HTTPS streaming service online identification method suitable for large-scale network environment

Abstract

The invention discloses an HTTPS streaming service online identification method suitable for a large-scale network environment. The method comprises the following steps: 1) calculating sliding time window parameters for reading HTTPS flow and DNS flow according to attributes of HTTPS and DNS flows in an actual network, and then reading HTTPS flow data and DNS flow data from the network flow in real time by adopting a sliding window mechanism; under each sliding time window, 2) respectively processing the DNS data and the HTTPS data into a data set in a key value pair format; 3) establishing association between the HTTPS and the DNS through a two-stage association method; and 4) selecting one or more of the associated domain names as the service identifier of the HTTPS stream by adopting a candidate service identifier determination method based on the DNS request behavior of the client. The method is applied to real-time automatic HTTPS flow service refinement identification in a large-scale network environment, a classification identifier used for identifying the HTTPS flow does not need to be determined in advance, a webpage fingerprint library does not need to be established in advance, cheating by an attacker is not likely to happen, and resource consumption is low.

Description

technical field [0001] The invention belongs to the field of network security and information technology, and in particular relates to an HTTPS streaming service online identification method suitable for a large-scale network environment. Background technique [0002] In recent years, encrypted traffic represented by HTTPS has continued to grow significantly. At present, more than half of the world's web traffic is transmitted using HTTPS. Online identification of services carried over HTTPS streams has important implications for network security management. At present, the identification methods for HTTPS flow services mainly include service identification based on fingerprint attack, methods based on Server Name Indication (SNI) and methods based on DNS and flow association. [0003] The service identification method based on fingerprint attack constructs webpage fingerprints by observing the patterns of data flow to infer encrypted or anonymously connected encrypted webp...

AI Technical Summary

Problems solved by technology

Although some methods have designed data expiration removal and data structure maximum capacity limitation mechanisms, the method of using the client IP address and server IP address as the retrieval key is always faced with the lack of DNS requests caused by the DNS cache mechanism. The problem of being unable to effectively identify HTTPS streams eventually leads to a low stream identification rate

Images