Method and system for auditing encrypted traffic masquerading based on server role consistency

Abstract

The application discloses a camouflage encrypted traffic auditing method and system based on server role consistency, relates to the technical field of network security, and comprises the following steps: S1, acquiring encrypted communication traffic and extracting feature information; S2, determining a service type and constructing an access correlation graph; S3, analyzing rationality features and server role results of a destination server IP; S4, analyzing consistency scores of the destination server IP; S5, analyzing rationality scores; S6, analyzing access structure scores; S7, analyzing comprehensive auditing scores; and S8, analyzing auditing results. The actual behavior features of the destination server IP are analyzed to determine the server role, the server role consistency analysis mechanism is used to verify whether the role is consistent with the service type corresponding to the access behavior, the destination server IP rationality analysis and multi-target access structure analysis are combined, and the camouflage encrypted traffic is identified from the business semantics and network behavior levels, so that the effective auditing of the camouflage encrypted traffic is realized without decrypting the communication content.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and system for auditing disguised encrypted traffic based on server role consistency. Background Technology

[0002] With the widespread adoption of encrypted communication technologies such as TLS and HTTPS, the vast majority of network traffic can no longer be analyzed using traditional plaintext parsing methods. To adapt to encrypted environments, existing network auditing technologies typically classify and manage traffic based on explicit characteristics such as domain names, certificates, ports, and protocol fingerprints.

[0003] However, in real-world network environments, some encrypted communications masquerade as legitimate access to mainstream internet services at the session or transport layer. This makes them highly similar to genuine business access in terms of domain names, certificates, or protocol characteristics, thereby bypassing existing auditing and regulatory mechanisms. Such communications do not actually access the corresponding internet service; instead, they send communication traffic to a specific server, which then forwards it to the external network.

[0004] Different types of internet services (such as video streaming, social services, email services, and cloud services) have developed relatively stable server deployment structures and access behavior patterns over long-term operation, including server role division, connection duration distribution, multi-target access structures, and traffic interaction rhythms. While spoofed communication can mimic some surface characteristics, it is difficult to maintain consistency with real services in terms of server roles, access structures, and long-term behavioral consistency.

[0005] Existing technologies mostly focus on identifying the characteristics of specific protocols or tools, which have problems such as strong dependence, easy circumvention, and limited applicability. They are difficult to audit disguised encrypted traffic in a general and effective way without decrypting the communication content. Summary of the Invention

[0006] The purpose of this invention is to design a method and system for auditing disguised encrypted traffic based on server role consistency in order to solve the above problems.

[0007] The present invention achieves the above objectives through the following technical solutions:

[0008] Methods for auditing encrypted traffic based on server role consistency include:

[0009] S1. Obtain encrypted communication traffic that passes through the audit node for encrypted access behavior and extract feature information;

[0010] S2. Determine the service type of encrypted access behavior based on feature information, and construct an access association graph of multi-destination servers for encrypted access behavior. The nodes of the access association graph are the destination server IPs, and the edges of the access association graph are the co-occurrence relationships of access from the same source server IP.

[0011] S3. Analyze the rationality characteristics of the destination server IP and the server role results;

[0012] S4. Analyze the consistency score of the destination server IP based on the service type and server role results. ;

[0013] S5. Analyze the reasonableness score based on the reasonableness characteristics of the destination server IP. ;

[0014] S6. Analyze and score the access structure based on the access relationship diagram. ;

[0015] S7. Based on consistency scoring Reasonableness score and access structure scoring Analysis of comprehensive audit scores ;

[0016] S8. Based on the comprehensive audit score Analyze the audit results.

[0017] A disguised encrypted traffic auditing system based on server role consistency includes:

[0018] Storage; storage is used to store computer programs;

[0019] An executor; the executor is used to execute a computer program in storage, which, when executed, implements the above-described method for masquerading encrypted traffic auditing based on server role consistency.

[0020] The beneficial effects of this invention are as follows: by analyzing the actual behavioral characteristics of the destination server IP, its server role is determined, and then the server role consistency analysis mechanism is used to further verify whether the role is consistent with the service type corresponding to the access behavior. Combining the rationality analysis of the destination server IP and the multi-target access structure analysis, disguised encrypted traffic is identified from the business semantics and network behavior levels. This method achieves effective auditing of disguised encrypted traffic without decrypting the communication content. Detailed Implementation

[0021] In the description of this invention, it should also be noted that, unless otherwise explicitly specified and limited, terms such as "set" and "connection" should be interpreted broadly. For example, "connection" can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium; it can be a connection within two components. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0022] The specific embodiments of the present invention will be described in detail below.

