HTTPS protocol analysis method, and system implementing method

Abstract

The invention provides an HTTPS protocol analysis method, and a system implementing the method. The method comprises the following steps: separating HTTPS encrypted traffic from an encrypted HTTPS protocol data packet, and extracting an unknown server IP address and a corresponding port number from the HTTPS encrypted traffic; carrying out crawling on the IP address and the corresponding port number through a crawler; decrypting an HTTPS page obtained through the crawling according to a crawler certificate, so that corresponding http page contents are obtained; identifying an http page; determining an application to which the http page belongs; and updating the IP address and the corresponding port number to a rule base as application features.

Description

technical field [0001] The invention relates to the field of computer or Internet technology, in particular to a method and system for analyzing HTTPS encrypted traffic. Background technique [0002] The data transmitted by the HTTP protocol is unencrypted, which makes the transmission of private information by the HTTP protocol very insecure. In order to ensure the safe transmission of these private data, many high-security services such as banking websites or e-mails will use the HTTPS protocol, and ordinary websites will also use the HTTPS protocol to encrypt and transmit private information such as user account passwords. [0003] HTTPS (full name: Hyper Text Transfer Protocol over Secure Socket Layer) is an HTTP channel aimed at security, that is, the secure version of HTTP, which adds an SSL layer under HTTP. The security basis of HTTPS is SSL, so the details of encryption require SSL. HTTPS is a URI scheme (abstract identifier system), the syntax is similar to the h...

AI Technical Summary

Problems solved by technology

However, due to the encrypted nature of HTTPS, the identification of traffic encrypted with HTTPS is not ideal

Images