预设等级，如果计算接收到UDP数据包的UDP端口数量与已打开的可用的UDP端口的数量的比值大于或等于3时，则进行标记的网络地址的风险等级小于预设等级。需要说明的是，当接收到请求数据的端口数量与当前有效端口的数量的比值的预设值还可以设置为4或5等。
本实施例中，根据对应端口的端口类型，当为第一类型端口时，则直接采用接收请求数据的第一类型端口的数量与当前有效端口的数量的比值获取进行标记的网络地址的风险等级，获取风险等级的方式简单，且根据第一类型端口选取对应的获取进行标识的网络地址的风险等级，选取灵活，适用性强。
在其中一个实施例中，步骤S208可以包括如下的流程，步骤S208，即根据端口的类型以及请求数据获取标记的网络地址的风险等级的步骤，还可以包括：
当端口为第二类型端口时，则获取请求数据中的标志位。第二类型端口是指配置有相应的通信协议，从而可以用于接收或发送重要的信息的端口，第二类型端口可以是配置有 TCP通信协议的端口，例如，第一类型端口为TCP端口。标志位是指请求数据中携带有标识当前请求数据发送状态的标识，例如，标志位可以是紧急标志位(URG)、有意义的应答标志位(ACK)、重置连接标志位(RST)、同步序列号标志位(SYN)、完成发送数据标志位(FIN)或空标志位等。进一步地，当对网路地址进行标记时，则需要对网络地址继续识别，进而获取接收请求数据的端口当端口的类型为第二类型端口时，则获取接收到的请求数据中的标志位。可以是，当服务器对网络地址进行标记时，则需要对网络地址继续识别，则服务器获取接收请求数据的端口，如获取到接收该请求数据的端口为TCP端口时，则接收到的请求数据为TCP数据包，进而，需要根据接收到的TCP数据包中的标志位查询该网络地址的风险等级，则服务器获取接收到的TCP数据包中不同的标志位的数量，如获取标志位可以是紧急标志位(URG)、有意义的应答标志位(ACK)、重置连接标志位(RST)、同步序列号标志位(SYN)、完成发送数据标志位(FIN)以及空标志位等。
获取存在预设标志信息的标志位的数量。具体地，预设标志信息是指预先设置的表示请求数据的状态的信息。例如，预设标志信息可以是预设的表示请求数据的状态的信息，如可以是获取同步序列号、已完成发送数据或空标志等。进一步地，当获取到请求数据中的标志位时，则查询请求数据中的标志位存在预设标志信息的数量。可以是，预设标志信息可以是已完成发送数据，当服务器获取到TCP数据包的不同标志位时，获取标志位中表示为已完成发送数据的标志位的数量，也即可以是获取完成发送数据标志位(FIN)的数量；也可以是，预设标志信息可以是获取同步序列号数据，当服务器获取到TCP数据包的不同标志位时，获取标志位中表示获取同步序列号数据的标志位的数量，也即可以是获取同步序列号标志位(SYN)的数量；还可以是，预设标志位信息可以是空标志，当服务器获取到TCP数据包的不同标志位时，获取标志位中表示空标志的标志位的数量，也即可以获取空标志位的数量等。
统计请求数据的接收数量。具体地，服务器统计接收到的请求数据的数量。可以是，当接收请求数据的端口为TCP端口时，则接收到的请求数据为TCP数据包，统计接收到TCP数据包的数量。
当存在预设标志信息的标志位的数量与请求数据的接收数量的比值超过阈值时，则网络地址的风险等级大于预设等级，否则，网络地址的风险等级小于等于预设等级。具体的，计算存在预设标志信息的标志位的数量与请求数据的接收数量的比值，当比值超过阈值时，则进行标记的网络地址的风险等级大于预设等级，当比值等于或小于阈值时，则进行标记的网络地址的风险等级小于预设等级。可以是，当接收请求数据的端口为TCP端口时，则接收到的请求数据为TCP数据包，统计接收到TCP数据包的数量，当预设标志信息是已完成发送数据，获取标志位中表示为已完成发送数据的标志位的数量，也即可以是获取完成发送数据标志位(FIN)的数量，进而计算TCP数据包中表示为已完成发送数据的标志位的数量与接收到TCP数据包数量的比值，当比值超过20％时，则认为进行标记的网络地址对应的终端向服务器所有TCP端口都发送有第一次握手信息，也即试探服务器打开的端口从而与服务器打开的端口进行数据交互请求，则该进行标识的网络地址为风 险等级大于预设等级的网络地址，则该网络地址对应的终端为入侵设备，但若比值小于20％或等于20％时，则进行标识的网络地址为风险等级小于等于预设等级的网络地址。也可以是，预设标志信息也可以是获取同步序列号数据或空标志等，则判断步骤如上，在此不再赘述。
需要说明的时，存在预设标志信息的标志位的数量与请求数据的接收数量的比值的阈值可以是10％，12％，15％，21％等。
需要说明的时，当端口为第二类型的端口时，服务器也可以获取接收到请求数据的端口数量，进而获取当前有效端口的数量，当接收到请求数据的端口数量与当前有效端口的数量的比值小于预设值时，则网络地址的风险等级大于预设等级，否则，网络地址的风险等级小于等于预设等级。例如，当端口为TCP端口时，则接收到的请求数据为TCP数据包，进而服务器获取到接收TCP数据包的TCP端口的数量，且获取当前有效可用的TCP端口的数量，当接收到TCP数据包的TCP端口数量与当前有效可用的TCP端口的数量的比值小于3时，则网络地址的风险等级大于预设等级，否则，网络地址的风险等级小于等于预设等级。其中，接收到请求数据的端口数量与当前有效端口的数量的比值的预设值还可以为4或5等。
本实施例中，根据对应端口的端口类型，当为第二类型端口时，则采用请求数据中的标志位进行判断，判断方式多样，且判断准确，选取灵活，增强适用性。
在其中一个实施例中，上述方法还可以包括如下步骤：
网络信息存储库包括黑名单存储库与白名单存储库。具体地，黑名单存储库是指存储有禁止通信的网络地址的数据库，禁止通信的网络地址是具有威胁性的网络地址；白名单存储库是指存储有可信的网络地址的数据库，可信的网络地址是指服务器可以与该可信的网络地址对应的终端直接进行通信，而无需进一步识别的网络地址。
