A system and method for identifying traffic security features
By collecting and identifying packet security features in the cloud computing environment and linking them with virtual network control nodes, the problem of ultra-lightweight demand in cloud computing is solved, and efficient traffic security feature recognition and resource conservation are achieved.
Patent Information
- Application Number
- CN202210946970.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-08-09
- Publication Date
- 2025-01-03
- Estimated Expiration
- 2042-08-09
AI Technical Summary
The existing technology cannot achieve ultra-light packet collection and security feature recognition in a cloud computing environment. Traditional solutions rely on dedicated hardware or non-virtualized systems and cannot meet the needs of SaaS applications in cloud computing.
By collecting and identifying message security features in the cloud acquisition system and linking it with the virtual network control node, the application features and behavioral features of hyperscan are used to clean the message first, and then call the regular matching algorithm hyperscan to realize the data message traffic recognition function. Efficient scanning and label output of streams.
It realizes efficient traffic security feature recognition in a cloud computing environment, reduces resource consumption, improves identification accuracy and efficiency, and is suitable for ultra-lightweight needs.
Smart Images
Figure CN115314294B_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of cloud computing technology, and in particular to a system and method for identifying traffic security features. Background Art
[0002] With the rapid development of cloud computing technology, the network connection between virtual computing nodes has become more complex, requiring an ultra-lightweight and non-intrusive method and system for message collection and security feature identification. Traditional DPI (deep packet identification), NG-FIREWALL (next-generation firewall), IPS (intrusion prevention system), and IDS (intrusion detection system) are all involved, but traditional solutions all use dedicated hardware all-in-one machines or non-virtualized dedicated system solutions, which cannot meet the ultra-lightweight requirements and therefore cannot become a SaaS (Software-as-a-Service) application in cloud computing.
[0003] The commonly used software recognition technology in the industry is to directly send the entire data packet flow without cleaning to the regular matching algorithm hyperscan, and then generate the corresponding flow log label data after processing based on the output results. Regular matching generally adopts the flow mode, that is, the application continuously sends the data packets of the same session to the regular matching algorithm hyperscan. In this implementation method, a large number of redundant strings in the message will be sent to the regular matching algorithm hyperscan for repeated detection, and the execution efficiency is relatively low.
[0004] The patent "A method and device for secure processing and disposal of network data streams" (CN107579993B) involves a method for implementing the technology, which is applicable to a dedicated electronic device, does not have the characteristics of ultra-lightweight, and is not suitable for deployment and functional implementation in a virtualized environment within cloud computing.
[0005] Therefore, technicians in this field are committed to developing a traffic security feature identification system and method. Summary of the invention
[0006] In view of the above-mentioned defects of the prior art, the technical problem to be solved by the present invention is how to achieve ultra-lightweight message collection and security feature identification, which is suitable for deployment and completion of functions in a virtualized environment within cloud computing.
[0007] The inventor collects and identifies message security features by deploying a collection system in the cloud and reports them to the security analysis system, and then links with the virtual network control node in the cloud to finally achieve control of the network. Specifically, the inventor first cleans the original message, and sorts, associates, and queues multiple original message fragments of the same session or multiple specified sessions, and then calls the traffic identification function component that integrates the application features and behavior features of the regular matching algorithm hyperscan, scans the specified data message flow queue in sequence, stops scanning once a match is found, and outputs the label result, which includes both the application feature label and the behavior feature label.
[0008] In one embodiment of the present invention, a traffic security feature identification system is provided, comprising:
[0009] The original message collection module receives the original message, processes it to obtain the original message fragments and the corresponding original flow logs, and stores them in the shared memory;
[0010] The user-mode identification module periodically reads the original message fragments and the corresponding original flow logs from the shared memory, analyzes and processes the original message fragments according to the dynamic collection and identification rules, and generates application feature labels and behavior feature labels;
[0011] The original message collection module is deployed in the kernel space of Linux, the user state identification module is deployed in the user space of Linux, and the original message collection module and the user state identification module are communicatively connected.
