Encrypted traffic auditing method and system

Abstract

This invention discloses a method and system for auditing encrypted traffic, relating to the field of network security technology. The method includes S1 acquiring encrypted communication traffic; S2 extracting connection-level features and time window Δ of the encrypted communication traffic. t The process involves: S3 extracting core features; S4 analyzing service types to obtain type results; S5 analyzing the expected results of the server role of the destination IP; S6 analyzing the actual results of the server role of the destination IP; S7 analyzing the audit results; and S8 outputting an audit report. This method achieves effective auditing of disguised encrypted communication without decrypting the communication content, avoiding privacy and compliance risks. By determining the consistency of server roles, it identifies disguised communication at the behavioral level, overcoming the technical limitations of relying solely on protocols or fingerprints. It does not rely on specific application, domain name, or tool characteristics and has good adaptability to unknown or continuously evolving disguised communication. It adopts a quantifiable scoring model and configurable thresholds, possessing engineering feasibility and optimization capabilities.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to an encrypted traffic auditing method and system. Background Technology

[0002] With the widespread deployment of encrypted communication protocols such as TLS and HTTPS, network communication content is gradually shifting from plaintext to encryption. Traditional traffic auditing techniques based on content parsing or deep protocol parsing are no longer effective. Existing encrypted traffic auditing solutions typically rely on explicit characteristics such as domain names or SNI information, server certificates and their issuing authorities, port numbers or protocol versions, and specific client or protocol fingerprints for classification and management.

[0003] However, in real-world network environments, some communication behaviors are deliberately disguised to closely resemble access to mainstream internet services at the aforementioned external characteristics level. For example, they may simulate access to video platforms, cloud services, or API interfaces, thereby bypassing auditing mechanisms based on static or single-connection characteristics. This type of disguised communication typically features superficial protocol characteristics similar to real services, actual communication targets concentrated on a small number of servers, and the communication purpose being relay / aggregation / proxy / control rather than access to real internet services.

[0004] Existing technologies are mostly focused on identifying specific protocols, tools, or traffic fingerprints, which have limited applicability and make it difficult to conduct general audits of unknown or continuously evolving disguised encrypted communications. Furthermore, they lack an effective overall judgment mechanism without decrypting the communication content. Summary of the Invention

[0005] The purpose of this invention is to design an encrypted traffic auditing method and system to solve the above problems.

[0006] The present invention achieves the above objectives through the following technical solutions:

[0007] Encrypted traffic auditing methods include:

[0008] S1. Obtain encrypted communication traffic;

[0009] S2. Extract connection-level features and time window Δ of encrypted communication traffic. t Within the context, statistical-level characteristics; connection-level characteristics include source IP, destination IP, connection start time, connection end time, connection duration T, and number of packets per session. And the total number of bytes within the session (B); statistical features include the number of unique source IPs accessing the destination IP. Total number of connections to destination IP Peak concurrent connections to the destination IP The proportion of overlapping connections to the total number of connections ;

[0010] S3. Extract five core features from the source IP and destination IP during the TLS handshake phase and in the plaintext visible field. The five core features are the SNI domain name string d, the TLS protocol version, the list of Ciphers supported by the client, the ALPN negotiation result, and the plaintext attribute information of the server certificate.

[0011] S4. Analyze the service types based on the five core characteristics to obtain the type results;

[0012] S5. Analyze the expected results of the server role of the destination IP based on the type results;

[0013] S6. Analyze the actual results of the server role of the destination IP based on statistical-level characteristics;

[0014] S7. Compare and analyze the expected results with the actual results to analyze the audit results;

[0015] S8. Output audit report.

[0016] An encrypted traffic auditing system includes:

[0017] Storage; storage is used to store computer programs;

[0018] An executor; the executor is used to execute a computer program in the storage, which, when executed, implements the encrypted traffic auditing method described above.

[0019] The beneficial effects of this invention are as follows: This method achieves effective auditing of disguised encrypted communication without decrypting the communication content, avoiding privacy and compliance risks; it identifies disguised communication from a behavioral level by determining server role consistency, overcoming the technical limitations of relying solely on protocols or fingerprints; it does not rely on specific application, domain name, or tool characteristics, and has good adaptability to unknown or continuously evolving disguised communication; it adopts a quantifiable scoring model and configurable thresholds, possessing engineering feasibility and optimization capabilities; and it is applicable to various application scenarios such as network boundary auditing, data center egress auditing, and cross-domain traffic compliance auditing. Attached Figure Description

[0020] Figure 1 This describes the roles and data interactions between the source IP and the destination IP.

