A custom encryption protocol traffic processing method, device and electronic device

Abstract

The present invention provides a method, device and electronic device for processing custom encryption protocol traffic. The method first performs communication protocol filtering on an acquired first network data packet to obtain a second network data packet using an unknown communication protocol, then calculates the payload bit frequency and information entropy of the second network data packet, and uses the payload bit frequency and information entropy of the second network data packet to judge the communication protocol used by each data stream in the second network data packet. In this way, in the process of identifying traffic using an unknown protocol or suspicious communication traffic in a network environment, the method can effectively identify traffic using a custom encryption communication protocol or suspicious encryption communication traffic in a network environment based on the highly random distribution of payload byte values ​​of the custom encryption communication protocol and using the calculated payload bit frequency and information entropy of the traffic using an unknown protocol or suspicious communication traffic.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method, device and electronic device for processing custom encryption protocol traffic. Background Art

[0002] At present, more and more encrypted services are used for communication on the Internet. Various encrypted network protocols, such as Transport Layer Security (TLS) and Secure Shell (SSH), provide better security for network communication. However, when some applications (social communication software, etc.) or malicious programs (botnets, Trojans, APT, etc.) are creating their own network functions, the known network protocols cannot meet their needs in terms of security and scalability, so they need to design and implement custom encryption protocols. How to identify traffic using custom encryption protocols is an urgent problem to be solved. Summary of the invention

[0003] To solve the above problems, the purpose of the embodiments of the present invention is to provide a method, device and electronic device for processing custom encryption protocol traffic.

[0004] In a first aspect, an embodiment of the present invention provides a method for processing traffic of a custom encryption protocol, including:

[0005] Acquire a first network data packet, and perform communication protocol filtering on the acquired first network data packet to obtain a second network data packet using an unknown communication protocol;

[0006] According to the network quintuple carried in the second network data packet, the second network data packet is divided into different data streams;

[0007] Processing the network data packets in each of the different data streams to obtain a payload character string of each of the data streams;

[0008] Based on the obtained payload character string of each of the data flows, respectively calculating the payload bit frequency and information entropy of each of the data flows in the second network data packet;

[0009] The communication protocol used by each data stream in the second network data packet is determined based on the calculated payload bit frequency and information entropy of each data stream.

[0010] In a second aspect, an embodiment of the present invention further provides a custom encryption protocol traffic processing device, including:

[0011] An acquisition module, used for acquiring a first network data packet, performing communication protocol filtering on the acquired first network data packet, and obtaining a second network data packet using an unknown communication protocol;

[0012] A division module, used for dividing the second network data packet into different data streams according to the network quintuple carried in the second network data packet;

[0013] A processing module, used for processing the network data packets in each of the different data streams to obtain a payload string of each of the data streams;

[0014] A calculation module, configured to calculate the payload bit frequency and information entropy of each of the data flows in the second network data packet based on the obtained payload character string of each of the data flows;

[0015] A determination module is used to determine the communication protocol used by each data flow in the second network data packet based on the calculated payload bit frequency and information entropy of each data flow.

[0016] In a third aspect, an embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the method described in the first aspect are executed.

[0017] In a fourth aspect, an embodiment of the present invention further provides an electronic device, comprising a memory, a processor and one or more programs, wherein the one or more programs are stored in the memory and configured so that the processor executes the steps of the method described in the first aspect above.

[0018] In the scheme provided by the first aspect to the fourth aspect of the embodiment of the present invention, the communication protocol is first filtered for the acquired first network data packet to obtain a second network data packet using an unknown communication protocol, and then the payload bit frequency and information entropy of the second network data packet are calculated, and the payload bit frequency and information entropy of the second network data packet are used to judge the communication protocol used by each data flow in the second network data packet. In this way, in the process of identifying traffic using an unknown protocol or suspicious communication traffic in a network environment, according to the characteristic that the custom encryption communication protocol has a high degree of randomness, the calculated payload bit frequency and information entropy of the traffic using an unknown protocol or suspicious communication traffic can be used to effectively identify the traffic using a custom encryption communication protocol or suspicious communication traffic in the network environment, with the characteristics of high recognition accuracy and low false alarm rate.

