Method, device and storage device for accurately detecting network traffic
A technology of network traffic and detection methods, applied in the field of network security, can solve problems such as poor performance estimation accuracy and controllability, significant impact on detection efficiency, irregular changes in detection performance, etc., and achieve the effect of solving uncontrollable feature matching performance.
- Summary
- Abstract
- Description
- Claims
- Application Information
AI Technical Summary
Problems solved by technology
Method used
Image
Examples
example 1
[0053] In order to solve the problems caused by the definition and matching of regular expressions, the present invention proposes a method for accurate detection of network traffic, including:
[0054] Define a single feature with keywords or starting position, offset, length, and feature string as conditions, where the feature string can be a string or a binary string;
[0055] Define a rule with a logical relationship between multiple features, such as an AND or relationship;
[0056] All feature strings are stored in a set in memory or database, preferably, using an in-memory database (such as REDIS) to store a hash value set of feature strings;
[0057] Obtain the data packets to be detected in the network;
[0058] Extract the content in the data packet to be detected according to the position and the length, preferably, when multiple features are marked with keywords as the starting position, use a multi-pattern matching algorithm, such as AC (Aho-Corasiek) or WM (Wu-M...
example 2
[0062] figure 2 It is a schematic flow diagram of the method for accurately detecting network traffic in Example 2, and the specific description is as follows:
[0063] Step 201, rule customization;
[0064] First, pre-install and run the application software or executable program that generates network traffic to be analyzed to collect network traffic samples; then, manually analyze the load content of the network traffic samples, the plaintext load features are represented by strings, and the ciphertext loads can be used Binary string representation, record feature string and position (the unit can be byte or bit according to needs); when there are multiple features, specify the AND or relationship between features; finally, extract the features and feature relationships in the form of database fields or files Describe and store.
[0065] This embodiment takes a text format file as an example, the feature definition format example is: {fid, keyword or location identifier,...
example 3
[0085] This example describes a device for accurately detecting network traffic, which mainly includes:
[0086] Rule definition module: realize the feature definition in the format of {keyword or position, offset, length, string value} and the rule definition of multiple features and / or relationships through the Web or files;
[0087] Rule parsing module: parse the rule definition into three data sets such as extraction position set, feature string set, and feature relationship set for use in the detection process;
[0088] Content extraction module: perform content extraction in the data packet to be detected according to the extraction position set;
[0089] Feature matching module: query whether the extracted content exists in the feature string set, if it exists, the matching is successful;
[0090] Relationship calculation module: According to the matching result record, judge whether the matching result satisfies the relationship definition in the feature relationship ...
PUM
Login to View More Abstract
Description
Claims
Application Information
Login to View More