[0021] Figure 2 This is a schematic diagram of the encrypted traffic auditing method of the present invention;

[0022] Figure 3 This is a flowchart of the service type determination scheme. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0024] Therefore, the following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the invention without inventive effort are within the scope of protection of the invention.

[0025] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0026] In the description of this invention, it should be understood that the terms "upper," "lower," "inner," "outer," "left," "right," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings, or the orientation or positional relationship commonly used when the product of this invention is in use, or the orientation or positional relationship commonly understood by those skilled in the art. They are only used to facilitate the description of this invention and to simplify the description, and are not intended to indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this invention.

[0027] Furthermore, the terms "first," "second," etc., are used only to distinguish descriptions and should not be interpreted as indicating or implying relative importance.

[0028] In the description of this invention, it should also be noted that, unless otherwise explicitly specified and limited, terms such as "set" and "connection" should be interpreted broadly. For example, "connection" can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium; it can be a connection within two components. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0029] The specific embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0030] like Figure 1 , Figure 2 , Figure 3 As shown, encrypted traffic auditing methods include:

[0031] S1. Acquire encrypted communication traffic; Specifically, collect encrypted communication traffic in real time at network boundary devices (such as firewalls and gateways), and extract two basic features, connection level and statistical level, without decrypting the communication content, to provide data support for subsequent role determination.

[0032] S2. Extract connection-level features and time window Δ of encrypted communication traffic. t Within the context, statistical-level characteristics; connection-level characteristics include source IP, destination IP, connection start time, connection end time, connection duration T, and number of packets per session. And the total number of bytes within the session (B); statistical features include the number of unique source IPs accessing the destination IP. Total number of connections to destination IP Peak concurrent connections to the destination IP The proportion of overlapping connections to the total number of connections ;

[0033] Source IP and destination IP identify the network addresses of the communicating parties; connection start time and end time determine the time range of a single session; connection duration T is the difference between the end time and the start time; number of packets in the session. B represents the total number of data packets transmitted in a single session; B represents the total number of bytes within the session; and B represents the total amount of data transmitted in a single session. The number of unique source IPs accessing this destination IP is also mentioned. Reflects the server's service coverage; total number of connections to the destination IP. Reflects the server's load capacity; peak concurrent connections to the destination IP. Reflects the server's maximum capacity; the ratio of overlapping connections to total connections. Reflecting the concurrent service characteristics of a server, overlapping connections refer to connections that exist at the same time.

[0034] S3. Extract five core features from the source IP and destination IP during the TLS handshake phase and in the plaintext visible field. The five core features are the SNI domain name string d, the TLS protocol version, the list of Ciphers supported by the client, the ALPN negotiation result, and the plaintext attribute information of the server certificate.

[0035] The SNI domain name string DomainName is the target server domain name declared by the client, directly reflecting the service provider's ecosystem attributes; the client-supported Cipher list reflects the encryption capability adaptation characteristics between the client and the server; the ALPN negotiation result is the application layer protocol negotiation result, which is related to the transport layer adaptation logic of the service; the plaintext attribute information of the server certificate includes the certificate issuing authority (public CA / private CA / self-signed), validity period, and the number of domain names (SAN number) contained in the certificate.

[0036] S4. Analyze service types based on 5 core characteristics to obtain type results; specifically including:

[0037] S41. Analyze the feature scores of the 5 core features for each service type; there are a total of 5 service types, specifically: video or short video service. Social and content interaction services Email or instant messaging services Cloud computing or API services Content delivery network (CDN) or static resource service ;

[0038] The specific feature score for the SNI domain name string DomainName is as follows:

[0039] (1) The SNI domain name string d is divided into tokens according to "." and "-", and the number of segments after "." is used as the domain name level L;

[0040] (2) Match the token with the keyword set for each service type to obtain the matching results for each service type; specifically:

[0041] Video keyword collection :{video,vod,live,stream,player,media};

[0042] API keyword collection :{api,rpc,grpc,service,open,gateway};

