Network traffic classification method, equipment, storage medium and device

Abstract

The present invention relates to the technical field of network traffic classification, and discloses a network traffic classification method, equipment, storage medium and device. The present invention transmits the network traffic to be responded to to the kernel layer when the application layer receives the network traffic to be responded; classifies the network traffic to be responded to by the preset classification rules in the kernel layer to obtain the classification result, and the preset classification rules are generated based on the virtual patch file uploaded by the application layer; when the classification result is non-malicious traffic, the application layer responds to the network traffic to be responded to, thereby setting the virtual patch file in the kernel layer. Since the kernel layer can access all data, the full coverage of the classification can be guaranteed, and then the network traffic to be responded to is classified by the virtual patch file, thereby improving the more effective network security protection of the virtual patch.

Description

Technical Field

[0001] The present invention relates to the field of virtual patch technology, and in particular to a network traffic classification method, equipment, storage medium and device. Background Art

[0002] Virtual patching is a solution that can free developers from the dilemma of patch management. Virtual patching technology aims to change or eliminate vulnerabilities by controlling the input or output of the affected application. It can also support earlier versions of an application when the earlier version is no longer supported by the vendor.

[0003] Traditional virtual patches are mainly identified in user mode, but since the user mode has relatively low permissions, it cannot intercept all traffic, resulting in the inability to perform network security defense more securely. Summary of the invention

[0004] The main purpose of the present invention is to provide a network traffic classification method, equipment, storage medium and device, aiming to solve how to improve the more effective network security protection of virtual patches.

[0005] To achieve the above object, the present invention provides a network traffic classification method, which comprises the following steps:

[0006] When the application layer receives the network traffic to be responded to, the application layer transmits the network traffic to be responded to to the kernel layer;

[0007] Classifying the network traffic to be responded to according to a preset classification rule in the kernel layer to obtain a classification result, wherein the preset classification rule is generated based on the virtual patch file uploaded by the application layer;

[0008] When the classification result is non-malicious traffic, the application layer responds to the network traffic to be responded to.

[0009] Optionally, the preset classification rule is a field matching rule;

[0010] The classifying the network traffic to be responded to according to the preset classification rules in the kernel layer to obtain the classification result includes:

[0011] The network traffic to be responded to is classified according to the field matching rule in the kernel layer to obtain a classification result.

[0012] Optionally, classifying the network traffic to be responded to according to the field matching rule in the kernel layer to obtain the classification result includes:

[0013] Get the preset classification field information;

[0014] Parsing the network traffic to be responded to, and obtaining the parsed field information to be responded to;

[0015] Matching the preset classification field information with the field information to be responded to, to determine whether the field information to be responded to contains the preset classification field information;

[0016] When the field information to be responded to contains the preset classification field information, a classification result is obtained according to the preset classification field information.

[0017] Optionally, matching the preset classification field information with the field information to be responded to includes:

[0018] Combining the preset classification field information to obtain a preset classification field information set;

[0019] Obtaining regular expression rule information, and building matching rules for the preset classification field information set according to the regular expression rule information to generate a matching regular expression;

[0020] The field information to be responded to is matched according to the matching regular expression.

[0021] Optionally, the preset classification rule is a feature matching rule;

[0022] The classifying the network traffic to be responded to according to the preset classification rules in the kernel layer to obtain the classification result includes:

[0023] The network traffic to be responded to is classified according to the feature matching rules in the kernel layer to obtain a classification result.

[0024] Optionally, classifying the network traffic to be responded to according to the feature matching rule in the kernel layer to obtain the classification result includes:

[0025] Parsing the network traffic to be responded to, and obtaining parsed data to be responded to;

[0026] Obtaining corresponding response characteristic information according to the data to be responded to;

[0027] The network traffic to be responded to is classified according to the response characteristic information to obtain a classification result.

[0028] Optionally, the preset classification rule is a link matching rule;

[0029] The classifying the network traffic to be responded to according to the preset classification rules in the kernel layer to obtain the classification result includes:

[0030] The network traffic to be responded to is classified according to the link matching rule in the kernel layer to obtain a classification result.

[0031] Optionally, classifying the network traffic to be responded to according to the link matching rule in the kernel layer to obtain the classification result includes:

[0032] Parsing the network traffic to be responded to obtain parsed link information;

[0033] Extracting source address information of the request information in the link information and destination address information of the request information to be responded to in the link information;

[0034] Determine a preset address type according to the source address information, judge whether the destination address information belongs to the preset address type, and obtain a judgment result;

[0035] A classification result is obtained according to the judgment result.

[0036] Optionally, when receiving the network traffic to be responded to at the application layer, transmitting the network traffic to be responded to to the kernel layer includes:

[0037] When receiving the network traffic to be responded to at the application layer, performing network traffic attribute analysis on the network traffic to be responded to obtain a traffic attribute result;

[0038] Obtaining a corresponding communication protocol type according to the traffic attribute result;

[0039] When the communication protocol type is a preset protocol type, reorganizing the network traffic to be responded to obtain reorganized network traffic to be responded to;

[0040] The reorganized network traffic to be responded to is transmitted to the kernel layer.

[0041] Optionally, when the communication protocol type is a preset protocol type, reorganizing the network traffic to be responded to obtain reorganized network traffic to be responded to includes:

[0042] When the communication protocol type is a preset protocol type, counting the current length information of the network traffic to be responded to;

[0043] Performing fragment identification on the network traffic to be responded to according to the current length information to obtain fragmented network traffic;

[0044] Extracting reassembly number information from the network traffic of the fragment;

[0045] The fragmented network traffic is reassembled according to the reassembly number information to obtain reassembled network traffic to be responded to.

[0046] Optionally, the performing fragment identification on the network traffic to be responded to according to the current length information to obtain fragmented network traffic includes:

[0047] Get the preset length threshold;

[0048] Compare the current length information with the preset length threshold to determine whether the current length information reaches the preset length threshold;

[0049] When the current length information reaches the preset length threshold, the network traffic to be responded to corresponding to the preset length threshold is used as the network traffic of the segment.

[0050] Optionally, when receiving the network traffic to be responded to at the application layer, transmitting the network traffic to be responded to to the kernel layer includes:

[0051] When the application layer receives the network traffic to be responded to, calling a preset receiving function, wherein the preset receiving function connects the application layer and the kernel layer;

[0052] The network traffic to be responded to is transmitted to the kernel layer according to the preset receiving function.

[0053] Optionally, when receiving the network traffic to be responded to at the application layer, calling a preset receiving function includes:

[0054] When receiving the network traffic to be responded to at the application layer, comparing the network traffic to be responded to with a preset protocol keyword;

[0055] Obtaining the protocol type of the network traffic to be responded to according to the comparison result;

[0056] The corresponding preset receiving function is called according to the protocol type of the network traffic to be responded to.

[0057] Optionally, before classifying the network traffic to be responded to according to the preset classification rule in the kernel layer and obtaining the classification result, the method further includes:

[0058] Calling a preset hook function in the kernel layer to extract filtering rule information in the preset hook function;

[0059] The filtering rule information is used as a preset classification rule.

