Method for extracting TLS data block in encrypted network traffic

Abstract

The invention discloses a method for extracting a TLS data block in encrypted network flow. In the prior art, network transmission data needs to be added with information of a network transmission protocol, when the data is encrypted and transmitted by using a TLS protocol, the encrypted network message load is mixed with the information of the transmission protocol, the encryption protocol and the data, the added transmission protocol information is related to various factors, and great interference is brought to the analysis of the encrypted data. The method comprises the following steps: firstly, acquiring encrypted data on a target application; filtering TCP (Transmission Control Protocol) streams accommodating the target TLS data blocks from the encrypted data; and then establishing astream record file for each filtered TCP stream, recording the load of the TLS message belonging to each TCP stream, and finally extracting a TLS data block according to the load of the TLS message stored in the stream record file. The method has universality, and the TLS encrypted data block generated by the terminal can be extracted from the traffic encrypted and transmitted by the network application.

Description

technical field [0001] The invention belongs to the technical field of network security, in particular to a method for extracting TLS data blocks in encrypted network traffic. Background technique [0002] In order to protect user data privacy and data transmission security, data encryption before transmission has been widely adopted. According to a Cisco survey, the proportion of encrypted traffic in Internet traffic increased from 38% to 50% from 2016 to 2017, and the proportion of encrypted Internet traffic will exceed 80% in 2019. However, while data encryption technology brings security to data, it is also easy to be used maliciously. A large number of malicious attacks also use encryption technology to disguise the attack traffic in order to increase the probability of success, so data encryption also brings great challenges to identifying malicious attacks. [0003] At present, Transport Layer Security (TLS) is the most important protocol for providing encryption fo...

Images