[0012] Optionally, in the traffic security feature identification system of the above embodiment, the dynamic collection and identification rules include collection configuration parameters and original flow rule templates. The collection configuration parameters can be directly read by the user-state identification module, and the original flow rule template is pre-compiled to generate a flow rule template file for use by the user-state identification module.
[0013] Furthermore, in the traffic security feature identification system of the above embodiment, it also includes a feature compilation module, a built-in hyperscan compilation module component, which pre-compiles the original flow rule template, generates a flow rule template file, loads it into the user state identification module for use, and the feature compilation module and the user state identification module are communicatively connected.
[0014] Furthermore, in the traffic security feature identification system of the above embodiment, the collection configuration parameters include the virtual device unique identifier, source IP, target IP, source port, destination port, network layer protocol type, transport layer protocol type, number of packets, packet length, collection duration, application protocol type, and flow rule template ID, among which the virtual device unique identifier is a required field and the rest are optional. When there is no agreement on the collection configuration parameters, the default is to not impose restrictions on filtering and identification requirements.
[0015] Furthermore, in the traffic security feature identification system of the above embodiment, the original flow rule template uses a regular expression method to describe the original message features.
[0016] Furthermore, in the traffic security feature identification system of the above embodiment, the original message features include application features and behavior features of the original message.
[0017] Furthermore, in the traffic security feature identification system of the above embodiment, the flow rule template ID corresponds to an original flow rule template, and an original flow rule template includes an original message feature description.
[0018] Furthermore, in the traffic security feature identification system of the above-mentioned embodiment, the original message feature description includes the applicable protocol type, scanning location range, regular expression rules, feature hit method, time range of the original message feature, frequency range, interval range, occurrence order and calculation model of the original behavior feature similarity.
[0019] Furthermore, in the traffic security feature identification system of the above-mentioned embodiment, the feature compilation module loads multiple original flow rule templates in the dynamic collection and identification rules, preprocesses the feature data therein, converts them into regular expression files supported by the hyperscan compilation module, and then uses the hyperscan compilation module component to precompile the regular expression file to generate a flow rule template file.
[0020] Optionally, in the traffic security feature identification system of any of the above embodiments, the user-state identification module uses an intelligent caching function to continuously write flow feature portraits and corresponding application feature tags and behavior feature tags. When the original message fragments and the corresponding original flow logs are read, the intelligent cache is first queried, and the flow feature portraits extracted from the original flow logs are matched to output application feature tags and behavior feature tags.
[0021] Furthermore, in the traffic security feature identification system of the above embodiment, the flow feature portrait includes session start time, session end time, source IP, source port, destination IP, destination port, network layer protocol type, transport layer protocol type, application layer protocol type, some protocol fixed-length header fields, the number of data packets and the length of each data packet according to the OSI protocol layer, and behavioral feature context description.
[0022] Furthermore, in the traffic security feature identification system of the above embodiment, the user-state identification module has a built-in traffic identification function component, which identifies the original message fragments according to the dynamic collection and identification rules.
[0023] Furthermore, in the traffic security feature identification system of the above embodiment, when the flow feature cannot be matched in the intelligent cache, the traffic identification function component uses the regular matching algorithm hyperscan to match and output the application feature label and the behavior feature label at one time.
[0024] Based on any of the above embodiments, in another embodiment of the present invention, a method for identifying traffic security features is provided, comprising the following steps:
[0025] S100, preparation;
[0026] S200, original message collection, the original message collection module receives the original message, processes it to obtain the original message fragment and the corresponding original flow log, and stores them in the shared memory;
[0027] S300, original message fragment analysis and processing, the user state identification module regularly reads the original message fragment and the corresponding original flow log from the shared memory, analyzes and processes the original message fragment according to the dynamic collection and identification rules, and generates application feature labels and behavior feature labels;
[0028] S400, flow log update: the original flow log is processed by the user state identification module, and the final flow log is generated together with the application feature tag and the behavior feature tag.