[0060] Optionally, before using the filtering rule information as a preset classification rule, the method further includes:

[0061] Obtaining a virtual patch file uploaded by the application layer, and calling a patch generator according to the virtual patch file;

[0062] Encapsulating the filtering rule information by the patch generator to obtain encapsulated filtering rule information;

[0063] The using the filtering rule information as a preset classification rule includes:

[0064] The encapsulated filtering rule information is used as a preset classification rule.

[0065] Optionally, before using the encapsulated filtering rule information as a preset classification rule, the method further includes:

[0066] Obtaining version information of the encapsulated filtering rule information and current version information corresponding to the preset classification rule in the kernel layer;

[0067] Determine whether the version information of the encapsulated filtering rule information is higher than the current version information;

[0068] When the version information of the encapsulated filtering rule information is higher than the current version information, the step of using the encapsulated filtering rule information as the preset classification rule is performed.

[0069] In addition, to achieve the above-mentioned purpose, the present invention also proposes a network traffic classification device, the network traffic classification device comprising:

[0070] A transmission module, configured to transmit the network traffic to be responded to to the kernel layer when the application layer receives the network traffic to be responded to;

[0071] A classification module, configured to classify the network traffic to be responded to according to a preset classification rule in the kernel layer to obtain a classification result, wherein the preset classification rule is generated based on the virtual patch file uploaded by the application layer;

[0072] The response module is used to respond to the network traffic to be responded to by the application layer when the classification result is non-malicious traffic.

[0073] Optionally, the preset classification rule is a field matching rule;

[0074] The classification module is further used to classify the network traffic to be responded to according to the field matching rules in the kernel layer to obtain a classification result.

[0075] In addition, to achieve the above-mentioned purpose, the present invention also proposes a network traffic classification device, which includes: a memory, a processor, and a network traffic classification program stored in the memory and running on the processor, and when the network traffic classification program is executed by the processor, the steps of the network traffic classification method described above are implemented.

[0076] In addition, to achieve the above-mentioned purpose, the present invention also proposes a storage medium, on which a network traffic classification program is stored, and when the network traffic classification program is executed by a processor, the steps of the network traffic classification method described above are implemented.

[0077] The technical solution provided by the present invention is as follows: when the application layer receives the network traffic to be responded to, the network traffic to be responded to is transmitted to the kernel layer; the network traffic to be responded to is classified by the preset classification rules in the kernel layer to obtain a classification result, and the preset classification rules are generated based on the virtual patch file uploaded by the application layer; when the classification result is non-malicious traffic, the application layer responds to the network traffic to be responded to, thereby setting the virtual patch file in the kernel layer. Since the kernel layer can access all data, full coverage of the classification can be guaranteed, and then the network traffic to be responded to is classified by the virtual patch file, thereby improving the more effective network security protection of the virtual patch. BRIEF DESCRIPTION OF THE DRAWINGS

[0078] Figure 1 It is a schematic diagram of the structure of a network traffic classification device in a hardware operating environment involved in an embodiment of the present invention;

[0079] Figure 2 It is a flowchart of the first embodiment of the network traffic classification method of the present invention;

[0080] Figure 3 A schematic diagram of the OSI model structure of an embodiment of a network traffic classification method of the present invention;

[0081] Figure 4 It is a flowchart of a second embodiment of the network traffic classification method of the present invention;

[0082] Figure 5 A schematic diagram of a flow chart of a third embodiment of a network traffic classification method of the present invention;

[0083] Figure 6 This is a structural block diagram of the first embodiment of the network traffic classification device of the present invention. DETAILED DESCRIPTION

[0084] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0085] The main technical terms involved in the embodiments of this application include:

[0086] HTTP protocol: HyperText Transfer Protocol, Hypertext Transfer Protocol, is the most widely used network transmission protocol on the Internet.

[0087] OSI model: Open System Interconnection Reference Model, open system interconnection communication reference model.

[0088] TCP protocol: Transmission Control Protocol, Transmission Control Protocol is a connection-oriented, reliable and byte stream-based transport layer communication protocol.

[0089] UDP protocol: User Datagram Protocol, User Datagram Protocol, is a connectionless transport layer protocol in the OSI reference model, providing simple transaction-oriented unreliable information transmission services. The UDP protocol is used to process data packets like the TCP protocol. In the OSI model, both are located in the transport layer, which is the upper layer of the IP protocol.

[0090] IP protocol: Internet Protocol, Internet interconnection protocol.

[0091] VPatch: is a free patch generator that is used to generate small patch files to upgrade old versions to new versions.

[0092] Hook function: Hook function is part of Windows message processing mechanism. By setting "hook", the application can filter all messages and events at the system level and access messages that cannot be accessed under normal circumstances. The essence of hook is a program for processing system messages, which is hooked into the system through system calls.

[0093] Protocol stack: Protocol stack, also known as protocol stack, is a specific software implementation of a computer network protocol suite. A protocol in a protocol suite is usually designed for only one purpose, which makes design easier. Because each protocol module usually communicates with two other protocol modules above and below, they can usually be imagined as layers in a protocol stack. The lowest level protocol always describes the physical interaction with the hardware. Each higher level adds more features. User applications only deal with the top-level protocol.

[0094] Reference Figure 1 , Figure 1 A schematic diagram of the structure of a network traffic classification device in a hardware operating environment involved in an embodiment of the present invention.

[0095] like Figure 1As shown, the network traffic classification device may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), and the user interface 1003 may optionally include a standard wired interface and a wireless interface, and the wired interface of the user interface 1003 may be a universal serial bus (USB) interface in the present invention. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface). The memory 1005 may be a high-speed random access memory (Random Access Memory, RAM); it may also be a stable memory, such as a non-volatile memory (Non-volatile Memory), specifically, a disk memory. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0096] Those skilled in the art will understand that Figure 1 The structure shown in the figure does not constitute a limitation on the network traffic classification device, and may include more or less components than those shown in the figure, or combine certain components, or arrange the components differently.

[0097] like Figure 1 As shown, the memory 1005 as a computer storage medium may include an operating system, a network communication module, a user interface module, and a network traffic classification program.

[0098] exist Figure 1 In the network traffic classification device shown, the network interface 1004 is mainly used to connect to the background server and communicate data with the background server; the user interface 1003 is mainly used to connect to peripherals; the network traffic classification device calls the network traffic classification program stored in the memory 1005 through the processor 1001, and executes the network traffic classification method provided in the embodiment of the present invention.

[0099] Based on the above hardware structure, an embodiment of the network traffic classification method of the present invention is proposed.

[0100] Reference Figure 2 , Figure 2 It is a flowchart of the first embodiment of the network traffic classification method of the present invention.

[0101] In a first embodiment, the network traffic classification method comprises the following steps:

[0102] Step S10: When the application layer receives the network traffic to be responded to, the application layer transmits the network traffic to be responded to the kernel layer.