[0043] CDN / Static Keyword Collection :{cdn,static,img,image,assets,cache};

[0044] Social interaction keyword collection :{social,feed,msg,im,chat,comment};

[0045] (3) Calculate keyword scores based on matching results , represented as: ,in, Match the service type in the SNI domain string d Corresponding keyword set The number of tokens; The saturation threshold; This is a limiting function;

[0046] (4) Use triangular membership function analysis to determine the preference score of each service type for the number of domain name levels L. , represented as: ;

[0047] (5) Traverse the SNI domain name string d and the ecosystem set The relationship, and calculate the ecological affiliation score. , represented as: ,in, For indicator functions, An ecosystem-service type mapping table; a pre-defined set of service ecosystems. Includes cloud / CDN ecosystem (e.g., cloudfront.net, amazonaws.com; the content of the collection can be maintained by the user according to the actual scenario), video platform ecosystem collection (e.g., douyinvod.com, tiktokcdn.com; the collection content can be maintained by the user according to the actual scenario), Enterprise Private Domain Collection (Internal domain names of the organization, configured through policies);

[0048] (6) Based on keyword scores relative to each service type Preference score Ecological attribution score Analyze domain name feature scores , represented as: ,in, , and Keyword scores Preference score Ecological attribution score The weight, , , ;

[0049] Feature scores of ALPN negotiation results The calculation is performed using a "discrete mapping + confidence decay" mechanism, and is expressed as follows: ,in, For the ALPN-service type mapping table, Confidence coefficient;

[0050] Feature score of server certificate Represented as: ,in, , and The number of SANs for the plaintext attributes of the server certificate. Score Score for the number of days of validity and Score of issuer_type The weight, , , , , This is the maximum validity period. For the expiration date, if If the time is less than 30 days (too short), the score drops directly to 0.3;

[0051] Feature scores for TLS protocol version and client-supported Cipher list Represented as: ,in, , and TLS versions are the TLS protocol versions and TLS tls. ver Score CipherSuites list ciphers score Score and coverage of mainstream kits The weight, , , where n is the number of Ciphers. Let n be the expected interval. For the threshold, It is a collection of mainstream kits; if ,but ;

[0052] S42. Weight the scores of the five features and calculate and analyze the comprehensive score of the five core features relative to each service type. k=1,2,3,4,5, represented as: ,in, Weights are configurable parameters that can be adjusted effectively based on the characteristics of different service types and network environments. , , , , , ;

[0053] S43. Select the top two service types as candidate service types based on the comprehensive score of each service type.

[0054] S44. Take the two candidate service types and their corresponding comprehensive scores as the type results.

[0055] S5. Analyze the expected results of the server role of the destination IP based on the type results; specifically: take... ;Take the maximum score , Sub-Oita ;

[0056] Judgment rules:

[0057] like and Output service type

[0058] Otherwise, output "Service type uncertain".

[0059] Default threshold , .

[0060] S6. Analyze the actual results of the server role of the destination IP based on statistical-level characteristics;

[0061] The predefined server roles are: Access Server (responsible for client access authentication and session establishment) R1, Content Distribution Server (responsible for high-volume distribution of video, static resources, etc.) R2, Business Processing Server (responsible for core business logic such as API calls and message processing) R3, Relay / Aggregation Server (responsible for traffic relay and data aggregation, not real service functions) R4, and Proxy / Edge Server (responsible for edge node proxy and traffic forwarding) R5;

[0062] The service type-expected server role mapping relationship is shown in Table 1:

[0063]

[0064] Example of role determination rules (key feature thresholds for different roles, configurable):

[0065] Content distribution type (R2): ≤0.3 (downlink traffic is dominant) ∈[10s,300s], downlink burst rate ≥0.6;

[0066] Business Processing (R3): ∈[0.7,1.3] (Uplink and downlink traffic balance) ≥0.5 (large fluctuations in packet transmission);

[0067] Transit / Gathering Type (R4): ≥600s (primarily long connections) ≤0.3 (stable packet transmission) ≤5 (few clients).

[0068] Specifically, this involves analyzing the matching scores between statistical features and each service type. The highest matching score and its corresponding service type are taken as the actual result for the server role, and are expressed as follows: ,in, Let be the weight of the j-th feature in the statistical features. For index matching functions; This is the kth type of service.