[0029] Optionally, in the traffic security feature identification system of the above embodiment, the dynamic collection and identification rules include collection configuration parameters and original flow rule templates. The collection configuration parameters can be directly read by the user-state identification module, and the original flow rule template is pre-compiled to generate a flow rule template file for use by the user-state identification module.
[0030] Furthermore, in the traffic security feature identification method of the above embodiment, step S100 includes:
[0031] S110, feature compilation: the feature compilation module preprocesses the feature data in the original flow rule template, converts it into a regular expression file supported by the hyperscan compilation module, calls the hyperscan compilation module component for precompilation, and generates a flow rule template file corresponding to multiple traffic features;
[0032] S120, starting the user state identification module;
[0033] S130: Loading dynamic collection and recognition rules: The user state recognition module loads the dynamic collection and recognition rules.
[0034] Furthermore, in the traffic security feature identification method of the above embodiment, the dynamic collection and identification rules include collection configuration parameters and original flow rule templates. The collection configuration parameters can be directly read by the user-state identification module, and the original flow rule template is pre-compiled to generate a flow rule template file for use by the user-state identification module.
[0035] Furthermore, in the traffic security feature identification method of the above embodiment, the collection configuration parameters include the virtual device unique identifier, source IP, target IP, source port, destination port, network layer protocol type, transmission protocol type, number of packets, packet length, collection duration, application protocol type, and flow rule template ID, among which the virtual device unique identifier is a required field, and the rest are optional. When there is no agreement on the collection identification rules, the default is to not restrict filtering and identification requirements.
[0036] Furthermore, in the traffic security feature identification method of the above embodiment, the original flow rule template uses a regular expression method to describe the application features and behavior features of the original message.
[0037] Optionally, in the traffic security feature identification method of the above embodiment, step S300 includes:
[0038] S310, original message fragment and original flow log check, the user state identification module regularly checks the original message fragment and the corresponding original flow log in the shared memory;
[0039] S320, reading the original message fragment and the original flow log, in response to the arrival of the original message fragment and the corresponding original flow log, the user state identification module reads the original message fragment and the corresponding original flow log;
[0040] S330, the original message fragment is added to the queue, and the user state identification module adds the original message fragment to the queue according to the dynamic collection and identification rule;
[0041] S340, grouping the original message fragments. If the original message fragments and the corresponding original flow logs in the queue meet the requirements of the dynamic collection and identification rules, execute S350, otherwise return to S310 until all the original message fragments and the corresponding original flow logs required by the dynamic collection and identification rules are added to the queue, sorted, and marked as the same group of original message fragments in the queue;
[0042] S350, flow feature portrait comparison: the user state recognition module first extracts the flow feature portrait from the original flow log in the queue, compares it with the flow feature portrait in the intelligent cache, and calculates the similarity evaluation score. If the evaluation score exceeds the preset threshold, the match is successful and S380 is executed. Otherwise, S360 and S370 are executed.
[0043] S360, original message fragment scanning, the user state identification module uses the traffic identification function component to scan a group of original message fragments, outputs the scanning results, and calculates the application feature label and the behavior feature label according to the scanning results;
[0044] S370, writing the flow feature profile, the user state identification module message writes the flow feature profile and the life cycle parameters of the flow feature profile into the intelligent cache to complete the scan matching;
[0045] S380, feature tag reading: the user state identification module reads the corresponding application feature tag and behavior feature tag from the successfully matched smart cache to complete the fast matching.
[0046] Optionally, in the traffic security feature identification method of any of the above embodiments, the flow feature portrait includes session start time, session end time, source IP, source port, destination IP, destination port, network layer protocol type, transport layer protocol type, application layer protocol type, fixed-length header fields of some protocols, the number of data packets and the length of each data packet according to the OSI protocol layer, and a behavioral feature context description.
[0047] Optionally, in the traffic security feature identification method of any of the above embodiments, the life cycle parameter of the flow feature portrait is a pre-set time value. After reaching the set time value, the corresponding flow feature portrait is aged and deleted. Different life cycle parameters can be set for different application feature labels and behavior feature labels.