将提取到的网络地址与黑名单存储库中的网络地址进行匹配。具体地，当提取到请求数据上携带的网络地址，则与黑名单存储库中存储的网络地址进行匹配。可以是，服务器将提取到请求数据上携带的网络地址与黑名单存储库中存储的网络地址逐一进行匹配，直至遍历完黑名单存储库中的所有网络地址。例如，服务器将提取到的请求数据上携带的网络地址，将提取到的网络地址与黑名单存储库中的任意一个网络地址按照字符进行匹配，当未匹配成功时，则继续与黑名单存储库中下一个网络地址按照字符进行匹配，直至遍历完黑名单存储库中的所有网络地址。
当提取到的网络地址与黑名单存储库中的网络地址匹配成功时，则提取到的网络地址为禁止通信网络地址。具体地，当提取到的网络地址与黑名单存储库中的存储的网络地址逐一进行匹配，当与其中任意一个网络地址匹配成功时，则提取到的网络地址为禁止通信网络地址，则该网络地址为具有威胁性的网络地址，进而无法与该网络地址对应的终端进行数据交互。可以是，服务器提取到的网络地址与黑名单存储库中存储的网络地址逐一进行匹配，当与其中任意一个网络地址匹配成功时，则提取到的网络地址为禁止通信网络地址。
当提取到的网络地址未与黑名单存储库中的网络地址匹配成功时，则将提取到的网络 地址与白名单存储库中存储的网络地址进行匹配。具体地，当提取到的网络地址与黑名单存储库中存储的网络地址逐一进行匹配，当遍历完成黑名单存储库中所有的网络地址，提取到的网络地址都未与黑名单存储库中存储的网络地址匹配成功时，则需要进行继续识别，则将提取到的网络地址与白名单存储库中存储的网络地址进行逐一匹配，直至遍历完白名单存储库中存储的所有的网络地址。可以是，服务器将提取到的网络地址与黑名单存储库中的网络地址逐一进行匹配，当遍历完成黑名单存储库中所有的网络地址，提取到的网络地址都未与黑名单存储库中存储的网络地址匹配成功时，则继续识别，进而服务器将提取到的网络地址与白名单存储库中存储的任意一个网络地址进行匹配，当未匹配成功时，则服务器将提取到的网络地址与白名单存储库中下一个网络地址进行匹配，直至遍历完白名单存储库中存储的网络地址。
当提取到的网络地址未与白名单存储库中存储的网络地址匹配成功时，则在网络信息存储库中未查询到网络地址。具体地，当提取到的网络地址与白名单存储库中存储的网络地址逐一进行匹配，未与白名单存储库中存储的网络地址匹配成功时，则提取到的网络地址也不是可信任的网络地址，也即在网络信息存储库中未查询到提取到的网络地址。可以是，服务器将提取到的网络地址与白名单存储库中的网络地址逐一进行匹配，当遍历完成白名单存储库中所有的网络地址，提取到的网络地址都未与白名单存储库中存储的网络地址匹配成功时，则在网络信息存储库中未查询到该网络地址，进而对该网络地址进行继续识别。
本实施例中，服务器将提取到的网络地址与黑名单存储库进行匹配，当匹配成功时则为禁止通信网络地址，则服务器不与该网络地址对应的终端进行数据交互，当未在黑名单存储库中查询到该提取到的网络地址时，则将该提取到的网络地址与白名单存储库中存储的网络地址进行匹配，当未匹配成功时，则该网络地址也不是可信任的网络地址，则需要进一步识别，也即该网络地址未在网络信息存储库中查询到该网络地址。先查询是否为禁止通信网络地址或者是可信任网络地址，避免后续识别的误识别，提高准确性，增强适用性。
在其中一个实施例中，上述步骤S212，即当接收到风险等级大于预设等级的网络地址发送的请求数据时，则不对请求数据进行响应的步骤，可以包括：
查询风险等级大于预设等级的网络地址对应的终端向端口发送请求数据的频率。具体地，当将风险等级大于预设等级的网络地址进行存储后，则查询该存储的风险等级大于预设等级的网络地址对应的终端发送请求数据的频率，可以是，服务器将风险等级大于预设等级的网络地址进行存储后，则获取该风险等级大于预设等级的网络地址对应的终端向端口发送请求数据的时间段，并获取风险等级大于预设等级的网络地址对应的终端在该时间段内向端口发送请求数据的次数，进而计算发送请求数据的次数与发送请求数据的时间段的比值，获得风险等级大于预设等级的网络地址对应的终端向端口发送请求数据的频率。例如，端口可以是TCP端口，请求数据可以为TCP数据包，服务器将风险等级大于预设等级的网络地址进行存储后，则获取该风险等级大于预设等级的网络地址对应的终端向TCP端口发送TCP数据包的时间段，并获取风险等级大于预设等级的网络地址对应的终 端在该时间段内向TCP端口发送TCP数据包的次数，进而计算发送TCP数据包的次数与发送TCP数据包的时间段的比值，获得风险等级大于预设等级的网络地址对应的终端向TCP端口发送请求数据的频率。端口也可以是UDP端口，请求数据也可以为UDP数据包，进而按照如上的方法查询风险等级大于预设等级的网络地址对应的终端向UDP端口发送UDP数据包的频率，在此不再赘述。
当频率大于预设频率时，则将风险等级大于预设等级的网络地址添加到黑名单存储库中，则不对添加到所述黑名单存储库中的所述风险等级大于预设等级的网络地址发送请求数据进行响应。具体地，当获取到风险等级大于预设等级的网络地址对应的终端向端口发送请求数据的频率时，比较该频率与预设频率，当该频率大于预设频率时，则该风险等级大于预设等级的网络地址为禁止通信网络地址，进而将该网络地址添加到黑名单存储库中，也即当网络地址对应的终端向服务器发送请求数据时，则不响应该请求数据，则服务器不再与该网络地址对应的终端进行数据交互。可以是，当服务器获取到风险等级大于预设等级的网络地址对应的终端想端口发送请求数据的频率时，比较该频率与预设频率，当该频率大于预设频率时，则该风险等级大于预设等级的网络地址对应的终端是在试探终端打开的端口，则为具有威胁性的网络地址，进而该网络地址对应的终端为入侵设备，则服务器将该风险等级大于预设等级的网络地址添加到黑名单存储库中，进而当网络地址对应的终端向服务器发送请求数据时，则不响应该请求数据，则服务器不再与该网络地址对应的终端进行数据交互。需要说明的是，预设频率可以为5、10、12、13、15等。
本实施例中，可以直接根据查询风险等级大于预设等级的网络地址对应的终端向端口发送请求数据的频率与预设频率进行比较，当大于预设频率时，则将该风险等级大于预设等级的网络地址添加到黑名单存储库中，则不对添加到所述黑名单存储库中的所述风险等级大于预设等级的网络地址发送请求数据进行响应，判断风险等级大于预设等级的网络地址为禁止通信网络地址的方法简单，判断效率高，识别服务器端口被入侵设备扫描的效率高。
