A proxy traffic detection method, apparatus, electronic device and readable storage medium

Abstract

The present application discloses a proxy traffic detection method, device, electronic device, and computer-readable storage medium. The method includes: acquiring traffic to be detected, and determining data stream behavior characteristics corresponding to the traffic to be detected; The characteristics obtained by detecting the network communication of the traffic; using the identification and classification model to classify the behavior characteristics of the data stream, and obtain the classification result; if the classification result is abnormal, the traffic to be detected is determined to be the proxy traffic; this method does not pay attention to the individual traffic in the traffic. The specific content of the data packet, but the corresponding data stream behavior characteristics are extracted. The data stream behavior characteristics can reflect the characteristics of the session connection or the network communication situation of the data flow, and detect the traffic to be detected from the characteristics of the network communication situation of the traffic, so it can detect the proxy traffic transmitted through port masquerading or encryption. Has strong detection ability.

Description

technical field [0001] The present application relates to the technical field of network security, and in particular, to a proxy traffic detection method, a proxy traffic detection device, an electronic device, and a computer-readable storage medium. Background technique [0002] The socks protocol (Protocol for sessions traversal across firewall securely) provides a framework that enables clients in the TCP (Transmission Control Protocol, Transmission Control Protocol) and UDP (User Datagram Protocol, User Datagram Protocol) domains Or the server application can use the services provided by the network firewall more conveniently and safely, such as accessing overseas websites and hiding its real IP. In order to detect the proxy traffic, the related art usually reads the content of the network data packet, that is, the payload and the port number, and determines whether the network data packet is a data packet in the proxy traffic based on the content. However, if the traff...

AI Technical Summary

Problems solved by technology

However, if the traffic passes port masquerade or transmission encryption, such as generated by using Shadowsocks tool (Shadowsocks is a widely used proxy tool based on socks protocol, which uses symmetric encryption algorithm to encrypt communication traffic), it will make it impossible to obtain network data The content of the packet, and thus cannot detect the proxy traffic, so the detection ability of related technologies is weak

Images