[0048] The present invention only needs to scan the original message fragments in the specified position range when the flow identification function component identifies the flow, avoiding full scanning. On the one hand, it reduces the resource consumption of original message collection, and also greatly reduces the resource consumption of feature recognition scanning; aggregating multiple original message fragments and flow logs together reduces the number of calls to the flow identification function component and improves the recognition accuracy; the flow feature recognition method implemented by intelligent caching and its corresponding similarity evaluation algorithm is more efficient and lightweight.
[0049] The concept, specific structure and technical effects of the present invention will be further described below in conjunction with the accompanying drawings to fully understand the purpose, characteristics and effects of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS
[0050] Figure 1 is a schematic diagram illustrating the structure of a traffic security feature identification system according to an exemplary embodiment;
[0051] Figure 2 is a flow chart illustrating a method for identifying traffic security features according to an exemplary embodiment;
[0052] Figure 3is a flow chart illustrating original message fragment analysis and processing according to an exemplary embodiment. DETAILED DESCRIPTION
[0053] The following describes several preferred embodiments of the present invention with reference to the drawings in the specification, so that the technical content is clearer and easier to understand. The present invention can be embodied in many different forms of embodiments, and the protection scope of the present invention is not limited to the embodiments mentioned in the text.
[0054] In the drawings, components with the same structure are indicated by the same numerical reference numerals, and components with similar structures or functions are indicated by similar numerical reference numerals. The size and thickness of each component shown in the drawings are arbitrarily shown, and the present invention does not limit the size and thickness of each component. In order to make the illustration clearer, the thickness of the components is schematically exaggerated in some places in the drawings.
[0055] The inventor has designed a traffic security feature recognition system, such as Figure 1 As shown, including:
[0056] The original message collection module receives the original message, processes it to obtain the original message fragments and the corresponding original flow logs, and stores them in the shared memory;
[0057] The user-state identification module periodically reads the original message fragments and the corresponding original flow logs from the shared memory, analyzes and processes the original message fragments according to the dynamic collection and identification rules, and generates application feature labels and behavior feature labels; the dynamic collection and identification rules include collection configuration parameters and original flow rule templates, the collection configuration parameters can be directly read by the user-state identification module, the original flow rule template is pre-compiled to generate a flow rule template file for use by the user-state identification module, the original flow rule template uses a regular expression method to describe the original message characteristics, the original message characteristics include the application characteristics and behavior characteristics of the original message; the collection configuration parameters include the virtual device unique identifier, source IP, target IP, source port, destination port, network layer protocol type, transport layer protocol type, number of packets, packet length, collection duration, application protocol type, flow rule template ID, among which the virtual device unique identifier is a required field, and the rest are optional. When there is no agreement on the collection configuration parameters, the default is to make no restrictions on filtering and identification requirements, among which the flow rule template ID corresponds to an original flow rule template, an original flow rule template includes an original message feature description, and the original message feature description includes applicable Protocol type, scanning location range, regular expression rules, feature hit method, time range of original message feature occurrence, frequency range, interval range, occurrence order and calculation model of original behavior feature similarity; the user-state identification module uses the intelligent cache function to continuously write flow feature portraits and corresponding application feature tags and behavior feature tags. When the original message fragment and the corresponding original flow log are read, the intelligent cache is first queried, and the application feature tags and behavior feature tags are output through the flow feature portrait matching extracted from the original flow log; the flow feature portrait includes session start time, session end time, source IP, source port, destination IP, destination port, network layer protocol type, transport layer protocol type, application layer protocol type, fixed-length header fields of some protocols, number of data packets and length of each data packet according to OSI protocol layering, and behavior feature context description; the user-state identification module has a built-in traffic identification function component to identify the original message fragments according to the dynamic collection and identification rules. When the flow feature cannot be matched in the intelligent cache, the traffic identification function component uses the regular matching algorithm hyperscan to match and output the application feature tag and behavior feature tag at one time;
[0058] The feature compilation module has a built-in hyperscan compilation module component, which precompiles the original flow rule template to generate a flow rule template file, which is loaded into the user-state identification module for use. The feature compilation module loads multiple original flow rule templates in the dynamic acquisition identification rule, preprocesses the feature data therein, and converts them into regular expression files supported by the hyperscan compilation module. The regular expression file is then precompiled using the hyperscan compilation module component to generate a flow rule template file; the feature compilation module is connected to the user-state identification module in communication;
[0059] The original message collection module is deployed in the kernel space of Linux, the user state identification module is deployed in the user space of Linux, and the original message collection module and the user state identification module are communicatively connected.