在其中一个实施例中，上述步骤S212，即当接收到风险等级大于预设等级的网络地址发送的请求数据时，则不对请求数据进行响应的步骤，还可以包括：
提取已存储的风险等级大于预设等级的网络地址对应的终端向端口发送请求数据的时间。具体地，当将风险等级大于预设等级的网络地址进行存储后，则提取该已存储的风险等级大于预设等级的网络地址对应的终端向端口发送请求数据的时间。可以是，服务器将风险等级大于预设等级的网络地址进行存储后，查询到端口接收请求数据的时间，进而提取该时间。
当发送请求数据的时间在预设的时间段内时，则对风险等级大于预设等级的网络地址添加可疑标签。具体地，可疑标签是指该风险等级大于预设等级的网络地址的风险程度的标识，可疑标签可以是表示风险等级大于预设等级的网络地址需要进一步判断是否为禁止通信网络地址的标识。进一步地，当服务器提取到风险等级大于预设等级的网络地址对应的终端向端口发送请求数据的时间在预设时间段内时，则该风险等级大于预设等级的网络地址对应的终端在特殊时间段内向服务器的端口发送请求数据，进而请求与服务器进行数 据交互等，则可能为可疑的风险等级大于预设等级的网络地址，则服务器对风险等级大于预设等级的网络地址添加可疑标签。需要说明的是，预设的时间段可以是服务器通常不与终端进行数据交互的特殊时间段，预设的时间段可以是凌晨的某个时间段等，例如，预设的时间段可以是23点到凌晨0点之间，预设的时间段可以是凌晨1点至凌晨1点30分之间等。
本实施例中，服务器根据已存储的风险等级大于预设等级的网络地址对应的终端向端口发送请求数据的时间是否在预设的时间段内，如果在预设时间段内则需要进一步分析，进而添加可疑标签，可以监控预设的时间段，例如一些特殊时间，且采取不同的方式识别风险等级大于预设等级的网络地址，从而识别对应入侵设备，查询准确，且发现及时增强适用性。
在其中一个实施例中，上述当发送请求数据的时间为预设的时间时，则对风险等级大于预设等级的网络地址添加可疑标签步骤之后，还可以包括：
查询添加可疑标签的风险等级大于预设等级的网络地址对应的终端在预设时间段内发送请求数据的次数。具体地，服务器查询添加了可疑标签的风险等级大于预设等级的网络地址对应的终端在预设时间段内发送请求数据的次数。可以是，服务器查询添加了可疑标签的风险等级大于预设等级的网络地址对应的终端在上述时间段内向服务器的端口发送请求数据的次数，例如，可以统计在特殊时间，凌晨1点至1点30分之间添加可疑标签的风险等级大于预设等级的网络地址对应的终端向TCP端口发送TCP数据包的次数，也可以统计在特殊时间，凌晨1点至1点30分之间添加可疑标签的风险等级大于预设等级的网络地址对应的终端向UDP端口发送UDP数据包的次数等。
当次数大于等于预设值时，则将添加了可疑标签的网络地址添加到黑名单存储库中，则不对添加到所述黑名单存储库中的所述风险等级大于预设等级的网络地址发送请求数据进行响应。具体地，当服务器统计的次数大于预设次数时，则在预设时间段内风险等级大于预设等级的网络地址对应的终端是在试探服务器打开的端口，则该风险等级大于预设等级的网络地址为禁止通信网络地址，则服务器不与该网络地址对应的终端进行数据交互等，则将该网络地址添加至黑名单存储库中，也即当网络地址对应的终端向服务器发送请求数据时，则不响应该请求数据，则服务器不再与该网络地址对应的终端进行数据交互。例如，可以预设次数为10次，当服务器统计添加了可疑标签的风险等级大于预设等级的网络地址对应的终端向服务器端口发送请求数据的次数大于10次时，则该风险等级大于预设等级的网络地址为禁止通信网络地址，则服务器不与该网络地址对应的终端进行数据交互等，则将该网络地址添加至黑名单存储库中，也即当网络地址对应的终端向服务器发送请求数据时，则不响应该请求数据，则服务器不再与该网络地址对应的终端进行数据交互。需要说明的时，预设次数还可以为11次、21次、30次、50次等。
本实施例中，当查询到风险等级大于预设等级的网络地址对应的终端向端口发送请求数据的时间，进而当该时间在预设的时间段内时，则对风险等级大于预设等级的网络地址添加可疑标签，也即进行第一级识别，进而对添加了可疑标签的风险等级大于预设等级的网络地址进行进一步识别，识别添加了可疑标签的风险等级大于预设等级的网络地址对应 的终端在预设时间端内发送请求数据的次数，当次数大于等于预设值时，则将该网络地址添加至黑名单存储库，即进行第二级识别，最终确定该网络地址为禁止通信网络地址，则通过两级分析，识别准确，进而对识别风险等级大于预设等级的网络地址对应的终端为入侵设备准确且及时。
应该理解的是，虽然图2的流程图中的各个步骤按照箭头的指示依次显示，但是这些步骤并不是必然按照箭头指示的顺序依次执行。除非本文中有明确的说明，这些步骤的执行并没有严格的顺序限制，这些步骤可以以其它的顺序执行。而且，图2中的至少一部分步骤可以包括多个子步骤或者多个阶段，这些子步骤或者阶段并不必然是在同一时刻执行完成，而是可以在不同的时刻执行，这些子步骤或者阶段的执行顺序也不必然是依次进行，而是可以与其它步骤或者其它步骤的子步骤或者阶段的至少一部分轮流或者交替地执行。
在其中一个实施例中，如图3所示，提供一端口监控装置的接口示意图，端口监控装置300可以包括提取模块310、标记模块320、第一获取模块330、第二获取模块340和存储模块350，其中：
提取模块310，用于接收终端发送的请求数据并提取请求数据上携带的网络地址。
标记模块320，用于当在网络信息存储库中未查询到网络地址时，则对网络地址进行标记。
第一获取模块330，用于获取接收请求数据的端口。
第二获取模块340，用于根据端口的类型以及请求数据获取标记的网络地址的风险等级。
存储模块350，用于当网络地址的风险等级大于预设等级时，则将风险等级大于预设等级的网络地址进行存储。
禁止响应模块360，用于当接收到风险等级大于预设等级的网络地址发送的请求数据时，则不对请求数据进行响应。