[0103] It should be noted that the executor of this embodiment is a network traffic classification device, and may also be other devices that can achieve the same or similar functions. This embodiment does not limit this. In this embodiment, the network traffic classification device is taken as an example for explanation.

[0104] In this embodiment, the application layer is the application layer in the OSI model, and the kernel layer is the protocol layer where the program running in the kernel state is located. The kernel state and the user state are two operating levels of the operating system. When the program runs at the 3rd privilege level, it can be said to be running in the user state. Because this is the lowest privilege level, it is the privilege level at which ordinary user processes run. Most programs that users directly face are running in the user state. When the program runs at the 0th privilege level, it can be said to be running in the kernel state. Programs running in the user state cannot directly access the operating system kernel data structure and program. When we execute a program in the system, most of the time it runs in the user state. When it needs the operating system to help complete some tasks that it does not have the power and ability to complete, it will switch to the kernel state, such as operating hardware. Because when it is executed in the user state, the memory space and objects that the process can access are limited, and the processor it occupies can be preempted. When it is executed in the kernel state, it can access all memory spaces and objects, and the processor it occupies is not allowed to be preempted, so that all the network traffic currently in use can be obtained through the kernel layer, such as Figure 3 The schematic diagram of the OSI model structure shown in the figure includes the application layer, presentation layer, session layer, etc., as well as the protocol types supported by each layer.

[0105] In a specific implementation, through preset monitoring software, the monitoring software can be set in the application layer or the kernel layer, and the network traffic is responded to through the preset monitoring software. The preset monitoring software can be a third-party monitoring software, such as a monitoring APP, etc., and can also be other forms of monitoring software, which is not limited in this embodiment.

[0106] Step S20: classifying the network traffic to be responded to according to a preset classification rule in the kernel layer to obtain a classification result, wherein the preset classification rule is generated based on the virtual patch file uploaded by the application layer.

[0107] In a specific implementation, the preset classification rule may be at least one of a field matching rule, a feature matching rule, and a link matching rule. The network traffic to be responded to is classified according to the preset classification rule in the kernel layer to obtain a classification result, wherein the classification result is malicious traffic or non-malicious traffic, and may also be other forms of classification results, such as a pending status. This embodiment does not limit this. In this embodiment, the classification result is taken as malicious traffic or non-malicious traffic as an example for illustration.

[0108] In this embodiment, since the preset classification rules are set in the kernel layer, all network traffic is classified and processed, thereby improving the security of network monitoring. Specifically, the rule writing instructions are obtained, the program calling instructions of the kernel layer are called, and the preset classification rules are written into the kernel layer according to the program calling instructions of the kernel layer, thereby realizing the creation of a virtual patch at the kernel layer.

[0109] It can be understood that the preset classification rules are generated based on the virtual patch file uploaded by the application layer, that is, they can be generated according to the user writing the virtual patch file through the application layer, so that the user can set up preset classification rules according to actual needs, thereby achieving the purpose of improving the flexibility of the preset classification rules.

[0110] In a specific implementation, the preset classification rule is a field matching rule, and the step S20 includes:

[0111] The network traffic to be responded is classified by the field matching rule in the kernel layer to obtain a classification result, which is specifically:

[0112] Obtain preset classification field information; parse the network traffic to be responded to obtain the parsed field information to be responded to; match the preset classification field information with the field information to be responded to determine whether the field information to be responded to contains the preset classification field information; when the field information to be responded to contains the preset classification field information, obtain a classification result according to the preset classification field information.

[0113] It should be noted that the preset classification field information is a characteristic field input by the user. The filtering of the network traffic to be responded to is implemented according to the characteristic field input by the user, such as fields such as "redirection", and other field information. This embodiment does not limit this. Under normal circumstances, since redirection will perform address changes on data transmission, it is not conducive to network security. Therefore, it can be determined whether the network traffic to be responded to contains redirection. If the network traffic to be responded to contains redirection, it means that there is a security risk. In this case, the network traffic to be responded to that has a security risk will be filtered, thereby improving the security of the network transmission environment.

[0114] In a specific implementation, the matching of the preset classification field information with the field information to be responded to includes:

[0115] The preset classification field information is combined to obtain a preset classification field information set; regular expression rule information is obtained, and matching rules are established for the preset classification field information set according to the regular expression rule information to generate a matching regular expression; and the field information to be responded to is matched according to the matching regular expression.

[0116] In this embodiment, in order to achieve the separation of network traffic to be responded to, matching is performed through regular expressions, and classification is achieved through matching results. Since there are multiple filtering conditions input by the user, filtering in batches through filtering conditions greatly affects the efficiency of data processing. Therefore, the user filtering conditions are generated into regular expressions, and data matching is performed through regular expressions. For example, if the user inputs redirection and address modification, the generated regular expression is [pcre:”*(redirection|address modification)*”;], thereby performing data matching through regular expressions and improving the efficiency of data processing.

[0117] Specifically, the preset classification field information is combined to obtain a preset classification field information set. For example, if user input is redirected and address is modified, "redirection" and "address modification" are combined to obtain a preset classification field information set, such as (redirection|address modification). It can also be other forms of combination, which is not limited in this embodiment. In order to achieve the establishment of a matching regular expression, regular expression rule information is obtained, wherein the regular expression rule information can be data structure information, such as [pcre:"*X*";], where X represents a preset classification field information set. It can also be other forms of data structure, which is not limited in this embodiment. According to the regular expression rule information, a matching rule is established for the preset classification field information set to generate a matching regular expression, that is, the generated regular expression is [pcre:"*(redirection|address modification)*";], and the field information to be responded to is matched according to the matching regular expression, thereby improving data processing efficiency. In addition to data matching by regular expressions, other matching methods can also be used, which is not limited in this embodiment.

[0118] As another embodiment, the preset classification rule is a feature matching rule; the step S20 includes:

[0119] The network traffic to be responded is classified according to the feature matching rules in the kernel layer to obtain a classification result, which is specifically:

[0120] The network traffic to be responded to is parsed to obtain the parsed data to be responded to; corresponding response feature information is obtained according to the data to be responded to; the network traffic to be responded to is classified according to the response feature information to obtain a classification result.

[0121] This embodiment mainly classifies network traffic based on response feature information, wherein the response feature information includes at least one of forced installation feature information, difficult uninstall feature information, browser hijacking feature information and malicious uninstall feature information. Forced installation refers to the act of installing software on a user's computer or other terminal without explicitly prompting the user or without the user's permission. Difficult uninstallation refers to the act of not providing a general uninstallation method, or there are still active programs after uninstallation without being affected by other software or human damage. Browser hijacking refers to the act of modifying the user's browser or other related settings without the user's permission, forcing the user to visit a specific website or causing the user to be unable to access the Internet normally. Malicious uninstallation refers to the act of uninstalling other software without explicitly prompting the user, without the user's permission, or misleading or deceiving the user.

[0122] In a specific implementation, feature identification is performed based on the data to be responded to, and it is determined whether the data to be responded to meets the feature information of malicious traffic. If the data to be responded to meets the feature information of malicious traffic, corresponding response feature information is obtained, and the network traffic to be responded to is classified based on the response feature information to obtain a classification result, thereby identifying network traffic based on the response feature information to improve the accuracy of feature identification.