[0060] Based on the above embodiments, the inventor provides a method for identifying traffic security features, such as Figure 2 As shown, the following steps are included:
[0061] S100, preparation work, including:
[0062] S110, feature compilation, the feature compilation module preprocesses the feature data in the original flow rule template, converts it into a regular expression file supported by the hyperscan compilation module, calls the hyperscan compilation module component for precompilation, and generates multiple flow rules corresponding to the flow features.
[0063] Rule template files;
[0064] S120, starting the user state identification module;
[0065] S130. Load dynamic collection and identification rules. The user-state identification module loads dynamic collection and identification rules. The dynamic collection and identification rules include collection configuration parameters and original flow rule templates. The collection configuration parameters can be directly read by the user-state identification module. The original flow rule template is pre-compiled to generate a flow rule template file for use by the user-state identification module; the collection configuration parameters include the virtual device unique identifier, source IP, target IP, source port, destination port, network layer protocol type, transmission protocol type, number of packets, packet length, collection duration, application protocol type, and flow rule template ID, among which the virtual device unique identifier is a required field, and the rest are optional. When there is no agreement on the collection and identification rules, the default is to not restrict filtering and identification requirements; the original flow rule template uses regular expressions to describe the application characteristics and behavior characteristics of the original message.
[0066] S200, original message collection, the original message collection module receives the original message, processes it to obtain the original message fragment and the corresponding original flow log, and stores them in the shared memory;
[0067] S300, original message fragment analysis and processing, the user state identification module periodically reads the original message fragment and the corresponding original flow log from the shared memory, analyzes and processes the original message fragment according to the dynamic collection and identification rules, and generates application feature tags and behavior feature tags; Figure 3 As shown, specifically including:
[0068] S310, original message fragment and original flow log inspection, user state identification module regular inspection
[0069] Check the original message fragments and corresponding original flow logs in the shared memory;
[0070] S320, reading the original message fragment and the original flow log, in response to the arrival of the original message fragment and the corresponding original flow log, the user state identification module reads the original message fragment and the corresponding original flow log;
[0071] S330, the original message fragment is added to the queue, and the user state recognition module recognizes the dynamic collection
[0072] According to the identification rule, the original message fragment is added to the queue;
[0073] S340, grouping the original message fragments. If the original message fragments and the corresponding original flow logs in the queue meet the requirements of the dynamic collection and identification rules, execute S350, otherwise return to S310 until all the original message fragments and the corresponding original flow logs required by the dynamic collection and identification rules are added to the queue, sorted, and marked as the same group of original message fragments in the queue;
[0074] S350, flow feature portrait comparison, the flow feature portrait includes session start time, session end time, source IP, source port, destination IP, destination port, network layer protocol type, transport layer protocol type, application layer protocol type, fixed-length header fields of some protocols, number of data packets and length of each data packet according to OSI protocol layering, and behavior feature context description; the user state identification module first extracts the flow feature portrait from the original flow log in the queue, compares it with the flow feature portrait in the intelligent cache, and calculates the similarity evaluation score. If the evaluation score exceeds the preset threshold, the match is successful and S380 is executed, otherwise S360 and S370 are executed;
[0075] S360, original message fragment scanning, the user state identification module uses the traffic identification function component to scan a group of original message fragments, outputs the scanning results, and calculates based on the scanning results
[0076] Output application feature labels and behavior feature labels;
[0077] S370, flow feature portrait writing, the user state identification module message writes the flow feature portrait and the life cycle parameters of the flow feature portrait into the intelligent cache to complete the scan matching; the life cycle parameter of the flow feature portrait is a pre-set time value. After reaching the set time value, the corresponding flow feature portrait is aged and deleted.