在其中一个实施例中，第二获取模块340可以包括：
第一数量获取单元，用于当端口为第一类型端口时，则获取接收到的请求数据的端口数量。
第二数量获取单元，用于获取当前有效端口的数量。
第一判断单元，用于当接收到请求数据的端口数量与当前有效端口的数量的比值小于预设值时，则网络地址的风险等级大于预设等级，否则，网络地址的风险等级小于等于预设等级。
在其中一个实施例中，第二获取模块340还可以包括：
标志位获取单元，用于当端口为第二类型端口时，则获取请求数据中的标志位。
标志位数量获取单元，用于获取存在预设标志信息的标志位的数量。
统计单元，用于统计请求数据的接收数量。
第二判断单元，当存在预设标志信息的标志位的数量与请求数据的接收数量的比值超过阈值时，则网络地址的风险等级大于预设等级，否则，网络地址的风险等级小于等于预 设等级。
在其中一个实施例中，端口监控装置300还可以包括：
第一匹配模块，用于将提取到的网络地址与黑名单存储库中的网络地址进行匹配。
禁止通信网络地址提取模块，用于当提取到的网络地址与黑名单存储库中的网络地址匹配成功时，则提取到的网络地址为禁止通信网络地址。
第二匹配模块，用于当提取到的网络地址未与黑名单存储库中的网络地址匹配成功时，则将提取到的网络地址与白名单存储库中存储的网络地址进行匹配；
查询模块，用于当提取到的网络地址未与白名单存储库中存储的网络地址匹配成功时，则在网络信息存储库中未查询到网络地址。
在其中一个实施例中，禁止访问模块360还可以包括：
频率查询模块，用于查询风险等级大于预设等级的网络地址对应的终端向端口发送请求数据的频率。
第一添加模块，用于当频率大于预设频率时，则将风险等级大于预设等级的网络地址添加到黑名单存储库中，则不对添加到所述黑名单存储库中的所述风险等级大于预设等级的网络地址发送请求数据进行响应。
在其中一个实施例中，禁止访问模块360还可以包括：
时间提取模块，用于提取已存储的风险等级大于预设等级的网络地址对应的终端向端口发送请求数据的时间。
可疑标签添加模块，用于当发送请求数据的时间在预设的时间段内时，则对风险等级大于预设等级的网络地址添加可疑标签。
在其中一个实施例中，禁止访问模块360还可以包括：
次数查询模块，用于查询添加可疑标签的风险等级大于预设等级的网络地址对应的终端在预设时间段内发送请求数据的次数。
第二添加模块，用于当次数大于等于预设值时，则将添加了可疑标签的网络地址添加到黑名单存储库中，则不对添加到所述黑名单存储库中的所述风险等级大于预设等级的网络地址发送请求数据进行响应。
关于端口监控装置的具体限定可以参见上文中对于端口监控方法的限定，在此不再赘述。上述端口监控装置中的各个模块可全部或部分通过软件、硬件及其组合来实现。上述各模块可以硬件形式内嵌于或独立于计算机设备中的处理器中，也可以以软件形式存储于计算机设备中的存储器中，以便于处理器调用执行以上各个模块对应的操作。
在一个实施例中，提供了一种计算机设备，该计算机设备可以是服务器，其内部结构图可以如图4所示。该计算机设备包括通过***总线连接的处理器、存储器、网络接口和数据库。其中，该计算机设备的处理器用于提供计算和控制能力。该计算机设备的存储器包括非易失性存储介质、内存储器。该非易失性存储介质存储有操作***、计算机可读指令和数据库。该内存储器为非易失性存储介质中的操作***和计算机可读指令的运行提供环境。该计算机设备的数据库用于存储端口监控数据。该计算机设备的网络接口用于与外部的终端通过网络连接通信。该计算机可读指令被处理器执行时以实现一种端口监控方 法。
本领域技术人员可以理解，图4中示出的结构，仅仅是与本申请方案相关的部分结构的框图，并不构成对本申请方案所应用于其上的计算机设备的限定，具体的计算机设备可以包括比图中所示更多或更少的部件，或者组合某些部件，或者具有不同的部件布置。
一种计算机设备，包括存储器和一个或多个处理器，存储器中储存有计算机可读指令，计算机可读指令被处理器执行时，使得一个或多个处理器执行以下步骤：计算机可读指令：接收终端发送的请求数据并提取请求数据上携带的网络地址。当在网络信息存储库中未查询到网络地址时，则对网络地址进行标记。获取接收请求数据的端口。根据端口的类型以及请求数据获取标记的网络地址的风险等级。当网络地址的风险等级大于预设等级时，则将风险等级大于预设等级的网络地址进行存储。及当接收到风险等级大于预设等级的网络地址发送的请求数据时，则不对请求数据进行响应。
在其中一个实施例中，处理器执行计算机可读指令时实现根据端口的类型以及请求数据获取标记的网络地址的风险等级的步骤，可以包括：当端口为第一类型端口时，则获取接收到的请求数据的端口数量。获取当前有效端口的数量。及当接收到请求数据的端口数量与当前有效端口的数量的比值小于预设值时，则网络地址的风险等级大于预设等级，否则，网络地址的风险等级小于等于预设等级。
在其中一个实施例中，处理器执行计算机可读指令时实现根据端口的类型以及请求数据获取标记的网络地址的风险等级的步骤，还可以包括：当端口为第二类型端口时，则获取请求数据中的标志位。获取存在预设标志信息的标志位的数量。统计请求数据的接收数量。及当存在预设标志信息的标志位的数量与请求数据的接收数量的比值超过阈值时，则网络地址的风险等级大于预设等级，否则，网络地址的风险等级小于等于预设等级。
在其中一个实施例中，处理器执行计算机可读指令时还可以实现以下步骤：将提取到的网络地址与黑名单存储库中的网络地址进行匹配。当提取到的网络地址与黑名单存储库中的网络地址匹配成功时，则提取到的网络地址为禁止通信网络地址。当提取到的网络地址未与黑名单存储库中的网络地址匹配成功时，则将提取到的网络地址与白名单存储库中存储的网络地址进行匹配。及当提取到的网络地址未与白名单存储库中存储的网络地址匹配成功时，则在网络信息存储库中未查询到网络地址。
在其中一个实施例中，处理器执行计算机可读指令时实现当接收到风险等级大于预设等级的网络地址发送的请求数据时，则不对请求数据进行响应的步骤，还可以包括：查询风险等级大于预设等级的网络地址对应的终端向端口发送请求数据的频率。及当频率大于预设频率时，则将风险等级大于预设等级的网络地址添加到黑名单存储库中，则不对添加到黑名单存储库中的风险等级大于预设等级的网络地址发送请求数据进行响应。