[0019] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0021] Figure 1 A flow chart of a method for processing custom encryption protocol traffic provided by Embodiment 1 of the present invention is shown;

[0022] Figure 2 It shows a schematic diagram of the structure of a custom encryption protocol traffic processing device provided by 2 in an embodiment of the present invention;

[0023] Figure 3 A schematic structural diagram of an electronic device provided by Embodiment 3 of the present invention is shown. DETAILED DESCRIPTION

[0024] In the description of the present invention, it should be understood that the terms "center", "longitudinal", "lateral", "length", "width", "thickness", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", "clockwise", "counterclockwise" and the like indicate orientations or positional relationships based on the orientations or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the referred device or element must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be understood as limiting the present invention.

[0025] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the present invention, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0026] In the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", "connected", "fixed" and the like should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be an indirect connection through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0027] With the popularity of encryption services and the improvement of security awareness, more and more people use encryption services for communication on the Internet. Various encryption network protocols, such as TLS and SSH, provide better security for network communication. However, when some application (social communication software, etc.) or malicious program (botnet, Trojan, APT, etc.) makers implement their own network functions, the known network protocols cannot meet their needs in terms of security and scalability, so they need to design and implement custom encryption protocols. Custom encryption protocols refer to network protocols designed and produced by network applications or malicious program authors, and their communication traffic is protected by standard encryption algorithms or self-designed encryption algorithms. Using custom encryption protocols, data communication is safer. If you want to analyze the vulnerabilities of custom encryption protocols, you must first decipher the custom encryption protocols, and you cannot exploit the vulnerabilities of common protocols. Moreover, custom encryption protocols have better scalability and can be expanded according to your own needs and development.

[0028] The technical problem to be solved by this application is to propose a custom encryption protocol identification method based on randomness judgment, which can identify the traffic of these custom encryption protocol communications from real network traffic, and provide a basis for security analysts to discover and analyze the communication traffic of malicious programs that use custom encryption protocols.

[0029] Based on this, the following embodiments of the present application propose a method, device and electronic device for processing custom encryption protocol traffic, which first performs communication protocol filtering on the acquired first network data packet to obtain a second network data packet using an unknown communication protocol, and then calculates the payload bit frequency and information entropy of the second network data packet, and uses the payload bit frequency and information entropy of the second network data packet to judge the communication protocol used by each data flow in the second network data packet. In this way, in the process of identifying traffic using an unknown protocol or suspicious communication traffic in a network environment, according to the characteristic that the custom encryption communication protocol has a high degree of randomness, the calculated payload bit frequency and information entropy of the traffic using an unknown protocol or suspicious communication traffic can be used to effectively identify traffic using a custom encryption communication protocol or suspicious communication traffic in the network environment, and the method has the characteristics of high recognition accuracy and low false alarm rate.

[0030] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0031] Example 1

[0032] The execution subject of a custom encryption protocol traffic processing method proposed in the embodiments of this book is a server.

[0033] See also Figure 1The flowchart of a method for processing a custom encryption protocol traffic is shown in FIG. 1 . This embodiment proposes a method for processing a custom encryption protocol traffic, which specifically includes the following steps:

[0034] Step 100: Acquire a first network data packet, and perform communication protocol filtering on the acquired first network data packet to obtain a second network data packet using an unknown communication protocol.

[0035] In the above step 100, the server obtains data packets in the network traffic by real-time monitoring of the network card or using tools such as Wireshark, tcpdump, etc., and filters out network traffic using TCP protocol and UDP protocol from the obtained network traffic data packets as the first network data packet.

[0036] In the process of performing communication protocol filtering on the first network data packet obtained to obtain a second network data packet using an unknown communication protocol, the data packets using the common plaintext transmission protocols defined in the RFC standard in the first network data packet are identified and filtered out, such as: HTTP, FTP, DNS, SMTP, etc.; then the data packets using the common encryption protocols defined in the RFC standard are identified and filtered out, such as: SSL / TLS, SSH, RDP, DTLS, QUIC, etc., wherein the method for identifying and filtering the communication protocol can adopt a traditional network protocol identification and filtering method, including but not limited to: port identification, feature value identification, behavior identification, etc. The specific process is the existing technology and will not be repeated here.

[0037] Step 102: Divide the second network data packet into different data streams according to the network quintuple carried in the second network data packet.

[0038] In the above step 102, the network quintuple includes: source IP address, source port identifier, destination IP address, destination port identifier, and communication protocol (such as TCP protocol, UDP protocol, etc.).