[0078] Behavioral feature tags, allowing different life cycle parameters to be set;
[0079] S380, feature tag reading: the user state identification module reads the corresponding application feature tag and behavior feature tag from the successfully matched smart cache to complete the fast matching.
[0080] S400, flow log update: the original flow log is processed by the user state identification module, and the final flow log is generated together with the application feature tag and the behavior feature tag.
[0081] The preferred specific embodiments of the present invention are described in detail above. It should be understood that a person skilled in the art can make many modifications and changes based on the concept of the present invention without creative work. Therefore, any technical solution that can be obtained by a person skilled in the art through logical analysis, reasoning or limited experiments based on the concept of the present invention on the basis of the prior art should be within the scope of protection determined by the claims.
Claims
1. A traffic security feature identification system, characterized in that: include: The original message collection module receives the original message, processes it to obtain the original message fragments and the corresponding original flow logs, and stores them in the shared memory; A user-state identification module, which periodically reads the original message fragments and the corresponding original flow logs from the shared memory, analyzes and processes the original message fragments according to dynamic collection and identification rules, and generates application feature labels and behavior feature labels; The original message collection module is deployed in the Linux kernel space, the user state identification module is deployed in the Linux user space, and the original message collection module and the user state identification module are communicatively connected; the processing method includes: S310, original message fragment and original flow log check, the user state identification module regularly checks the original message fragment and the corresponding original flow log in the shared memory; S320, reading the original message fragment and the original flow log, in response to the arrival of the original message fragment and the corresponding original flow log, the user state identification module reads the original message fragment and the corresponding original flow log; S330, the original message fragment is added to the queue, and the user state identification module adds the original message fragment to the queue according to the dynamic collection and identification rule; S340, grouping the original message fragments. If the original message fragments and the corresponding original flow logs in the queue meet the requirements of the dynamic collection and identification rule, execute S350, otherwise return to S310 until all the original message fragments and the corresponding original flow logs required by the dynamic collection and identification rule are added to the queue, sorted, and marked as the same group of original message fragments in the queue; S350, flow feature portrait comparison, the user state identification module first extracts the flow feature portrait from the original flow log in the queue, compares it with the flow feature portrait in the intelligent cache, and calculates the similarity evaluation score. If the evaluation score exceeds a preset threshold, the match is successful and S380 is executed, otherwise S360 and S370 are executed; S360, scanning the original message fragments, the user state identification module uses the traffic identification function component to scan a group of original message fragments, outputs the scanning results, and calculates the application feature label and the behavior feature label according to the scanning results; S370, writing the flow feature portrait, the user state identification module message writes the flow feature portrait and the life cycle parameters of the flow feature portrait into the intelligent cache to complete the scan matching; S380, feature tag reading: the user state identification module reads out the corresponding application feature tag and behavior feature tag from the successfully matched smart cache to complete fast matching.
2. The traffic security feature recognition system according to claim 1, characterized in that: The dynamic collection and identification rules include collection configuration parameters and original flow rule templates. The collection configuration parameters can be directly read by the user-state identification module. The original flow rule template is pre-compiled to generate a flow rule template file for use by the user-state identification module.
3. The traffic security feature recognition system according to claim 2, characterized in that: The traffic security feature identification system also includes a feature compilation module with a built-in hyperscan compilation module component, which pre-compiles the original flow rule template, generates the flow rule template file, and loads it into the user-state identification module for use. The feature compilation module and the user-state identification module are communicatively connected.