在其中一个实施例中，处理器执行计算机可读指令时实现当接收到风险等级大于预设等级的网络地址发送的请求数据时，则不对请求数据进行响应的步骤，还可以包括：提取已存储的风险等级大于预设等级的网络地址对应的终端向端口发送请求数据的时间。及当发送请求数据的时间在预设的时间段内时，则对风险等级大于预设等级的网络地址添加可疑标签。
在其中一个实施例中，处理器执行计算机可读指令时实现当发送请求数据的时间为预设的时间时，则对风险等级大于预设等级的网络地址添加可疑标签步骤之后，还可以包括：查询添加可疑标签的风险等级大于预设等级的网络地址对应的终端在预设时间段内发送请求数据的次数。及当次数大于等于预设值时，则将添加了可疑标签的网络地址添加到黑名单存储库中，则不对添加到黑名单存储库中的风险等级大于预设等级的网络地址发送请求数据进行响应。
上述关于计算机设备的具体限定可以参见上文中关于端口监控方法的限定，在此不再赘述。
一个或多个存储有计算机可读指令的非易失性计算机可读存储介质，计算机可读指令被一个或多个处理器执行时，使得一个或多个处理器执行以下步骤：接收终端发送的请求数据并提取请求数据上携带的网络地址。当在网络信息存储库中未查询到网络地址时，则对网络地址进行标记。获取接收请求数据的端口。根据端口的类型以及请求数据获取标记的网络地址的风险等级。及当网络地址的风险等级大于预设等级时，则将风险等级大于预设等级的网络地址进行存储。当接收到风险等级大于预设等级的网络地址发送的请求数据时，则不对请求数据进行响应。
在其中一个实施例中，计算机可读指令被处理器执行时实现根据端口的类型以及请求数据获取标记的网络地址的风险等级的步骤，可以包括：当端口为第一类型端口时，则获取接收到的请求数据的端口数量。获取当前有效端口的数量。当接收到请求数据的端口数量与当前有效端口的数量的比值小于预设值时，则网络地址的风险等级大于预设等级，否则，网络地址的风险等级小于等于预设等级。
在其中一个实施例中，计算机可读指令被处理器执行时实现根据端口的类型以及请求数据获取标记的网络地址的风险等级的步骤，还可以包括：当端口为第二类型端口时，则获取请求数据中的标志位。获取存在预设标志信息的标志位的数量。统计请求数据的接收数量。当存在预设标志信息的标志位的数量与请求数据的接收数量的比值超过阈值时，则网络地址的风险等级大于预设等级，否则，网络地址的风险等级小于等于预设等级。
在其中一个实施例中，计算机可读指令被处理器执行时还可以实现以下步骤：将提取到的网络地址与黑名单存储库中的网络地址进行匹配。当提取到的网络地址与黑名单存储库中的网络地址匹配成功时，则提取到的网络地址为禁止通信网络地址。当提取到的网络地址未与黑名单存储库中的网络地址匹配成功时，则将提取到的网络地址与白名单存储库中存储的网络地址进行匹配。当提取到的网络地址未与白名单存储库中存储的网络地址匹配成功时，则在网络信息存储库中未查询到网络地址。
在其中一个实施例中，计算机可读指令被处理器执行时实现当接收到风险等级大于预设等级的网络地址发送的请求数据时，则不对请求数据进行响应的步骤，还可以包括：查询风险等级大于预设等级的网络地址对应的终端向端口发送请求数据的频率。当频率大于预设频率时，则将风险等级大于预设等级的网络地址添加到黑名单存储库中，则不对添加到黑名单存储库中的风险等级大于预设等级的网络地址发送请求数据进行响应。
在其中一个实施例中，计算机可读指令被处理器执行时实现当接收到风险等级大于预 设等级的网络地址发送的请求数据时，则不对请求数据进行响应的步骤，还可以包括：提取已存储的风险等级大于预设等级的网络地址对应的终端向端口发送请求数据的时间。当发送请求数据的时间在预设的时间段内时，则对风险等级大于预设等级的网络地址添加可疑标签。
在其中一个实施例中，计算机可读指令被处理器执行时实现当发送请求数据的时间为预设的时间时，则对风险等级大于预设等级的网络地址添加可疑标签步骤之后，还可以包括：查询添加可疑标签的风险等级大于预设等级的网络地址对应的终端在预设时间段内发送请求数据的次数。当次数大于等于预设值时，则将添加了可疑标签的网络地址添加到黑名单存储库中，则不对添加到黑名单存储库中的风险等级大于预设等级的网络地址发送请求数据进行响应。
上述关于存储介质的具体限定可以参见上文中关于端口监控方法的限定，在此不再赘述。
本领域普通技术人员可以理解实现上述实施例方法中的全部或部分流程，是可以通过计算机可读指令来指令相关的硬件来完成，所述的计算机可读指令可存储于一非易失性计算机可读取存储介质中，该计算机可读指令在执行时，可包括如上述各方法的实施例的流程。其中，本申请所提供的各实施例中所使用的对存储器、存储、数据库或其它介质的任何引用，均可包括非易失性和/或易失性存储器。非易失性存储器可包括只读存储器(ROM)、可编程ROM(PROM)、电可编程ROM(EPROM)、电可擦除可编程ROM(EEPROM)或闪存。易失性存储器可包括随机存取存储器(RAM)或者外部高速缓冲存储器。作为说明而非局限，RAM以多种形式可得，诸如静态RAM(SRAM)、动态RAM(DRAM)、同步DRAM(SDRAM)、双数据率SDRAM(DDRSDRAM)、增强型SDRAM(ESDRAM)、同步链路(Synchlink)DRAM(SLDRAM)、存储器总线(Rambus)直接RAM(RDRAM)、直接存储器总线动态RAM(DRDRAM)、以及存储器总线动态RAM(RDRAM)等。
以上实施例的各技术特征可以进行任意的组合，为使描述简洁，未对上述实施例中的各个技术特征所有可能的组合都进行描述，然而，只要这些技术特征的组合不存在矛盾，都应当认为是本说明书记载的范围。
以上所述实施例仅表达了本申请的几种实施方式，其描述较为具体和详细，但并不能因此而理解为对发明专利范围的限制。应当指出的是，对于本领域的普通技术人员来说，在不脱离本申请构思的前提下，还可以做出若干变形和改进，这些都属于本申请的保护范围。因此，本申请专利的保护范围应以所附权利要求为准。