[0039] The second network data carrying the same network quintuple is divided into the same data stream, thereby dividing the second network data packets into different data streams.

[0040] Step 104: Process the network data packets in each of the different data flows to obtain a payload character string of each of the data flows.

[0041] In the above step 104, in order to obtain the payload character string of each data stream, the above step 104 may perform the following steps (1) to (2):

[0042] (1) removing the Ethernet protocol header, IP protocol header, TCP protocol or UDP protocol header in the network data packets in each of the data streams to obtain the payload portion of the network data packets in each of the data streams;

[0043] (2) According to the sequence of the sending time of the network data packets in each of the data streams, the payload parts of the network data packets in each of the data streams are concatenated to obtain the payload character strings of each of the data streams.

[0044] In the above step (1), the Ethernet protocol header, IP protocol header, TCP protocol or UDP protocol header in the network data packet in each of the data streams are removed in turn to obtain the specific process of the payload part of the network data packet in each of the data streams, which is prior art and will not be repeated here.

[0045] In one embodiment, if the payload length of each network data packet in each of the data streams exceeds 16 bytes, the first 16 bytes are removed. According to statistical data, most custom encryption protocols use at most the first 16 bytes as a custom protocol header. Removing the custom protocol header can avoid the interference of the custom protocol header in judging the randomness of the payload.

[0046] The customized protocol header is the above-mentioned Ethernet protocol header, IP protocol header, and TCP protocol or UDP protocol header.

[0047] In the above step (2), the time when the network data packet is sent is recorded in the timestamp field carried in the packet header of each network data packet.

[0048] In order to obtain the payload character string of each of the data streams, the server can perform the following specific steps: obtain the timestamp field carried in the header of each network data packet in each of the data streams, determine the sending time of each network data packet in each of the data streams according to the timestamp field carried in the header of each network data packet, and then splice the payload parts of the network data packets in each of the data streams according to the chronological order of the sending time of the network data packets in each of the data streams to obtain the payload character string of each of the data streams.

[0049] The obtained payload character string of each data stream is a character string composed of binary numbers.

[0050] In one embodiment, when the length of the payload string of a data stream is greater than 128 bytes, the portion of the payload string of the data stream greater than 128 bytes exceeding 128 bytes is truncated, that is, the maximum length of the payload string of the data stream is 128 bytes.

[0051] Step 106: Based on the obtained payload character string of each data stream, respectively calculate the payload bit frequency and information entropy of each data stream in the second network data packet.

[0052] Here, based on the obtained payload character string of each data stream, calculating the payload bit frequency of each data stream in the second network data packet includes the following steps (10) to (11):

[0053] (10) counting the number of 1s and the number of 0s in the payload character string of each of the data flows respectively;

[0054] (11) The payload bit frequency of each of the data flows in the second network data packet is calculated using the following formula 1:

[0055]

[0056] Wherein, t represents the payload bit frequency of each of the data streams; N0 represents the number of 0s in the payload string of each of the data streams; N1 represents the number of 1s in the payload string of each of the data streams; P0 and are all constants.

[0057] In the above step (11), P0 represents the theoretical probability of 0 appearing in the payload string of each data stream, which can be set to 0.5.

[0058] akin, The theoretical probability of 1 appearing in the payload character string of each data stream may be set to 0.5.

[0059] When the calculated payload bit frequency approaches 0, it means that the randomness of the payload string of the data stream is stronger. The stronger the randomness of the payload string of the data stream, the higher the possibility that the communication protocol used by the data stream is a custom encryption protocol.

[0060] After calculating the payload bit frequency of each of the data flows in the second network data packet, the following steps (20) to (23) may be continued:

[0061] (20) counting the number of bytes of the payload character string of each of the data flows;

[0062] (21) respectively counting the number of occurrences of each byte value in the payload string of each of the data flows;

[0063] (22) The occurrence probability of each byte value in the payload string of each data stream is calculated by the following formula 2:

[0064]

[0065] Among them, P(xi ) represents the probability of occurrence of each byte value in the payload string of each of the data streams; y i represents the number of occurrences of each byte value in the payload string of each of the data streams; z represents the number of bytes in the payload string of each of the data streams;

[0066] (23) Calculate the information entropy of each of the data flows in the second network data packet using the following formula 3:

[0067]

[0068] Wherein, H(x) represents the information entropy of each of the data flows in the second network data packet; and n is 256.