[0069] S7. Compare and analyze the expected results with the actual results to analyze the audit results; specifically including:

[0070] S71. Analyze the consistency score between expected and actual results. , represented as: If the communication behavior is consistent with the expected set of roles for the actual result ∈ expected result, then the communication behavior conforms to the service type representation at the role level; if the communication behavior is consistent with the expected set of roles for the actual result ∉ expected result, then the communication behavior is suspected of role spoofing.

[0071] S72, Based on matching score Overall score Consistency score Analysis and comprehensive score , represented as: ;in, , and The total score is as follows Matching score Consistency score The weights;

[0072] S73, Comparison and Comprehensive Score Based on the preset threshold, the audit results are as follows:

[0073] like If the value is less than 0.4, the audit result indicates high-risk spoofed communication (requiring focused auditing).

[0074] If 0.4≤ If the value is less than 0.6, the audit result is medium-risk communication (requires continuous monitoring).

[0075] like If the value is ≥0.6, the audit result is low-risk communication (normal service access).

[0076] S8. Output the audit report, which includes the following core information:

[0077] Basic communication information: source IP, destination IP, communication time range;

[0078] Service type determination result: Determined service type and confidence score (or "Service type uncertain");

[0079] Role determination results: expected set of roles, actual roles, and consistency determination conclusion;

[0080] Comprehensive risk score and level: Score and high / medium / low risk level;

[0081] Audit recommendations: High-risk communications should be blocked or further traced; medium-risk communications should be continuously monitored.

[0082] An encrypted traffic auditing system includes:

[0083] Storage; storage is used to store computer programs;

[0084] An executor; the executor is used to execute a computer program in the storage, which, when executed, implements the encrypted traffic auditing method described above.

[0085] This method is based on a plaintext protocol-based encrypted traffic auditing method. It extracts plaintext protocol features (including SNI domain name string, TLS protocol version, CipherSuites list, ALPN negotiation result, and server certificate plaintext attributes) during the TLS handshake phase to achieve service type inference based on multi-dimensional plaintext feature weighted scoring, without relying on specific applications or tools for identification.

[0086] This method dynamically maps service types to expected server roles, predefines server role sets such as access type, content distribution type, business processing type, relay / aggregation type, and proxy / edge type, and establishes a configurable mapping relationship between different service types and allowed expected server role sets;

[0087] The method for determining the actual role of a server based on long-term traffic statistics uses a preset time window as the statistical dimension to extract core indicators such as the number of independent clients, peak concurrent connections, connection duration distribution, uplink / downlink byte ratio, and packet interval variation coefficient. The actual functional role of the target server is determined by weighted scoring based on these indicators.

[0088] This method constructs a complete closed-loop judgment mechanism: "plaintext protocol feature extraction → multi-dimensional weighted service type probability inference → service type-expected server role mapping → traffic statistics-driven actual role determination → role consistency quantitative assessment." It does not require decryption of encrypted communication content such as TLS / HTTPS, nor does it rely on specific applications or tools for identification. By mining the long-term behavioral stability of server roles in real internet services, and using the audit perspective of "whether the communication behavior and the role representing the service type are reasonably matched," it achieves accurate risk assessment of encrypted communication disguised as normal service access. Compared with existing technologies, this invention has at least the following beneficial effects:

[0089] To achieve effective auditing of disguised encrypted communications without decrypting the communication content, thereby avoiding privacy and compliance risks;

[0090] By determining server role consistency, spoofed communication can be identified at the behavioral level, overcoming the technical limitations of relying solely on protocols or fingerprints.

[0091] It is not dependent on specific applications, domains, or tool characteristics, and has good adaptability to unknown or continuously evolving spoofing communications;

[0092] It employs a quantifiable scoring model and configurable thresholds, possessing both engineering feasibility and tuning capabilities;

[0093] It is suitable for various application scenarios such as network boundary auditing, data center egress auditing, and cross-domain traffic compliance auditing.

[0094] The technical solutions of the present invention are not limited to the specific embodiments described above. Any technical modifications made in accordance with the technical solutions of the present invention fall within the protection scope of the present invention.