4. The traffic security feature recognition system according to claim 3, characterized in that: The collection configuration parameters include the unique identifier of the virtual device, source IP, target IP, source port, destination port, network layer protocol type, transport layer protocol type, number of packets, packet length, collection duration, application protocol type, and flow rule template ID. The unique identifier of the virtual device is a required field, and the rest are optional. When there is no agreement on the collection configuration parameters, the default is to not restrict filtering and identification requirements.
5. The traffic security feature recognition system according to claim 4, characterized in that: The user-state identification module uses an intelligent caching function to continuously write flow feature portraits and corresponding application feature tags and behavior feature tags. When the original message fragment and the corresponding original flow log are read, the intelligent cache is first queried, and the flow feature portraits extracted from the original flow log are matched and output with application feature tags and behavior feature tags.
6. A method for identifying traffic security features, using the traffic security feature identification system as claimed in claim 5, characterized in that: The steps include: S100, preparation; S200, original message collection, the original message collection module receives the original message, processes to obtain the original message fragment and the corresponding original flow log, and stores them in the shared memory; S300, analyzing and processing the original message fragments, the user-state identification module periodically reads the original message fragments and the corresponding original flow logs from the shared memory, analyzes and processes the original message fragments according to the dynamic collection and identification rules, and generates application feature labels and behavior feature labels; specifically including: S310, original message fragment and original flow log check, the user state identification module regularly checks the original message fragment and the corresponding original flow log in the shared memory; S320, reading the original message fragment and the original flow log, in response to the arrival of the original message fragment and the corresponding original flow log, the user state identification module reads the original message fragment and the corresponding original flow log; S330, the original message fragment is added to the queue, and the user state identification module adds the original message fragment to the queue according to the dynamic collection and identification rule; S340, grouping the original message fragments. If the original message fragments and the corresponding original flow logs in the queue meet the requirements of the dynamic collection and identification rule, execute S350, otherwise return to S310 until all the original message fragments and the corresponding original flow logs required by the dynamic collection and identification rule are added to the queue, sorted, and marked as the same group of original message fragments in the queue; S350, flow feature portrait comparison, the user state identification module first extracts the flow feature portrait from the original flow log in the queue, compares it with the flow feature portrait in the intelligent cache, and calculates the similarity evaluation score. If the evaluation score exceeds a preset threshold, the match is successful and S380 is executed, otherwise S360 and S370 are executed; S360, scanning the original message fragments, the user state identification module uses the traffic identification function component to scan a group of original message fragments, outputs the scanning results, and calculates the application feature label and the behavior feature label according to the scanning results; S370, writing the flow feature portrait, the user state identification module message writes the flow feature portrait and the life cycle parameters of the flow feature portrait into the intelligent cache to complete the scan matching; S380, feature tag reading, the user state identification module reads the corresponding application feature tag and behavior feature tag from the successfully matched smart cache to complete fast matching; S400, flow log update, the original flow log is processed by the user state identification module, and together with the application feature tag and the behavior feature tag, a final flow log is generated.
7. The method for identifying traffic security features according to claim 6, characterized in that: The step S100 includes: S110, feature compilation, the feature compilation module preprocesses the feature data in the original flow rule template, converts it into a regular expression file supported by the hyperscan compilation module, calls the hyperscan compilation module component for precompilation, and generates a flow rule template file corresponding to multiple traffic features; S120, starting the user state identification module; S130: Loading dynamic collection and identification rules: the user state identification module loads the dynamic collection and identification rules.
8. The method for identifying traffic security features according to claim 7, characterized in that: The flow feature portrait includes session start time, session end time, source IP, source port, destination IP, destination port, network layer protocol type, transport layer protocol type, application layer protocol type, fixed-length header fields of some protocols, number of data packets and length of each data packet according to OSI protocol layering, and behavioral feature context description.
9. The method for identifying traffic security features according to claim 8, characterized in that: The life cycle parameter of the flow feature portrait is a preset time value. After reaching the set time value, the corresponding flow feature portrait is aged and deleted. Different life cycle parameters can be set for different application feature labels and behavior feature labels.