A kind of private encrypted data identification method and system

Abstract

A private encrypted data identification method and system, by acquiring the parsed data to be identified, to determine whether a destination IP in the to-be-identified data exists in a blacklist IP list: if the destination IP exists in the blacklist IP list, the to-be-identified IP list is determined. The data is regarded as non-classified private encrypted data; if the destination IP does not exist in the blacklist IP list, judge whether the destination IP exists in the whitelist IP list; judge whether the destination IP in the data to be identified exists in the whitelist IP list : If the destination IP exists in the whitelist IP list, the data to be identified is treated as a type of private encrypted data and reported to the engine; if the destination IP does not exist in the whitelist IP list, the TCP load of the data to be identified is calculated by binary discrete method , to judge the discrete degree of TCP load. The invention can identify private encrypted data efficiently and quickly, and realize dynamic analysis of specific private encrypted data.

Description

technical field [0001] The invention relates to a private encrypted data identification method and system, belonging to the technical field of encrypted data processing. Background technique [0002] At present, the identification of private encrypted data mainly includes the following schemes: [0003] First, use the signature to identify encrypted data. Mainly by judging whether the byte offset of the TCP payload is a specific value, if it is equal to a certain value, the data is considered encrypted data, if not, the data is considered not encrypted data. [0004] Second, use the port to identify encrypted data. The client communicates with the server, passing encrypted information. Before establishing a communication connection, the server needs to listen on a certain port and wait for the connection from the client. In this way, encrypted data can be identified using the port signature. Typically, these ports are not the usual service ports (0-1024). [0005] Thir...

AI Technical Summary

Problems solved by technology

[0010] To this end, the present invention provides a private encrypted data identification method and system, which is suitable for the capture, filtering, and identification of network encrypted data. On the basis of the original information entropy idea, a binary discrete method is proposed to solve the problem of traditional port-based identification and feature code identification. The problem of low accuracy and efficiency of encrypted data

Images