Claims (20)

  1. 一种端口监控的方法，包括：
    接收终端发送的请求数据并提取所述请求数据上携带的网络地址；
    当在网络信息存储库中未查询到所述网络地址时，则对所述网络地址进行标记；
    获取接收所述请求数据的端口；
    根据所述端口的类型以及所述请求数据获取标记的网络地址的风险等级；
    当所述网络地址的风险等级大于预设等级时，则将所述风险等级大于预设等级的网络地址进行存储；及
    当接收到所述风险等级大于预设等级的网络地址发送的所述请求数据时，则不对所述请求数据进行响应。
  2. 根据权利要求1所述方法，其特征在于，所述根据所述端口的类型以及所述请求数据获取标记的网络地址的风险等级，包括：
    当所述端口为第一类型端口时，则获取接收到的所述请求数据的端口数量；
    获取当前有效端口的数量；及
    当接收到所述请求数据的端口数量与所述当前有效端口的数量的比值小于预设值时，则所述网络地址的风险等级大于预设等级，否则，所述网络地址的风险等级小于等于预设等级。
  3. 根据权利要求1所述方法，其特征在于，所述根据所述端口的类型以及所述请求数据获取标记的网络地址的风险等级，还包括：
    当所述端口为第二类型端口时，则获取所述请求数据中的标志位；
    获取存在预设标志信息的标志位的数量；
    统计所述请求数据的接收数量；及
    当存在预设标志信息的标志位的数量与所述请求数据的接收数量的比值超过阈值时，则所述网络地址的风险等级大于预设等级，否则，所述网络地址的风险等级小于等于预设等级。
  4. 根据权利要求1至3任一项所述的方法，其特征在于，所述网络信息存储库包括黑名单存储库与白名单存储库；所述方法还包括：
    将提取到的所述网络地址与所述黑名单存储库中的网络地址进行匹配；
    当提取到的所述网络地址与所述黑名单存储库中的网络地址匹配成功时，则提取到的所述网络地址为禁止通信网络地址；
    当提取到的所述网络地址未与所述黑名单存储库中的网络地址匹配成功时，则将提取到的所述网络地址与白名单存储库中存储的网络地址进行匹配；及
    当提取到的所述网络地址未与所述白名单存储库中存储的网络地址匹配成功时，则在网络信息存储库中未查询到所述网络地址。
  5. 根据权利要求4所述的方法，其特征在于，所述当接收到所述风险等级大于预设等级的网络地址发送的所述请求数据时，则不对所述请求数据进行响应，还包括：
    查询所述风险等级大于预设等级的网络地址对应的终端向所述端口发送所述请求数 据的频率；及
    当所述频率大于预设频率时，则将所述风险等级大于预设等级的网络地址添加到所述黑名单存储库中，则不对添加到所述黑名单存储库中的所述风险等级大于预设等级的网络地址发送请求数据进行响应。
  6. 根据权利要求4所述的方法，其特征在于，所述当接收到所述风险等级大于预设等级的网络地址发送的所述请求数据时，则不对所述请求数据进行响应的步骤，还包括：
    提取已存储的所述风险等级大于预设等级的网络地址对应的终端向端口发送所述请求数据的时间；及
    当发送请求数据的所述时间在预设的时间段内时，则对所述风险等级大于预设等级的网络地址添加可疑标签。
  7. 根据权利要求6所述的方法，其特征在于，所述当发送请求数据的所述时间为预设的时间时，则对所述风险等级大于预设等级的网络地址添加可疑标签步骤之后，还包括：
    查询所述添加可疑标签的风险等级大于预设等级的网络地址对应的终端在所述预设时间段内发送请求数据的次数；及
    当所述次数大于等于预设值时，则将添加了所述可疑标签的网络地址添加到所述黑名单存储库中，则不对添加到所述黑名单存储库中的所述风险等级大于预设等级的网络地址发送请求数据进行响应。
  8. 一种端口监控装置，包括：
    提取模块，用于接收终端发送的请求数据并提取所述请求数据上携带的网络地址；
    标记模块，用于当在网络信息存储库中未查询到所述网络地址时，则对所述网络地址进行标记；
    第一获取模块，用于获取接收所述请求数据的端口；
    第二获取模块，用于根据所述端口的类型以及所述请求数据获取标记的网络地址的风险等级；
    存储模块，用于当所述网络地址的风险等级大于预设等级时，则将所述风险等级大于预设等级的网络地址进行存储；及
    禁止响应模块，用于当接收到所述风险等级大于预设等级的网络地址发送的所述请求数据时，则不对所述请求数据进行响应。
  9. 根据权利要求8所述的装置，其特征在于，所述第二获取模块包括：
    第一数量获取单元，用于当所述端口为第一类型端口时，则获取接收到的所述请求数据的端口数量；
    第二数量获取单元，用于获取当前有效端口的数量；及
    第一判断单元，用于当接收到所述请求数据的端口数量与所述当前有效端口的数量的比值小于预设值时，则所述网络地址的风险等级大于预设等级，否则，所述网络地址的风险等级小于等于预设等级。
  10. 一种计算机设备，包括存储器及一个或多个处理器，所述存储器中储存有计算机可读指令，所述计算机可读指令被所述一个或多个处理器执行时，使得所述一个或多个处 理器执行以下步骤：
    接收终端发送的请求数据并提取所述请求数据上携带的网络地址；
    当在网络信息存储库中未查询到所述网络地址时，则对所述网络地址进行标记；
    获取接收所述请求数据的端口；
    根据所述端口的类型以及所述请求数据获取标记的网络地址的风险等级；
    当所述网络地址的风险等级大于预设等级时，则将所述风险等级大于预设等级的网络地址进行存储；及
    当接收到所述风险等级大于预设等级的网络地址发送的所述请求数据时，则不对所述请求数据进行响应。
  11. 根据权利要求10所述的计算机设备，其特征在于，所述处理器执行所述计算机可读指令时实现所述根据所述端口的类型以及所述请求数据获取标记的网络地址的风险等级，包括：
    当所述端口为第一类型端口时，则获取接收到的所述请求数据的端口数量；
    获取当前有效端口的数量；及