[0069] In the above step (20), those skilled in the art know that one byte includes 8 bits. Then, based on the fact that one byte includes 8 bits, the server can count the number of bytes of the payload string of each data stream.

[0070] In the above step (21), those skilled in the art will know that the value range of a byte is between 0 and 255, so the server can first calculate the value of each byte in the payload string of each of the data streams, and then count the value of each byte, and then count the number of occurrences of each byte value in the payload string of each data stream.

[0071] For example, a payload character string of a data stream includes 28 bytes, wherein the values ​​of the 3rd byte, the 12th byte, and the 26th byte are 22.

[0072] Then, for the payload string of the data stream, the number of occurrences of the value 22 is 3.

[0073] After counting the number of occurrences of each byte value in the payload string of each data stream respectively through the above step (21), step (22) can be continued to calculate the occurrence probability of each byte value in the payload string of each data stream.

[0074] In the above step (22), the value of each byte is any value between 0 and 255. i Represents the i-th possible value of a single byte in a string, that is, i is any value between 0 and 255.

[0075] When i=22, the value 22 (x 22 ), continue to explain according to the example of the above data stream, it can be determined that when the payload string of a data stream includes 28 bytes, z=28; y22 Indicates the number of occurrences of each byte value 22 in the payload string of a data stream, that is: y 22 =3. Then, P(x 22 ):

[0076]

[0077] Through the above process of calculating the payload bit frequency and information entropy of each data stream in the second network data packet, it can be determined that: by calculating the payload bit frequency and information entropy of a payload string of up to 128 bytes using the TCP protocol / UDP protocol, two simple formulas are used to calculate the payload bit frequency and information entropy respectively, so that the payload bit frequency and information entropy of each data stream in the second network data packet can be obtained very quickly, which can save resource overhead during real-time detection calculations, greatly improve the judgment efficiency, and enable this technology to be applied in a real network environment with high-speed transmission.

[0078] After the payload bit frequency and information entropy of each of the data flows are calculated, the following step 108 may be performed to determine the communication protocol used by each of the data flows in the second network data packet.

[0079] Step 108: Determine the communication protocol used by each data flow in the second network data packet based on the calculated payload bit frequency and information entropy of each data flow.

[0080] In this embodiment, the communication protocol used by each data stream in the second network data packet includes: a custom encryption protocol and an unknown non-encryption protocol.

[0081] Specifically, the communication protocol used by each data flow in the second network data packet may be determined by the following steps:

[0082] When the payload bit frequency of a data stream among the calculated payload bit frequencies of each of the data streams is less than or equal to the frequency threshold and the information entropy is greater than or equal to the information entropy threshold, it is determined that the communication protocol used by the data stream having the payload bit frequency less than or equal to the frequency threshold and the information entropy greater than or equal to the information entropy threshold is a custom encryption protocol.

[0083] The frequency threshold is a preset value and is cached in the server.

[0084] In one embodiment, the value of the frequency threshold may be set to a t value of 3 when the probability of conforming to the normal distribution is equal to 95%.

[0085] The process of taking the value of the information entropy threshold includes: using a random number generator to simulate random byte sequences of length n bytes (n ranges from 16 to 128), 5000 times each (for example: 5000 times when n=16, 5000 times when n=17... 5000 times when n=128), and respectively calculating the maximum likelihood estimate of the n-byte information entropy value (calculated once for each length from 16 to 128), and the information entropy standard deviation for 5000 sample sets of n bytes (calculated once for each length from 16 to 128). Then, the maximum likelihood estimate minus three to five times the standard deviation can be used as the information entropy threshold. After the information entropy threshold is calculated, the calculated information entropy threshold is cached in the server.

[0086] When the calculated payload bit frequency of the data streams has a payload bit frequency greater than the frequency threshold or the information entropy is less than the information entropy threshold, the server determines that the data stream in the second network data packet uses an unknown non-encrypted protocol.

[0087] In one embodiment, less than the information entropy threshold means less than the information entropy threshold of the byte length corresponding to the length of each data stream payload string, that is, when judging the information entropy, the information entropy thresholds of different data stream payload string lengths are different.