[0123] As another embodiment, the preset classification rule is a link matching rule; the step S20 includes:

[0124] The network traffic to be responded to is classified according to the link matching rules in the kernel layer to obtain a classification result, which is specifically:

[0125] Parse the network traffic to be responded to and obtain the parsed link information; extract the source address information of the request information in the link information and the destination address information of the request information to be responded to in the link information; determine the preset address type according to the source address information, judge whether the destination address information belongs to the preset address type, and obtain the judgment result; obtain the classification result according to the judgment result.

[0126] This embodiment mainly classifies network traffic based on link matching rules. Since malicious traffic has the behavior of traffic tampering, that is, the destination address information is modified to a pre-set malicious address, thereby intercepting the user's behavior data, the behavior can be verified through the link address, thereby improving the security of network monitoring.

[0127] In a specific implementation, by extracting the source address information of the request information in the link information and the destination address information of the request information to be responded to in the link information, it is determined whether the source address information of the request information in the link information and the destination address information of the request information to be responded to in the link information belong to the same type. When the source address information of the request information in the link information and the destination address information of the request information to be responded to belong to the same type, it means that the network address has not been tampered with, and the network traffic to be responded to is non-malicious traffic. Correspondingly, when the source address information of the request information in the link information and the destination address information of the request information to be responded to do not belong to the same type, it means that the network address has been tampered with, and the network traffic to be responded to is malicious traffic, thereby realizing the identification of the network traffic to be responded to and improving the accuracy of malicious traffic identification.

[0128] In a specific implementation, a preset address type is determined based on the source address information, and it is determined whether the destination address information belongs to the preset address type. For example, the source address information is identified as a type, and the source address information is obtained as a network address of a hospital type. Specifically, the IP range information can be obtained based on the source address information, and the corresponding category information is determined based on the IP range information. Generally, the request information of a hospital website usually corresponds to the request information of other hospital websites. If the source address information and the destination address information of the link information do not belong to the same type, the website information may be tampered with, thereby further improving the accuracy of identifying malicious traffic.

[0129] Step S30: When the classification result is non-malicious traffic, the application layer responds to the network traffic to be responded to.

[0130] This embodiment is mainly used to filter input traffic and apply virtual patches to the application layer. When the application program at the application layer receives network data, it will eventually call the corresponding recvmsg function according to the protocol type through the system call, and then copy the user traffic to the user space. Vpatch hook can be performed before copying the data. The hook function needs to match the feature field passed in by the user according to the protocol type, complete regular matching, and realize traffic filtering.

[0131] Through the above scheme, this embodiment transmits the network traffic to be responded to the kernel layer when the application layer receives the network traffic to be responded; classifies the network traffic to be responded to by the preset classification rules in the kernel layer to obtain a classification result, and the preset classification rules are generated based on the virtual patch file uploaded by the application layer; when the classification result is non-malicious traffic, the application layer responds to the network traffic to be responded, thereby setting a virtual patch file in the kernel layer. Since the kernel layer can access all data, full coverage of the classification can be guaranteed, and then the network traffic to be responded to is classified by the virtual patch file, thereby improving the more effective network security protection of the virtual patch.

[0132] Reference Figure 4 , Figure 4 This is a flow chart of the second embodiment of the network traffic classification method of the present invention. Figure 2 The first embodiment shown provides a second embodiment of the network traffic classification method of the present invention.

[0133] In the second embodiment, the step S10 includes:

[0134] Step S101, when the application layer receives the network traffic to be responded, the network traffic attribute analysis is performed on the network traffic to be responded to obtain the traffic attribute result.

[0135] In this embodiment, the network traffic attribute is the communication protocol used by the network traffic. By analyzing the network traffic attributes of the network traffic to be responded to, the communication protocol type of the current network traffic can be obtained. Since each communication protocol processes data differently, for example, the TCP communication protocol uses segments for data transmission, but the UDP communication protocol uses streams for data transmission. When the communication protocol type of the current network traffic is TCP, the network traffic needs to be reorganized and restored to obtain the true situation of the current network traffic and improve the accuracy of classification.

[0136] Step S102, obtaining a corresponding communication protocol type according to the traffic attribute result.

[0137] In a specific implementation, data structure analysis can be performed on the network traffic to be responded to. Since the TCP communication protocol and other communication protocols have their own set of protocol structures, the corresponding communication protocol type can be obtained by analyzing the network traffic.

[0138] Step S103, when the communication protocol type is a preset protocol type, reorganize the network traffic to be responded to obtain reorganized network traffic to be responded to.

[0139] It should be noted that the preset protocol type is the TCP protocol type, and it can also be other communication protocol types that need to segment data in order to avoid data overflow during data transmission. This embodiment does not limit this. In this embodiment, the preset protocol type is the TCP protocol type as an example for explanation.

[0140] It is understandable that in order to obtain the true situation of the current network traffic, when the preset protocol type is the TCP protocol type, the network traffic to be responded to is reorganized to obtain the reorganized network traffic to be responded to, thereby ensuring the orderliness of data transmission.

[0141] Step S104: transmitting the reorganized network traffic to be responded to to the kernel layer.

[0142] In one embodiment, step S103 includes:

[0143] When the communication protocol type is a preset protocol type, the current length information of the network traffic to be responded to is counted; the network traffic to be responded to is fragmented and identified according to the current length information to obtain fragmented network traffic; the reorganization number information in the fragmented network traffic is extracted; the fragmented network traffic is reorganized according to the reorganization number information to obtain the reorganized network traffic to be responded to.

[0144] In this embodiment, when the communication protocol type is the TCP protocol type, it means that there is fragmented network traffic in the current network traffic. Therefore, it is first necessary to identify the fragmented network traffic from the current network traffic to obtain the fragmented network traffic. Since the fragmented network traffic carries numbering information, it can be reassembled through the numbering information to achieve the orderliness of the transmitted data, specifically: extract the reassembled numbering information in the fragmented network traffic; reassemble the fragmented network traffic according to the reassembled numbering information to obtain the reassembled network traffic to be responded to, thereby realizing the restoration of the fragmented data and improving the accuracy of traffic identification.

[0145] In one embodiment, the performing fragment identification on the network traffic to be responded to according to the current length information to obtain fragmented network traffic includes:

[0146] Obtain a preset length threshold; compare the current length information with the preset length threshold to determine whether the current length information reaches the preset length threshold; when the current length information reaches the preset length threshold, the network traffic to be responded to corresponding to the preset length threshold is used as the network traffic of the segment.

[0147] In this embodiment, in order to identify fragmented network traffic, a length analysis is performed based on current network data, wherein the preset length threshold is the maximum traffic length that can be received by the receiving terminal based on the destination address information. When the current traffic length reaches the maximum received traffic length, fragmentation is performed and the traffic is sent again in the next sequence time period, thereby avoiding the situation where the traffic that the receiving terminal can withstand is less than the traffic sent. The fragmented traffic reaches the maximum traffic length that can be received by the receiving terminal. Therefore, by judging whether the current length information reaches the preset length threshold, the network traffic to be responded to that reaches the preset length threshold is used as the fragmented network traffic, thereby realizing the identification of fragmented network traffic.