    当接收到所述请求数据的端口数量与所述当前有效端口的数量的比值小于预设值时，则所述网络地址的风险等级大于预设等级，否则，所述网络地址的风险等级小于等于预设等级。
  12. 根据权利要求10所述方法，其特征在于，所述处理器执行所述计算机可读指令时实现所述根据所述端口的类型以及所述请求数据获取标记的网络地址的风险等级，还包括：
    当所述端口为第二类型端口时，则获取所述请求数据中的标志位；
    获取存在预设标志信息的标志位的数量；
    统计所述请求数据的接收数量；及
    当存在预设标志信息的标志位的数量与所述请求数据的接收数量的比值超过阈值时，则所述网络地址的风险等级大于预设等级，否则，所述网络地址的风险等级小于等于预设等级。
  13. 根据权利要求10至12任一项所述的计算机设备，其特征在于，所述处理器执行所述计算机可读指令时实现所述网络信息存储库包括黑名单存储库与白名单存储库，还包括：
    将提取到的所述网络地址与所述黑名单存储库中的网络地址进行匹配；
    当提取到的所述网络地址与所述黑名单存储库中的网络地址匹配成功时，则提取到的所述网络地址为禁止通信网络地址；
    当提取到的所述网络地址未与所述黑名单存储库中的网络地址匹配成功时，则将提取到的所述网络地址与白名单存储库中存储的网络地址进行匹配；及
    当提取到的所述网络地址未与所述白名单存储库中存储的网络地址匹配成功时，则在网络信息存储库中未查询到所述网络地址。
  14. 根据权利要求13所述的计算机设备，其特征在于，所述处理器执行所述计算机 可读指令时实现所述当接收到所述风险等级大于预设等级的网络地址发送的所述请求数据时，则不对所述请求数据进行响应，还包括：
    查询所述风险等级大于预设等级的网络地址对应的终端向所述端口发送所述请求数据的频率；及
    当所述频率大于预设频率时，则将所述风险等级大于预设等级的网络地址添加到所述黑名单存储库中，则不对添加到所述黑名单存储库中的所述风险等级大于预设等级的网络地址发送请求数据进行响应。
  15. 根据权利要求13所述的计算机设备，其特征在于，所述处理器执行所述计算机可读指令时实现所述当接收到所述风险等级大于预设等级的网络地址发送的所述请求数据时，则不对所述请求数据进行响应，还包括：
    提取已存储的所述风险等级大于预设等级的网络地址对应的终端向端口发送所述请求数据的时间；及
    当发送请求数据的所述时间在预设的时间段内时，则对所述风险等级大于预设等级的网络地址添加可疑标签。
  16. 根据权利要求15所述的计算机设备，其特征在于，所述处理器执行所述计算机可读指令时实现所述当发送请求数据的所述时间为预设的时间时，则对所述风险等级大于预设等级的网络地址添加可疑标签步骤之后，还包括：
    查询所述添加可疑标签的风险等级大于预设等级的网络地址对应的终端在所述预设时间段内发送请求数据的次数；及
    将添加了所述可疑标签的网络地址添加到所述黑名单存储库中，则不对添加到所述黑名单存储库中的所述风险等级大于预设等级的网络地址发送请求数据进行响应。
  17. 一个或多个存储有计算机可读指令的非易失性计算机可读存储介质，所述计算机可读指令被一个或多个处理器执行时，使得所述一个或多个处理器执行以下步骤：
    接收终端发送的请求数据并提取所述请求数据上携带的网络地址；
    当在网络信息存储库中未查询到所述网络地址时，则对所述网络地址进行标记；
    获取接收所述请求数据的端口；
    根据所述端口的类型以及所述请求数据获取标记的网络地址的风险等级；
    当所述网络地址的风险等级大于预设等级时，则将所述风险等级大于预设等级的网络地址进行存储；及
    当接收到所述风险等级大于预设等级的网络地址发送的所述请求数据时，则不对所述请求数据进行响应。
  18. 根据权利要求17所述的存储介质，其特征在于，所述计算机可读指令被所述处理器执行时实现所述根据所述端口的类型以及所述请求数据获取标记的网络地址的风险等级，包括：
    当所述端口为第一类型端口时，则获取接收到的所述请求数据的端口数量；
    获取当前有效端口的数量；及
    当接收到所述请求数据的端口数量与所述当前有效端口的数量的比值小于预设值时， 则所述网络地址的风险等级大于预设等级，否则，所述网络地址的风险等级小于等于预设等级。
  19. 根据权利要求17所述的存储介质，其特征在于，所述计算机可读指令被所述处理器执行时实现所述根据所述端口的类型以及所述请求数据获取标记的网络地址的风险等级，还包括：
    当所述端口为第二类型端口时，则获取所述请求数据中的标志位；
    获取存在预设标志信息的标志位的数量；
    统计所述请求数据的接收数量；及
    当存在预设标志信息的标志位的数量与所述请求数据的接收数量的比值超过阈值时，则所述网络地址的风险等级大于预设等级，否则，所述网络地址的风险等级小于等于预设等级。
  20. 根据权利要求17至19任一项所述的存储介质，其特征在于，所述计算机可读指令被所述处理器执行时实现所述网络信息存储库包括黑名单存储库与白名单存储库；还包括：
    将提取到的所述网络地址与所述黑名单存储库中的网络地址进行匹配；
    当提取到的所述网络地址与所述黑名单存储库中的网络地址匹配成功时，则提取到的所述网络地址为禁止通信网络地址；
    当提取到的所述网络地址未与所述黑名单存储库中的网络地址匹配成功时，则将提取到的所述网络地址与白名单存储库中存储的网络地址进行匹配；及
    当提取到的所述网络地址未与所述白名单存储库中存储的网络地址匹配成功时，则在网络信息存储库中未查询到所述网络地址。
PCT/CN2018/088707 2018-01-08 2018-05-28 端口监控方法、装置、计算机设备及存储介质 WO2019134333A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810016281.8 2018-01-08
CN201810016281.8A CN108200068B (zh) 2018-01-08 2018-01-08 端口监控方法、装置、计算机设备及存储介质