Claims

1. An encrypted traffic auditing method, characterized in that, include: S1. Obtain encrypted communication traffic; S2. Extract connection-level features and time window Δ of encrypted communication traffic. t Within the context, statistical-level characteristics; connection-level characteristics include source IP, destination IP, connection start time, connection end time, connection duration T, and number of packets per session. And the total number of bytes within the session (B); statistical features include the number of unique source IPs accessing the destination IP. Total number of connections to destination IP Peak concurrent connections to the destination IP The proportion of overlapping connections to the total number of connections ; S3. Extract five core features from the source IP and destination IP during the TLS handshake phase and in the plaintext visible field. The five core features are the SNI domain name string d, the TLS protocol version, the list of Ciphers supported by the client, the ALPN negotiation result, and the plaintext attribute information of the server certificate. S4. Analyze the service types based on the five core characteristics to obtain the type results; S5. Analyze the expected results of the server role of the destination IP based on the type results; S6. Analyze the actual results of the server role of the destination IP based on statistical-level characteristics; S7. Compare and analyze the expected results with the actual results to analyze the audit results; S8. Output audit report.

2. The encrypted traffic auditing method according to claim 1, characterized in that, S4 includes: S41. Analyze the feature scores of the five core features for each service type; S42. Weight the scores of the five features and calculate and analyze the comprehensive score of the five core features relative to each service type. k=1,2,3,4,5; S43. Select the top two service types as candidate service types based on the comprehensive score of each service type. S44. Take the two candidate service types and their corresponding comprehensive scores as the type results.

3. The encrypted traffic auditing method according to claim 2, characterized in that, The specific feature score for the SNI domain name string DomainName is as follows: (1) The SNI domain name string d is divided into tokens according to "." and "-", and the number of segments after "." is used as the domain name level L; (2) Match the token with the keyword set for each service type to obtain the matching results for each service type; (3) Calculate keyword scores based on matching results , represented as: ,in, Match the service type in the SNI domain string d Corresponding keyword set The number of tokens; The saturation threshold; This is a limiting function; (4) Use triangular membership function analysis to determine the preference score of each service type for the number of domain name levels L. , represented as: ; (5) Traverse the SNI domain name string d and the ecosystem set The relationship, and calculate the ecological affiliation score. , represented as: ,in, For indicator functions, An ecosystem-service type mapping table; (6) Based on keyword scores relative to each service type Preference score Ecological attribution score Analyze domain name feature scores , represented as: ,in, , and Keyword scores Preference score Ecological attribution score The weight.

4. The encrypted traffic auditing method according to claim 2, characterized in that, The feature score of the ALPN negotiation result is calculated using a "discrete mapping + confidence decay" mechanism. , represented as: ,in, For the ALPN-service type mapping table, This is the confidence coefficient.

5. The encrypted traffic auditing method according to claim 2, characterized in that, Feature score of server certificate Represented as: ,in, , and The number of SANs for the plaintext attributes of the server certificate. Score Score for the number of days of validity and Score of issuer_type weights, , , , , This is the maximum validity period. This is the expiration date.

6. The encrypted traffic auditing method according to claim 2, characterized in that, Feature scores for TLS protocol version and client-supported Cipher list Represented as: ,in, , and TLS versions are the TLS protocol versions and TLS tls. ver Score Cipher Suites list ciphers score Score and coverage of mainstream kits The weight, , , where n is the number of Ciphers. Let n be the expected interval. For the threshold, It is a collection of mainstream kits.

7. The encrypted traffic auditing method according to claim 2, characterized in that, In S6, the matching scores between statistical features and each service type are analyzed. The highest matching score and its corresponding service type are taken as the actual result for the server role, and are expressed as follows: ,in, Let be the weight of the j-th feature in the statistical features. For index matching functions; This is the kth type of service.

8. The encrypted traffic auditing method according to claim 7, characterized in that, S7 includes: S71. Analyze the consistency score between expected and actual results. , represented as: ; S72, Based on matching score Overall score Consistency score Analysis and comprehensive score , represented as: ;in, , and The total score is as follows Matching score Consistency score The weights; Represented as: ;in, , and Consistency scores Overall score Consistency score The weights; S73, Comparison and Comprehensive Score The audit results are obtained by setting a preset threshold.

9. An encrypted traffic auditing system, characterized in that, include: Storage; Storage is used to store computer programs; Actuator; An executor is used to execute a computer program in a storage device, which, when executed, implements the encrypted traffic auditing method as described in any one of claims 1-8.

Images