[0148] Through the above scheme, this embodiment uses the current length information to identify the fragmented network traffic to be responded to, and reassembles the fragmented network traffic according to the reassembly number information in the fragmented network traffic to obtain the reassembled network traffic to be responded to, thereby restoring the fragmented network traffic, obtaining the real information of the network traffic, realizing the orderliness of the TCP end, tracking the connection status, and supporting the fragmented protocol header data, so as to achieve the purpose of accuracy of network traffic analysis.

[0149] Reference Figure 5 , Figure 5 This is a flow chart of the third embodiment of the network traffic classification method of the present invention. The third embodiment of the network traffic classification method of the present invention is proposed based on the first embodiment or the second embodiment. In this embodiment, the description is based on the first embodiment.

[0150] In the third embodiment, the step S10 includes:

[0151] Step S105, when the application layer receives the network traffic to be responded to, calling a preset receiving function, wherein the preset receiving function connects the application layer and the kernel layer.

[0152] In this embodiment, the preset receiving function may be a recvmsg function, or other functions that implement a receiving function, which is not limited in this embodiment. In this embodiment, the recvmsg function is taken as an example for description.

[0153] Step S106: transmitting the network traffic to be responded to to the kernel layer according to the preset receiving function.

[0154] In a specific implementation, the network traffic to be responded to in the application layer can be transmitted to the kernel layer through the recvmsg function, so that the network traffic to be responded to can be classified according to the preset classification rules in the kernel layer, thereby achieving comprehensive classification and avoiding the inability to access the kernel layer data due to permission issues.

[0155] In one embodiment, the step S105 includes:

[0156] When the application layer receives the network traffic to be responded to, the network traffic to be responded to is compared with the preset protocol keyword; the protocol type of the network traffic to be responded to is obtained according to the comparison result; and the corresponding preset receiving function is called according to the protocol type of the network traffic to be responded to.

[0157] In this embodiment, in order to ensure the flexibility of reception, since the receiving function corresponding to each transmission communication protocol is not the same, the network traffic to be responded to can be compared with the preset protocol keyword; the protocol type of the network traffic to be responded to is obtained according to the comparison result; the corresponding preset receiving function is called according to the protocol type of the network traffic to be responded to, wherein the preset protocol keyword can be an information segmentation keyword, and can also include other keywords, which is not limited in this embodiment. Since TCP performs segmentation during information transmission, the corresponding communication protocol type is obtained according to whether the information is segmented, that is, the corresponding recvmsg function is called according to the protocol type, thereby ensuring the correct reception of network traffic.

[0158] In one embodiment, before step S20, the method further includes:

[0159] The preset hook function in the kernel layer is called to extract the filtering rule information in the preset hook function; and the filtering rule information is used as the preset classification rule.

[0160] In this embodiment, the preset hook function may be a hook function, or other forms of hook functions, which are not limited in this embodiment. In this embodiment, the hook function is taken as an example for description.

[0161] In one embodiment, before using the filtering rule information as a preset classification rule, the method further includes:

[0162] Obtain a virtual patch file uploaded by the application layer, and call a patch generator according to the virtual patch file; encapsulate the filtering rule information through the patch generator to obtain encapsulated filtering rule information; and use the filtering rule information as a preset classification rule, including: using the encapsulated filtering rule information as a preset classification rule.

[0163] It should be noted that the patch generator may be a VPatch patch generator or other forms of patch generators, and this embodiment does not limit this. The VPatch patch generator is taken as an example for explanation. In order to generate preset classification rules according to the virtual patch file, the patch generator specifically encapsulates the filtering rule information to obtain the encapsulated filtering rule information, thereby realizing the setting of the virtual patch at the kernel layer.

[0164] In one embodiment, before using the encapsulated filtering rule information as a preset classification rule, the method further includes:

[0165] Obtain the version information of the encapsulated filtering rule information and the current version information corresponding to the preset classification rule in the kernel layer; determine whether the version information of the encapsulated filtering rule information is higher than the current version information; when the version information of the encapsulated filtering rule information is higher than the current version information, execute the step of using the encapsulated filtering rule information as the preset classification rule.

[0166] In this embodiment, since the current version information is stored in the kernel layer when the virtual patch is inserted, if no judgment is made and the current version information is directly updated, then when the current version information is higher than the preset classification rule, an invalid update will occur. In this case, it is not conducive to the version update and instead affects the data processing efficiency. Therefore, it is necessary to judge the version information of the virtual patch and update it only when the version information is higher than the current version information, thereby improving the efficiency of patch updating.

[0167] In addition, an embodiment of the present invention further proposes a storage medium, on which a network traffic classification program is stored. When the network traffic classification program is executed by a processor, the steps of the terminal network access method described above are implemented.

[0168] Since the storage medium adopts all the technical solutions of all the above embodiments, it has at least all the beneficial effects brought by the technical solutions of the above embodiments, which will not be described one by one here.

[0169] In addition, refer to Figure 6 The embodiment of the present invention further provides a network traffic classification device, the network traffic classification device comprising:

[0170] The transmission module 10 is used to transmit the network traffic to be responded to to the kernel layer when the application layer receives the network traffic to be responded to.

[0171] In this embodiment, the application layer is the application layer in the OSI model, and the kernel layer is the protocol layer where the program running in the kernel state is located. The kernel state and the user state are two operating levels of the operating system. When the program runs at the 3rd privilege level, it can be said to be running in the user state. Because this is the lowest privilege level, it is the privilege level at which ordinary user processes run. Most programs that users directly face are running in the user state. When the program runs at the 0th privilege level, it can be said to be running in the kernel state. Programs running in the user state cannot directly access the operating system kernel data structure and program. When we execute a program in the system, most of the time it runs in the user state. When it needs the operating system to help complete some tasks that it does not have the power and ability to complete, it will switch to the kernel state, such as operating hardware. Because when it is executed in the user state, the memory space and objects that the process can access are limited, and the processor it occupies can be preempted. When it is executed in the kernel state, it can access all memory spaces and objects, and the processor it occupies is not allowed to be preempted, so that all the network traffic currently in use can be obtained through the kernel layer, such as Figure 3 The schematic diagram of the OSI model structure shown in the figure includes the application layer, presentation layer, session layer, etc., as well as the protocol types supported by each layer.

[0172] In a specific implementation, through preset monitoring software, the monitoring software can be set in the application layer or the kernel layer, and the network traffic is responded to through the preset monitoring software. The preset monitoring software can be a third-party monitoring software, such as a monitoring APP, etc., and can also be other forms of monitoring software, which is not limited in this embodiment.

[0173] The classification module 20 is used to classify the network traffic to be responded to according to the preset classification rules in the kernel layer to obtain a classification result, wherein the preset classification rules are generated based on the virtual patch file uploaded by the application layer.