Publications (1)

Publication Number Publication Date
WO2019134333A1 true WO2019134333A1 (zh) 2019-07-11

Family

ID=62588581

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/088707 WO2019134333A1 (zh) 2018-01-08 2018-05-28 端口监控方法、装置、计算机设备及存储介质

Country Status (2)

Country Link
CN (1) CN108200068B (zh)
WO (1) WO2019134333A1 (zh)

Families Citing this family (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110061998B (zh) * 2019-04-25 2022-03-22 新华三信息安全技术有限公司 一种攻击防御方法及装置
CN110266668B (zh) * 2019-06-06 2021-09-17 新华三信息安全技术有限公司 一种端口扫描行为的检测方法及装置
CN112217777A (zh) * 2019-07-12 2021-01-12 上海云盾信息技术有限公司 攻击回溯方法及设备
CN111131221B (zh) * 2019-12-19 2022-04-12 中国平安财产保险股份有限公司 接口校验的装置、方法及存储介质
CN111314308A (zh) * 2020-01-16 2020-06-19 国网浙江省电力有限公司温州供电公司 基于端口分析的***安全检查方法及装置
CN111385293B (zh) * 2020-03-04 2021-06-22 腾讯科技（深圳）有限公司 一种网络风险检测方法和装置
CN111447199A (zh) * 2020-03-23 2020-07-24 深信服科技股份有限公司 服务器的风险分析方法、服务器的风险分析装置及介质
CN111614675B (zh) * 2020-05-21 2022-08-12 深圳市网心科技有限公司 请求执行方法、设备、***及介质
CN111597556B (zh) * 2020-05-21 2023-05-02 四川英得赛克科技有限公司 应用于工业控制环境的arp扫描检测方法、***
CN111818107B (zh) * 2020-09-14 2021-04-27 深圳赛安特技术服务有限公司 网络请求的响应方法、装置、设备及可读存储介质
CN112995430A (zh) * 2021-02-26 2021-06-18 珠海奔图电子有限公司 数据通信控制方法、装置及图像形成装置
CN114285654A (zh) * 2021-12-27 2022-04-05 北京天融信网络安全技术有限公司 一种检测攻击的方法和装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7797738B1 (en) * 2005-12-14 2010-09-14 At&T Corp. System and method for avoiding and mitigating a DDoS attack
CN105580333A (zh) * 2013-08-14 2016-05-11 丹尼尔·钱 评估可疑网络通信
CN105681353A (zh) * 2016-03-22 2016-06-15 浙江宇视科技有限公司 防御端口扫描入侵的方法及装置
CN106549959A (zh) * 2016-10-26 2017-03-29 ***股份有限公司 一种代理网际协议ip地址的识别方法及装置

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102932348A (zh) * 2012-10-30 2013-02-13 常州大学 一种钓鱼网站的实时检测方法及***
CN105323210A (zh) * 2014-06-10 2016-02-10 腾讯科技（深圳）有限公司 一种检测网站安全的方法、装置及云服务器
CN104320412B (zh) * 2014-11-11 2018-04-17 福建联迪商用设备有限公司 一种蓝牙pos、蓝牙pos安全连接的方法及装置
CN105868878B (zh) * 2015-01-21 2019-11-15 阿里巴巴集团控股有限公司 Mac地址的风险识别方法及装置
CN105472610A (zh) * 2015-11-20 2016-04-06 上海斐讯数据通信技术有限公司 无线路由器登录管理方法及装置
CN106790105B (zh) * 2016-12-26 2020-08-21 携程旅游网络技术（上海）有限公司 基于业务数据的爬虫识别拦截方法及***
CN106850637B (zh) * 2017-02-13 2020-02-04 韩伟杰 一种基于流量白名单的异常流量检测方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7797738B1 (en) * 2005-12-14 2010-09-14 At&T Corp. System and method for avoiding and mitigating a DDoS attack
CN105580333A (zh) * 2013-08-14 2016-05-11 丹尼尔·钱 评估可疑网络通信
CN105681353A (zh) * 2016-03-22 2016-06-15 浙江宇视科技有限公司 防御端口扫描入侵的方法及装置
CN106549959A (zh) * 2016-10-26 2017-03-29 ***股份有限公司 一种代理网际协议ip地址的识别方法及装置

Also Published As

Publication number Publication date
CN108200068A (zh) 2018-06-22
CN108200068B (zh) 2020-07-14

Similar Documents

Publication Publication Date Title
WO2019134333A1 (zh) 端口监控方法、装置、计算机设备及存储介质
CN113574838B (zh) 通过客户端指纹过滤互联网流量的***和方法
WO2018113594A1 (zh) 防御dns攻击的方法、装置及存储介质
US20210144455A1 (en) Network Telemetry with Byte Distribution and Cryptographic Protocol Data Elements
WO2019144549A1 (zh) 漏洞测试方法、装置、计算机设备和存储介质
CN111709009A (zh) 联网工业控制***的探测方法、装置、计算机设备和介质
WO2019148714A1 (zh) DDoS攻击检测方法、装置、计算机设备和存储介质
CN111131126B (zh) 攻击检测方法和装置
US20160285909A1 (en) Cloud checking and killing method, device and system for combating anti-antivirus test
CN114398449B (zh) 数据处理方法、装置、视频监控***、存储介质
CN105959294B (zh) 一种恶意域名鉴别方法及装置
CN115002025B (zh) 一种数据安全传输方法、***及云平台
US10764307B2 (en) Extracted data classification to determine if a DNS packet is malicious
CN112738018A (zh) Arp欺骗攻击检测方法、装置、计算机设备和存储介质
CN110619022B (zh) 基于区块链网络的节点检测方法、装置、设备及存储介质
CN114826946A (zh) 未授权访问接口的检测方法、装置、设备及存储介质
US11050771B2 (en) Information processing apparatus, communication inspecting method and medium
WO2019200754A1 (zh) 数据传输风险评估方法、装置、计算机设备和存储介质
CN110912904B (zh) 恶意设备识别方法、装置、存储介质和计算机设备
CN110430199B (zh) 识别物联网僵尸网络攻击源的方法与***
CN112583774A (zh) 一种攻击流量检测的方法、装置、存储介质及电子设备
CN109818912B (zh) 防范泛洪攻击的方法、装置、负载均衡设备和存储介质
US20200067973A1 (en) Safer Password Manager, Trusted Services, and Anti-Phishing Process
CN107948331B (zh) 大数据信息的处理方法、处理***以及信息收集设备
CN112153011A (zh) 一种机器扫描的检测方法、装置、电子设备和存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18897957

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205 DATED 20/10/2020)

122 Ep: pct application non-entry in european phase

Ref document number: 18897957

Country of ref document: EP

Kind code of ref document: A1