[0088] In summary, this embodiment proposes a method for processing custom encryption protocol traffic, which first performs communication protocol filtering on the acquired first network data packet to obtain a second network data packet using an unknown communication protocol, and then calculates the payload bit frequency and information entropy of the second network data packet, and uses the payload bit frequency and information entropy of the second network data packet to judge the communication protocol used by each data flow in the second network data packet. In this way, in the process of identifying traffic using an unknown protocol or suspicious communication traffic in a network environment, according to the characteristic that the custom encryption communication protocol has a high degree of randomness, the calculated payload bit frequency and information entropy of the traffic using an unknown protocol or suspicious communication traffic can be used to effectively identify traffic using a custom encryption communication protocol or suspicious communication traffic in the network environment, and the method has the characteristics of high recognition accuracy and low false alarm rate.

[0089] Example 2

[0090] This embodiment proposes a custom encryption protocol traffic processing device, which is used to execute the custom encryption protocol traffic processing method proposed in the above embodiment 1.

[0091] See also Figure 2 The structure diagram of a custom encryption protocol traffic processing device shown in the figure, a custom encryption protocol traffic processing device proposed in this embodiment includes:

[0092] The acquisition module 200 is used to acquire a first network data packet, and filter the acquired first network data packet by a communication protocol to obtain a second network data packet using an unknown communication protocol;

[0093] A division module 202, configured to divide the second network data packet into different data flows according to the network quintuple carried in the second network data packet;

[0094] The processing module 204 is used to process the network data packets in each of the different data flows to obtain the payload character string of each of the data flows;

[0095] A calculation module 206, configured to calculate the payload bit frequency and information entropy of each of the data flows in the second network data packet based on the obtained payload character string of each of the data flows;

[0096] The determination module 208 is used to determine the communication protocol used by each data flow in the second network data packet according to the calculated payload bit frequency and information entropy of each data flow.

[0097] Specifically, the processing module 204 is specifically used to:

[0098] Removing the Ethernet protocol header, IP protocol header, TCP protocol or UDP protocol header in the network data packets in each of the data streams to obtain the payload portion of the network data packets in each of the data streams;

[0099] According to the sequence of the sending time of the network data packets in each of the data streams, the payload parts of the network data packets in each of the data streams are concatenated to obtain the payload character strings of each of the data streams.

[0100] Specifically, the calculation module 206 is used to calculate the payload bit frequency of each of the data flows in the second network data packet based on the obtained payload character string of each of the data flows, including:

[0101] Counting the number of 1s and the number of 0s in the payload character string of each of the data flows respectively;

[0102] The payload bit frequency of each of the data flows in the second network data packet is calculated using the following formula:

[0103]

[0104] Wherein, t represents the payload bit frequency of each of the data streams; N0 represents the number of 0s in the payload string of each of the data streams; N1 represents the number of 1s in the payload string of each of the data streams; P0 and are all constants.

[0105] In summary, this embodiment proposes a custom encryption protocol traffic processing device, which first performs communication protocol filtering on the acquired first network data packet to obtain a second network data packet using an unknown communication protocol, and then calculates the payload bit frequency and information entropy of the second network data packet, and uses the payload bit frequency and information entropy of the second network data packet to judge the communication protocol used by each data flow in the second network data packet. In this way, in the process of identifying traffic using an unknown protocol or suspicious communication traffic in a network environment, according to the characteristic of a high randomness of the custom encryption communication protocol, the calculated payload bit frequency and information entropy of the traffic using an unknown protocol or suspicious communication traffic can be used to effectively identify traffic using a custom encryption communication protocol or suspicious communication traffic in the network environment, and the device has the characteristics of high recognition accuracy and low false alarm rate.

[0106] Example 3

[0107] This embodiment provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the method for processing user-defined encryption protocol traffic described in the above embodiment 1 are executed. The specific implementation can be found in method embodiment 1, which will not be described in detail here.

[0108] In addition, see Figure 3 The structural diagram of an electronic device shown in FIG. 1 is a schematic diagram of a structure of an electronic device. This embodiment further provides an electronic device, which includes a bus 51 , a processor 52 , a transceiver 53 , a bus interface 54 , a memory 55 and a user interface 56 . The electronic device includes a memory 55 .