[0174] In a specific implementation, the preset classification rule may be at least one of a field matching rule, a feature matching rule, and a link matching rule. The network traffic to be responded to is classified according to the preset classification rule in the kernel layer to obtain a classification result, wherein the classification result is malicious traffic or non-malicious traffic, and may also be other forms of classification results, such as a pending status. This embodiment does not limit this. In this embodiment, the classification result is taken as malicious traffic or non-malicious traffic as an example for illustration.

[0175] In this embodiment, since the preset classification rules are set in the kernel layer, all network traffic is classified and processed, thereby improving the security of network monitoring. Specifically, the rule writing instructions are obtained, the program calling instructions of the kernel layer are called, and the preset classification rules are written into the kernel layer according to the program calling instructions of the kernel layer, thereby realizing the creation of a virtual patch at the kernel layer.

[0176] It can be understood that the preset classification rules are generated based on the virtual patch file uploaded by the application layer, that is, they can be generated according to the user writing the virtual patch file through the application layer, so that the user can set up preset classification rules according to actual needs, thereby achieving the purpose of improving the flexibility of the preset classification rules.

[0177] In a specific implementation, the preset classification rule is a field matching rule, and the step S20 includes:

[0178] The network traffic to be responded is classified by the field matching rule in the kernel layer to obtain a classification result, which is specifically:

[0179] Obtain preset classification field information; parse the network traffic to be responded to obtain the parsed field information to be responded to; match the preset classification field information with the field information to be responded to determine whether the field information to be responded to contains the preset classification field information; when the field information to be responded to contains the preset classification field information, obtain a classification result according to the preset classification field information.

[0180] It should be noted that the preset classification field information is a characteristic field input by the user. The filtering of the network traffic to be responded to is implemented according to the characteristic field input by the user, such as fields such as "redirection", and other field information. This embodiment does not limit this. Under normal circumstances, since redirection will perform address changes on data transmission, it is not conducive to network security. Therefore, it can be determined whether the network traffic to be responded to contains redirection. If the network traffic to be responded to contains redirection, it means that there is a security risk. In this case, the network traffic to be responded to that has a security risk will be filtered, thereby improving the security of the network transmission environment.

[0181] In a specific implementation, the matching of the preset classification field information with the field information to be responded to includes:

[0182] The preset classification field information is combined to obtain a preset classification field information set; regular expression rule information is obtained, and matching rules are established for the preset classification field information set according to the regular expression rule information to generate a matching regular expression; and the field information to be responded to is matched according to the matching regular expression.

[0183] In this embodiment, in order to achieve the separation of network traffic to be responded to, matching is performed through regular expressions, and classification is achieved through matching results. Since there are multiple filtering conditions input by the user, filtering in batches through filtering conditions greatly affects the efficiency of data processing. Therefore, the user filtering conditions are generated into regular expressions, and data matching is performed through regular expressions. For example, if the user inputs redirection and address modification, the generated regular expression is [pcre:”*(redirection|address modification)*”;], thereby performing data matching through regular expressions and improving the efficiency of data processing.

[0184] Specifically, the preset classification field information is combined to obtain a preset classification field information set. For example, if user input is redirected and address is modified, "redirection" and "address modification" are combined to obtain a preset classification field information set, such as (redirection|address modification). It can also be other forms of combination, which is not limited in this embodiment. In order to achieve the establishment of a matching regular expression, regular expression rule information is obtained, wherein the regular expression rule information can be data structure information, such as [pcre:"*X*";], where X represents a preset classification field information set. It can also be other forms of data structure, which is not limited in this embodiment. According to the regular expression rule information, a matching rule is established for the preset classification field information set to generate a matching regular expression, that is, the generated regular expression is [pcre:"*(redirection|address modification)*";], and the field information to be responded to is matched according to the matching regular expression, thereby improving data processing efficiency. In addition to data matching by regular expressions, other matching methods can also be used, which is not limited in this embodiment.

[0185] As another embodiment, the preset classification rule is a feature matching rule; the step S20 includes:

[0186] The network traffic to be responded is classified according to the feature matching rules in the kernel layer to obtain a classification result, which is specifically:

[0187] The network traffic to be responded to is parsed to obtain the parsed data to be responded to; corresponding response feature information is obtained according to the data to be responded to; the network traffic to be responded to is classified according to the response feature information to obtain a classification result.

[0188] This embodiment mainly classifies network traffic based on response feature information, wherein the response feature information includes at least one of forced installation feature information, difficult uninstall feature information, browser hijacking feature information and malicious uninstall feature information. Forced installation refers to the act of installing software on a user's computer or other terminal without explicitly prompting the user or without the user's permission. Difficult uninstallation refers to the act of not providing a general uninstallation method, or there are still active programs after uninstallation without being affected by other software or human damage. Browser hijacking refers to the act of modifying the user's browser or other related settings without the user's permission, forcing the user to visit a specific website or causing the user to be unable to access the Internet normally. Malicious uninstallation refers to the act of uninstalling other software without explicitly prompting the user, without the user's permission, or misleading or deceiving the user.

[0189] In a specific implementation, feature identification is performed based on the data to be responded to, and it is determined whether the data to be responded to meets the feature information of malicious traffic. If the data to be responded to meets the feature information of malicious traffic, corresponding response feature information is obtained, and the network traffic to be responded to is classified based on the response feature information to obtain a classification result, thereby identifying network traffic based on the response feature information to improve the accuracy of feature identification.

[0190] As another embodiment, the preset classification rule is a link matching rule; the step S20 includes:

[0191] The network traffic to be responded to is classified according to the link matching rules in the kernel layer to obtain a classification result, which is specifically:

[0192] Parse the network traffic to be responded to and obtain the parsed link information; extract the source address information of the request information in the link information and the destination address information of the request information to be responded to in the link information; determine the preset address type according to the source address information, judge whether the destination address information belongs to the preset address type, and obtain the judgment result; obtain the classification result according to the judgment result.

[0193] This embodiment mainly classifies network traffic based on link matching rules. Since malicious traffic has the behavior of traffic tampering, that is, the destination address information is modified to a pre-set malicious address, thereby intercepting the user's behavior data, the behavior can be verified through the link address, thereby improving the security of network monitoring.

[0194] In a specific implementation, by extracting the source address information of the request information in the link information and the destination address information of the request information to be responded to in the link information, it is determined whether the source address information of the request information in the link information and the destination address information of the request information to be responded to in the link information belong to the same type. When the source address information of the request information in the link information and the destination address information of the request information to be responded to belong to the same type, it means that the network address has not been tampered with, and the network traffic to be responded to is non-malicious traffic. Correspondingly, when the source address information of the request information in the link information and the destination address information of the request information to be responded to do not belong to the same type, it means that the network address has been tampered with, and the network traffic to be responded to is malicious traffic, thereby realizing the identification of the network traffic to be responded to and improving the accuracy of malicious traffic identification.