[0023] Methods for auditing encrypted traffic based on server role consistency include:

[0024] S1. Obtain encrypted communication traffic through the audit node and extract feature information. Feature information includes source server IP address, destination server IP address, connection establishment time, disconnection time, session duration, number of data packets and bytes in the session, uplink and downlink traffic ratio, packet arrival time interval distribution and number of concurrent connections. Feature information is used to characterize the external connection behavior of encrypted communication.

[0025] S2. Determine the service type of encrypted access behavior based on feature information, and construct an access association graph of multi-destination servers for encrypted access behavior. The nodes of the access association graph are the destination server IPs, and the edges of the access association graph are the co-occurrence relationships of access from the same source server IP. Service types include video or short video service types, social and content interaction service types, email and instant messaging service types, cloud computing and API service types, and content distribution and static resource service types.

[0026] S3. Analyze the rationality characteristics and server role results of the destination server IP. The rationality characteristics constitute the behavioral profile of the destination server IP, and the server role results are classified as access server role, content distribution server role, business processing server role, relay / aggregation server role, or proxy / edge server role; specifically including:

[0027] S31. The rationality characteristics of the destination server IP within the statistical time window ΔT; rationality characteristics include connection scale characteristics, connection duration characteristics, traffic structure characteristics, and stability characteristics; connection scale characteristics include the total number of connections N. conn Number of different source server IPs N src Peak concurrent connections C peak Connection duration characteristics include average connection duration T avg Connection duration 90th percentile T p90 and maximum connection duration T max Traffic structure characteristics include uplink / downlink byte ratio Rupdown Downward sudden surge percentage (Burst) down_ratio and downlink rate variance V down_var Stability characteristics include the packet spacing coefficient of variation (CV). iat and the overlap ratio Conn overlap_ratio ;

[0028] S32. Calculate the matching degree between the destination server IP and all server role determination rules based on the rationality characteristics analysis, expressed as: ,in, This is the feature matching function, which outputs 0 or a normalized value.

[0029] The rules for determining the role of an access server are: N src ≥S1、T p90 ≤T1、C peak ≥C1、Conn overlap_ratio ≥O1;

[0030] The rules for determining the role of the content distribution server are: Burst down_ratio ≥B1、R updown ≤R1、V down_var ≥V1、T avg Located in the middle range;

[0031] The rules for determining the role of a business processing server are as follows: R updown Approximately 1, CV iat ≥C2、T avg Medium, N src medium;

[0032] The rules for determining the role of a transit / aggregation server are as follows: T p90 ≥T2, CV iat ≤C3、R updown Long-term stability, N src Smaller, Conn overlap_ratio Lower;

[0033] The rules for determining the role of a proxy / edge server are: T avg Longer than average, R updown Stable, Burst down_ratio Lower, CV iat Medium to low;

[0034] S33. Based on all the matching degrees, the role with the highest score is taken as the server role result of the destination server IP.

[0035] S4. Analyze the consistency score of the destination server IP based on the service type and server role results. , is represented as: ,in, This is the penalty value for role conflicts, configured according to the severity of the conflict; when the target server role does not belong to this set, it is considered a role inconsistency.

[0036] S5. Analyze the reasonableness score based on the reasonableness characteristics of the destination server IP. , is represented as: ,in, , and These represent the degree of deviation in the characteristics of the number of different source server IPs, the 90th percentile of connection duration, and the coefficient of variation of packet interval, respectively. , and These are the weighting coefficients for the number of different source server IPs, the 90th percentile of connection duration, and the coefficient of variation of packet interval, respectively.

[0037] S6. Analyze and score the access structure based on the access relationship diagram. , is represented as: ,in, and These are the target concentration C and the graph structure stability, respectively. Weighting coefficients;

[0038] S7. Based on consistency scoring Reasonableness score and access structure scoring Analysis of comprehensive audit scores , is represented as: ,in, , and Consistency scores Reasonableness score and access structure scoring Weighting coefficients;

[0039] S8. Based on the comprehensive audit score Analyze audit results against audit thresholds.