[0109] In this embodiment, the electronic device further includes: one or more programs stored in the memory 55 and executable on the processor 52, and configured to be executed by the processor to perform the following steps (1) to (5):

[0110] (1) obtaining a first network data packet, and performing communication protocol filtering on the obtained first network data packet to obtain a second network data packet using an unknown communication protocol;

[0111] (2) dividing the second network data packet into different data flows according to the network quintuple carried in the second network data packet;

[0112] (3) processing the network data packets in each of the different data streams to obtain a payload string of each of the data streams;

[0113] (4) based on the obtained payload character string of each of the data flows, respectively calculating the payload bit frequency and information entropy of each of the data flows in the second network data packet;

[0114] (5) Determine the communication protocol used by each data flow in the second network data packet based on the calculated payload bit frequency and information entropy of each data flow.

[0115] The transceiver 53 is used to receive and send data under the control of the processor 52.

[0116] Among them, the bus architecture (represented by bus 51), bus 51 can include any number of interconnected buses and bridges, and bus 51 links various circuits including one or more processors represented by processor 52 and memory represented by memory 55. Bus 51 can also link various other circuits such as peripherals, voltage regulators, and power management circuits together, which are all well known in the art, so this embodiment will not be further described. Bus interface 54 provides an interface between bus 51 and transceiver 53. Transceiver 53 can be one element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices on a transmission medium. For example: transceiver 53 receives external data from other devices. Transceiver 53 is used to send data processed by processor 52 to other devices. Depending on the nature of the computing system, a user interface 56, such as a keypad, display, speaker, microphone, joystick, can also be provided.

[0117] The processor 52 is responsible for managing the bus 51 and general processing, such as running a general operating system as mentioned above, while the memory 55 can be used to store data used by the processor 52 when performing operations.

[0118] Optionally, the processor 52 may be, but is not limited to: a central processing unit, a single-chip microcomputer, a microprocessor or a programmable logic device.

[0119] It can be understood that the memory 55 in the embodiment of the present invention can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct RAM bus random access memory (DRRAM). The memory 55 of the system and method described in the present embodiment is intended to include, but is not limited to, these and any other suitable types of memory.

[0120] In some implementations, the memory 55 stores the following elements, executable modules or data structures, or a subset thereof, or an extended set thereof: an operating system 551 and application programs 552 .

[0121] The operating system 551 includes various system programs, such as a framework layer, a core library layer, a driver layer, etc., which are used to implement various basic services and process hardware-based tasks. The application 552 includes various application programs, such as a media player (Media Player), a browser (Browser), etc., which are used to implement various application services. The program for implementing the method of the embodiment of the present invention can be included in the application 552.

[0122] In summary, this embodiment proposes a computer-readable storage medium and an electronic device, which first performs communication protocol filtering on the acquired first network data packet to obtain a second network data packet using an unknown communication protocol, and then calculates the payload bit frequency and information entropy of the second network data packet, and uses the payload bit frequency and information entropy of the second network data packet to judge the communication protocol used by each data stream in the second network data packet. In this way, in the process of identifying traffic using an unknown protocol or suspicious communication traffic in a network environment, according to the characteristic that a custom encryption communication protocol has a high degree of randomness, the calculated payload bit frequency and information entropy of the traffic using an unknown protocol or suspicious communication traffic can be used to effectively identify traffic using a custom encryption communication protocol or suspicious communication traffic in a network environment, and the identification has the characteristics of high accuracy and low false alarm rate.

[0123] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A method for processing traffic of a custom encryption protocol, characterized in that: include: Acquire a first network data packet, and perform communication protocol filtering on the acquired first network data packet to obtain a second network data packet using an unknown communication protocol; According to the network quintuple carried in the second network data packet, the second network data packet is divided into different data streams; Processing the network data packets in each of the different data streams to obtain a payload character string of each of the data streams; Based on the obtained payload character string of each of the data flows, respectively calculating the payload bit frequency and information entropy of each of the data flows in the second network data packet; Determining the communication protocol used by each data flow in the second network data packet according to the calculated payload bit frequency and information entropy of each data flow; Calculating the payload bit frequency of each of the data flows in the second network data packet based on the obtained payload character string of each of the data flows includes: Counting the number of 1s and the number of 0s in the payload character string of each of the data flows respectively; The payload bit frequency of each of the data flows in the second network data packet is calculated using the following formula: Wherein, t represents the payload bit frequency of each of the data streams; N0 represents the number of 0s in the payload string of each of the data streams; N1 represents the number of 1s in the payload string of each of the data streams; P0 and are all constants; wherein P0 represents the theoretical probability of 0 appearing in the payload string of each of the data flows; represents the theoretical probability of 1 appearing in the payload string of each of the data flows; Determining the communication protocol used by each data flow in the second network data packet according to the calculated payload bit frequency and information entropy of each data flow includes: When the payload bit frequency of a data stream among the calculated payload bit frequencies of each of the data streams is less than or equal to the frequency threshold and the information entropy is greater than or equal to the information entropy threshold, it is determined that the communication protocol used by the data stream having the payload bit frequency less than or equal to the frequency threshold and the information entropy greater than or equal to the information entropy threshold is a custom encryption protocol.