[0195] In a specific implementation, a preset address type is determined based on the source address information, and it is determined whether the destination address information belongs to the preset address type. For example, the source address information is identified as a type, and the source address information is obtained as a network address of a hospital type. Specifically, the IP range information can be obtained based on the source address information, and the corresponding category information is determined based on the IP range information. Generally, the request information of a hospital website usually corresponds to the request information of other hospital websites. If the source address information and the destination address information of the link information do not belong to the same type, the website information may be tampered with, thereby further improving the accuracy of identifying malicious traffic.

[0196] The response module 30 is used for, when the classification result is non-malicious traffic, for the application layer to respond to the network traffic to be responded to.

[0197] This embodiment is mainly used to filter input traffic and apply virtual patches to the application layer. When the application program at the application layer receives network data, it will eventually call the corresponding recvmsg function according to the protocol type through the system call, and then copy the user traffic to the user space. Vpatch hook can be performed before copying the data. The hook function needs to match the feature field passed in by the user according to the protocol type, complete regular matching, and realize traffic filtering.

[0198] Through the above scheme, this embodiment transmits the network traffic to be responded to the kernel layer when the application layer receives the network traffic to be responded; classifies the network traffic to be responded to by the preset classification rules in the kernel layer to obtain a classification result, and the preset classification rules are generated based on the virtual patch file uploaded by the application layer; when the classification result is non-malicious traffic, the application layer responds to the network traffic to be responded, thereby setting a virtual patch file in the kernel layer. Since the kernel layer can access all data, full coverage of the classification can be guaranteed, and then the network traffic to be responded to is classified by the virtual patch file, thereby improving the more effective network security protection of the virtual patch.

[0199] Furthermore, the preset classification rule is a field matching rule;

[0200] The classification module 20 is further configured to classify the network traffic to be responded to according to the field matching rule in the kernel layer to obtain a classification result.

[0201] Furthermore, the classification module 20 is also used to obtain preset classification field information;

[0202] Parsing the network traffic to be responded to, and obtaining the parsed field information to be responded to;

[0203] Matching the preset classification field information with the field information to be responded to, to determine whether the field information to be responded to contains the preset classification field information;

[0204] When the field information to be responded to contains the preset classification field information, a classification result is obtained according to the preset classification field information.

[0205] The classification module 20 is further used to combine the preset classification field information to obtain a preset classification field information set;

[0206] Obtaining regular expression rule information, and building matching rules for the preset classification field information set according to the regular expression rule information to generate a matching regular expression;

[0207] The field information to be responded to is matched according to the matching regular expression.

[0208] Furthermore, the preset classification rule is a feature matching rule;

[0209] The classification module 20 is further configured to classify the network traffic to be responded to according to the feature matching rules in the kernel layer to obtain a classification result.

[0210] Furthermore, the classification module 20 is also used to parse the network traffic to be responded to, and obtain the parsed data to be responded to;

[0211] Obtaining corresponding response characteristic information according to the data to be responded to;

[0212] The network traffic to be responded to is classified according to the response characteristic information to obtain a classification result.

[0213] Furthermore, the preset classification rule is a link matching rule;

[0214] The classification module 20 is further configured to classify the network traffic to be responded to according to the link matching rule in the kernel layer to obtain a classification result.

[0215] Furthermore, the classification module 20 is also used to parse the network traffic to be responded to, and obtain the parsed link information;

[0216] Extracting source address information of the request information in the link information and destination address information of the request information to be responded to in the link information;

[0217] Determine a preset address type according to the source address information, judge whether the destination address information belongs to the preset address type, and obtain a judgment result;

[0218] A classification result is obtained according to the judgment result.

[0219] Furthermore, the transmission module 10 is also used to perform network traffic attribute analysis on the network traffic to be responded to when the application layer receives the network traffic to be responded to, and obtain the traffic attribute result;

[0220] Obtaining a corresponding communication protocol type according to the traffic attribute result;

[0221] When the communication protocol type is a preset protocol type, reorganizing the network traffic to be responded to obtain reorganized network traffic to be responded to;

[0222] The reorganized network traffic to be responded to is transmitted to the kernel layer.

[0223] Furthermore, the transmission module 10 is also used to count the current length information of the network traffic to be responded to when the communication protocol type is a preset protocol type;

[0224] Performing fragment identification on the network traffic to be responded to according to the current length information to obtain fragmented network traffic;

[0225] Extracting reassembly number information from the network traffic of the fragment;

[0226] The fragmented network traffic is reassembled according to the reassembly number information to obtain reassembled network traffic to be responded to.

[0227] Furthermore, the transmission module 10 is also used to obtain a preset length threshold;

[0228] Compare the current length information with the preset length threshold to determine whether the current length information reaches the preset length threshold;

[0229] When the current length information reaches the preset length threshold, the network traffic to be responded to corresponding to the preset length threshold is used as the network traffic of the segment.

[0230] Furthermore, the transmission module 10 is also used to call a preset receiving function when the application layer receives the network traffic to be responded to, wherein the preset receiving function connects the application layer and the kernel layer;

[0231] The network traffic to be responded to is transmitted to the kernel layer according to the preset receiving function.

[0232] Furthermore, the transmission module 10 is also used to compare the network traffic to be responded to with a preset protocol keyword when the application layer receives the network traffic to be responded to;

[0233] Obtaining the protocol type of the network traffic to be responded to according to the comparison result;

[0234] The corresponding preset receiving function is called according to the protocol type of the network traffic to be responded to.

[0235] Furthermore, the classification module 20 is also used to call a preset hook function in the kernel layer to extract the filtering rule information in the preset hook function;

[0236] The filtering rule information is used as a preset classification rule.

[0237] Furthermore, the classification module 20 is also used to obtain the virtual patch file uploaded by the application layer, and call the patch generator according to the virtual patch file;

[0238] Encapsulating the filtering rule information by the patch generator to obtain encapsulated filtering rule information;

[0239] The encapsulated filtering rule information is used as a preset classification rule.

[0240] Furthermore, the classification module 20 is also used to obtain the version information of the encapsulated filtering rule information and the current version information corresponding to the preset classification rule in the kernel layer;

[0241] It is determined whether the version information of the encapsulated filtering rule information is higher than the current version information.

[0242] The network traffic classification device described in the present invention adopts all the technical solutions of all the above embodiments, and therefore has at least all the beneficial effects brought by the technical solutions of the above embodiments.

[0243] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A network traffic classification method, characterized in that: The network traffic classification method comprises the following steps: When the application layer receives the network traffic to be responded to, the application layer transmits the network traffic to be responded to to the kernel layer; The network traffic to be responded to is classified according to a preset classification rule in the kernel layer to obtain a classification result, wherein the preset classification rule is generated based on the virtual patch file uploaded by the application layer, and the preset classification rule is obtained by encapsulating the filtering rule information in the preset hook function by a patch generator; When the classification result is non-malicious traffic, the application layer responds to the network traffic to be responded to.

2. The network traffic classification method according to claim 1, characterized in that: The preset classification rule is a field matching rule; The classifying the network traffic to be responded to according to the preset classification rules in the kernel layer to obtain the classification result includes: The network traffic to be responded to is classified according to the field matching rule in the kernel layer to obtain a classification result.