[0040] A disguised encrypted traffic auditing system based on server role consistency includes:

[0041] Storage; storage is used to store computer programs;

[0042] An executor; the executor is used to execute a computer program in storage, which, when executed, implements the above-described method for masquerading encrypted traffic auditing based on server role consistency.

[0043] By analyzing the actual behavioral characteristics of the destination server IP, its server role is determined. Then, through the server role consistency analysis mechanism, it is further verified whether the role is consistent with the service type corresponding to the access behavior. Combining the rationality analysis of the destination server IP and the analysis of multi-target access structure, disguised encrypted traffic is identified from the perspective of business semantics and network behavior. This method achieves effective auditing of disguised encrypted traffic without decrypting the communication content.

[0044] The technical solutions of the present invention are not limited to the specific embodiments described above. Any technical modifications made in accordance with the technical solutions of the present invention fall within the protection scope of the present invention.

Claims

1. A method for auditing disguised encrypted traffic based on server role consistency, characterized in that, include: S1. Obtain encrypted communication traffic that passes through the audit node for encrypted access behavior and extract feature information; S2. Determine the service type of encrypted access behavior based on feature information, and construct an access association graph of multi-destination servers for encrypted access behavior. The nodes of the access association graph are the destination server IPs, and the edges of the access association graph are the co-occurrence relationships of access from the same source server IP. S3. Analyze the rationality characteristics of the destination server IP and the server role results; S4. Analyze the consistency score of the destination server IP based on the service type and server role results. ; S5. Analyze the reasonableness score based on the reasonableness characteristics of the destination server IP. ; S6. Analyze and score the access structure based on the access relationship diagram. ; S7. Based on consistency scoring Reasonableness score and access structure scoring Analysis of comprehensive audit scores ; S8. Based on the comprehensive audit score Analyze the audit results.

2. The method for auditing disguised encrypted traffic based on server role consistency according to claim 1, characterized in that, The characteristic information includes the source server IP address, destination server IP address, connection establishment time, disconnection time, session duration, number of data packets and bytes in the session, uplink and downlink traffic ratio, packet arrival time interval distribution, and number of concurrent connections.

3. The method for auditing disguised encrypted traffic based on server role consistency according to claim 1, characterized in that, S3 includes: S31. The rationality characteristics of the destination server IP within the statistical time window ΔT; rationality characteristics include connection scale characteristics, connection duration characteristics, traffic structure characteristics, and stability characteristics; connection scale characteristics include the total number of connections N. conn Number of different source server IPs N src Peak concurrent connections C peak Connection duration characteristics include average connection duration T avg Connection duration 90th percentile T p90 and maximum connection duration T max Traffic structure characteristics include uplink / downlink byte ratio R updown Downward sudden surge percentage (Burst) down_ratio and downlink rate variance V down_var Stability characteristics include the packet spacing coefficient of variation (CV). iat and the overlap ratio Conn overlap_ratio ; S32. Calculate the matching degree between the destination server IP and all server role determination rules based on the rationality characteristics analysis, expressed as: ,in, For feature matching functions; S33. Based on all the matching degrees, determine the server role result of the destination server IP.

4. The method for auditing disguised encrypted traffic based on server role consistency according to claim 1, characterized in that, In S4, consistency scoring Represented as: ,in, This represents the penalty value for character conflicts.

5. The method for auditing disguised encrypted traffic based on server role consistency according to claim 3, characterized in that, In S5, rationality score Represented as: ,in, , and These represent the degree of deviation in the characteristics of the number of different source server IPs, the 90th percentile of connection duration, and the coefficient of variation of packet interval, respectively. , and These are the weighting coefficients for the number of different source server IPs, the 90th percentile of connection duration, and the coefficient of variation of packet interval, respectively.

6. The method for auditing disguised encrypted traffic based on server role consistency according to claim 1, characterized in that, Access Structure Scoring Represented as: ,in, and These are the target concentration C and the graph structure stability, respectively. The weighting coefficients.

7. The method for auditing disguised encrypted traffic based on server role consistency according to claim 1, characterized in that, Comprehensive Audit Scoring Represented as: ,in, , and Consistency scores Reasonableness score and access structure scoring The weighting coefficients.

8. A disguised encrypted traffic auditing system based on server role consistency, characterized in that: include: Storage; Storage is used to store computer programs; Actuator; The executor is used to execute a computer program in the storage, which, when executed, implements the masquerading encrypted traffic auditing method based on server role consistency as described in any one of claims 1-7.

Images