2. The method according to claim 1, characterized in that Processing the network data packets in each of the different data streams to obtain the payload character string of each of the data streams includes: Removing the Ethernet protocol header, IP protocol header, TCP protocol or UDP protocol header in the network data packets in each of the data streams to obtain the payload portion of the network data packets in each of the data streams; According to the sequence of the sending time of the network data packets in each of the data streams, the payload parts of the network data packets in each of the data streams are concatenated to obtain the payload character strings of each of the data streams.

3. The method according to claim 1, characterized in that Calculating the information entropy of each of the data flows in the second network data packet based on the obtained payload character string of each of the data flows includes: Counting the number of bytes of the payload character string of each of the data flows; Counting the number of occurrences of each byte value in the payload character string of each of the data flows; The occurrence probability of each byte value in the payload string of each data stream is calculated by the following formula: Among them, P(x i ) represents the probability of occurrence of each byte value in the payload string of each of the data streams; y i represents the number of occurrences of each byte value in the payload string of each of the data streams; z represents the number of bytes in the payload string of each of the data streams; The information entropy of each of the data flows in the second network data packet is calculated by the following formula: Wherein, H(x) represents the information entropy of each of the data flows in the second network data packet; and n is 256.

4. A custom encryption protocol traffic processing device, characterized in that: include: An acquisition module, used for acquiring a first network data packet, performing communication protocol filtering on the acquired first network data packet, and obtaining a second network data packet using an unknown communication protocol; A division module, used for dividing the second network data packet into different data streams according to the network quintuple carried in the second network data packet; A processing module, used for processing the network data packets in each of the different data streams to obtain a payload string of each of the data streams; A calculation module, configured to calculate the payload bit frequency and information entropy of each of the data flows in the second network data packet based on the obtained payload character string of each of the data flows; A determination module, configured to determine the communication protocol used by each data flow in the second network data packet according to the calculated payload bit frequency and information entropy of each data flow; The calculation module is used to calculate the payload bit frequency of each of the data flows in the second network data packet based on the obtained payload character string of each of the data flows, including: Counting the number of 1s and the number of 0s in the payload character string of each of the data flows respectively; The payload bit frequency of each of the data flows in the second network data packet is calculated using the following formula: Wherein, t represents the payload bit frequency of each of the data streams; N0 represents the number of 0s in the payload string of each of the data streams; N1 represents the number of 1s in the payload string of each of the data streams; P0 and are all constants; P0 represents the theoretical probability of 0 appearing in the payload string of each data stream; represents the theoretical probability of 1 appearing in the payload string of each of the data flows; A determination module, configured to determine the communication protocol used by each data flow in the second network data packet according to the calculated payload bit frequency and information entropy of each data flow, comprising: When the payload bit frequency of a data stream among the calculated payload bit frequencies of each of the data streams is less than or equal to the frequency threshold and the information entropy is greater than or equal to the information entropy threshold, it is determined that the communication protocol used by the data stream having the payload bit frequency less than or equal to the frequency threshold and the information entropy greater than or equal to the information entropy threshold is a custom encryption protocol.

5. The device according to claim 4, characterized in that The processing module is specifically used for: Removing the Ethernet protocol header, IP protocol header, TCP protocol or UDP protocol header in the network data packets in each of the data streams to obtain the payload portion of the network data packets in each of the data streams; According to the sequence of the sending time of the network data packets in each of the data streams, the payload parts of the network data packets in each of the data streams are concatenated to obtain the payload character strings of each of the data streams.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method described in any one of claims 1 to 3 are executed.

7. An electronic device, characterized in that: The electronic device includes a memory, a processor and one or more programs, wherein the one or more programs are stored in the memory and are configured so that the processor executes the steps of the method according to any one of claims 1 to 3.

Images