3. The network traffic classification method according to claim 2, characterized in that: The classifying the network traffic to be responded to by the field matching rule in the kernel layer to obtain the classification result includes: Get the preset classification field information; Parsing the network traffic to be responded to, and obtaining the parsed field information to be responded to; Matching the preset classification field information with the field information to be responded to, to determine whether the field information to be responded to contains the preset classification field information; When the field information to be responded to contains the preset classification field information, a classification result is obtained according to the preset classification field information.

4. The network traffic classification method according to claim 3, characterized in that: The matching of the preset classification field information with the field information to be responded to includes: Combining the preset classification field information to obtain a preset classification field information set; Obtaining regular expression rule information, and building matching rules for the preset classification field information set according to the regular expression rule information to generate a matching regular expression; The field information to be responded to is matched according to the matching regular expression.

5. The network traffic classification method according to claim 1, characterized in that: The preset classification rule is a feature matching rule; The classifying the network traffic to be responded to according to the preset classification rules in the kernel layer to obtain the classification result includes: The network traffic to be responded to is classified according to the feature matching rules in the kernel layer to obtain a classification result.

6. The network traffic classification method according to claim 5, characterized in that: The classifying the network traffic to be responded to by the feature matching rule in the kernel layer to obtain the classification result includes: Parsing the network traffic to be responded to, and obtaining parsed data to be responded to; Obtaining corresponding response characteristic information according to the data to be responded to; The network traffic to be responded to is classified according to the response characteristic information to obtain a classification result.

7. The network traffic classification method according to claim 1, characterized in that: The preset classification rule is a link matching rule; The classifying the network traffic to be responded to according to the preset classification rules in the kernel layer to obtain the classification result includes: The network traffic to be responded to is classified according to the link matching rule in the kernel layer to obtain a classification result.

8. The network traffic classification method according to claim 7, wherein the classifying the network traffic to be responded to by the link matching rule in the kernel layer to obtain the classification result comprises: Parsing the network traffic to be responded to obtain parsed link information; Extracting source address information of the request information in the link information and destination address information of the request information to be responded to in the link information; Determine a preset address type according to the source address information, judge whether the destination address information belongs to the preset address type, and obtain a judgment result; A classification result is obtained according to the judgment result.

9. The network traffic classification method according to any one of claims 1 to 8, wherein when the application layer receives the network traffic to be responded to, the network traffic to be responded to is transmitted to the kernel layer, comprising: When receiving the network traffic to be responded to at the application layer, performing network traffic attribute analysis on the network traffic to be responded to obtain a traffic attribute result; Obtaining a corresponding communication protocol type according to the traffic attribute result; When the communication protocol type is a preset protocol type, reorganizing the network traffic to be responded to obtain reorganized network traffic to be responded to; The reorganized network traffic to be responded to is transmitted to the kernel layer.

10. The network traffic classification method according to claim 9, wherein when the communication protocol type is a preset protocol type, the network traffic to be responded to is reorganized to obtain the reorganized network traffic to be responded to, comprising: When the communication protocol type is a preset protocol type, counting the current length information of the network traffic to be responded to; Performing fragment identification on the network traffic to be responded to according to the current length information to obtain fragmented network traffic; Extracting reassembly number information from the network traffic of the fragment; The fragmented network traffic is reassembled according to the reassembly number information to obtain reassembled network traffic to be responded to.

11. The network traffic classification method according to claim 10, wherein the step of identifying the network traffic to be responded to in pieces according to the current length information to obtain the pieced network traffic comprises: Get the preset length threshold; Compare the current length information with the preset length threshold to determine whether the current length information reaches the preset length threshold; When the current length information reaches the preset length threshold, the network traffic to be responded to corresponding to the preset length threshold is used as the network traffic of the segment.

12. The network traffic classification method according to any one of claims 1 to 8, wherein when the application layer receives the network traffic to be responded to, the network traffic to be responded to is transmitted to the kernel layer, comprising: When the application layer receives the network traffic to be responded to, calling a preset receiving function, wherein the preset receiving function connects the application layer and the kernel layer; The network traffic to be responded to is transmitted to the kernel layer according to the preset receiving function.

13. The network traffic classification method according to claim 12, wherein when the application layer receives the network traffic to be responded to, calling the preset receiving function comprises: When receiving the network traffic to be responded to at the application layer, comparing the network traffic to be responded to with a preset protocol keyword; Obtaining the protocol type of the network traffic to be responded to according to the comparison result; The corresponding preset receiving function is called according to the protocol type of the network traffic to be responded to.

14. The network traffic classification method according to any one of claims 1 to 8, wherein the network traffic to be responded to is classified according to the preset classification rules in the kernel layer, and before obtaining the classification result, the method further comprises: Calling a preset hook function in the kernel layer to extract filtering rule information in the preset hook function; The filtering rule information is used as a preset classification rule.

15. The network traffic classification method according to claim 14, before using the filtering rule information as a preset classification rule, the method further comprises: Obtaining a virtual patch file uploaded by the application layer, and calling a patch generator according to the virtual patch file; Encapsulating the filtering rule information by the patch generator to obtain encapsulated filtering rule information; The using the filtering rule information as a preset classification rule includes: The encapsulated filtering rule information is used as a preset classification rule.

16. The network traffic classification method according to claim 15, before using the encapsulated filtering rule information as a preset classification rule, the method further comprises: Obtaining version information of the encapsulated filtering rule information and current version information corresponding to the preset classification rule in the kernel layer; Determine whether the version information of the encapsulated filtering rule information is higher than the current version information; When the version information of the encapsulated filtering rule information is higher than the current version information, the step of using the encapsulated filtering rule information as the preset classification rule is performed.

17. A network traffic classification device, characterized in that: The network traffic classification device comprises: A transmission module, configured to transmit the network traffic to be responded to to the kernel layer when the application layer receives the network traffic to be responded to; A classification module, configured to classify the network traffic to be responded to according to a preset classification rule in the kernel layer to obtain a classification result, wherein the preset classification rule is generated based on the virtual patch file uploaded by the application layer, and the preset classification rule is obtained by encapsulating the filtering rule information in the preset hook function by a patch generator; The response module is used to respond to the network traffic to be responded to by the application layer when the classification result is non-malicious traffic.

18. The network traffic classification device according to claim 17, wherein the preset classification rule is a field matching rule; The classification module is further used to classify the network traffic to be responded to according to the field matching rules in the kernel layer to obtain a classification result.

19. A network traffic classification device, characterized in that: The network traffic classification device comprises: a memory, a processor, and a network traffic classification program stored in the memory and running on the processor. When the network traffic classification program is executed by the processor, the steps of the network traffic classification method according to any one of claims 1 to 16 are implemented.

20. A storage medium, characterized in that: The storage medium stores a network traffic classification program, and when the network traffic classification program is executed by the processor, the steps of the network traffic classification method according to any one of claims 1 to 16 are implemented.

Images