Encrypted traffic analysis method, device, electronic device, medium and program

Abstract

The present invention relates to an encrypted traffic analysis method, device, electronic device, medium and program. The method includes: triggering a memory acquisition function preset in the target process when the target process calls the main read function or the main write function of the secure transmission basic library; wherein the target process is used for running encrypted communication A process that is connected and pre-set with the memory acquisition function; through the memory acquisition function, the master session key is acquired from the target encrypted communication connection; wherein, the target encrypted communication connection is the encrypted communication run by the target process connect. The invention conveniently obtains the master session key corresponding to the encrypted communication connection of the target process through the memory acquisition function set in the target process running at the endpoint, which is used for encrypted data (traffic) analysis, and greatly saves the calculation of the gateway device. Resources, since there is no certificate replacement process, certificate warnings are accordingly avoided.

Description

technical field [0001] The present invention relates to the technical field of information security, and in particular, to a method, device, electronic device, medium and program for analyzing encrypted traffic. Background technique [0002] With the popularity of HTTPS, a large amount of attack traffic is also sent and received using encrypted traffic, which brings difficulties to the traffic analysis of terminals and gateway devices. [0003] Most of the existing encrypted traffic analysis solutions create a middleman in the gateway device of the enterprise network, and use the middleman to forward encrypted traffic for traffic analysis and monitoring. In this way, the encrypted traffic of each encrypted communication connection is decrypted and re-encrypted on the gateway device, which consumes a lot of computing resources, and because the certificate replacement exists for the middleman, the terminal can easily perceive the existence of the middleman process due to the c...

AI Technical Summary

Problems solved by technology

[0005] The present invention provides an encrypted traffic analysis method, device, electronic equipment, medium and program, which are used to solve the technical defects in the prior art that the gateway equipment consumes large computing resources and the terminal is prone to generate certificate alarms

Images