Abnormal encrypted traffic detection method, device, electronic device and storage medium

Abstract

The present application provides a method, device, electronic device and storage medium for detecting abnormal encrypted traffic. The method includes: obtaining the TLS encrypted traffic to be detected; determining the JA3 fingerprint of the TLS encrypted traffic to be detected, and the ServerName field value in the ClientHello data packet of the TLS encrypted traffic to be detected; generating a target SN‑JA3 fingerprint using the JA3 fingerprint and the ServerName field value; querying a preset fingerprint library through the target SN‑JA3 fingerprint to determine whether the TLS encrypted traffic to be detected is abnormal encrypted traffic, wherein the preset fingerprint library stores multiple SN‑JA3 fingerprints and the probability of each SN‑JA3 fingerprint appearing in non-abnormal encrypted traffic. Therefore, this method can determine whether the TLS encrypted traffic to be detected is abnormal encrypted traffic, which is used to detect abnormal encrypted traffic.

Description

Technical Field

[0001] The present application relates to the field of computer security technology, and in particular to a method, device, electronic device and storage medium for detecting abnormal encrypted traffic. Background Art

[0002] With the development of technology, users are increasingly using the internet for social activities, shopping, entertainment, and other online activities. During these online activities, network traffic is generated, which often carries user information. To prevent the theft of user information carried in network traffic, the TLS protocol (Transport Layer Security) is currently commonly used to encrypt network traffic.

[0003] However, in actual applications, some malware interacts with the control server and usually uses the TLS protocol to encrypt the network traffic of the interaction process, thereby forming abnormal encrypted traffic. Therefore, it is necessary to detect abnormal encrypted traffic. Summary of the Invention

[0004] The purpose of the embodiments of the present application is to provide a method, device, electronic device and storage medium for detecting abnormal encrypted traffic, which are used to detect abnormal encrypted traffic.

[0005] A first aspect of an embodiment of the present application provides a method for detecting abnormal encrypted traffic, including:

[0006] Obtain the TLS encrypted traffic to be tested;

[0007] Determine the JA3 fingerprint of the TLS encrypted traffic to be detected and the ServerName field value in the ClientHello packet of the TLS encrypted traffic to be detected;

[0008] Generate a target SN-JA3 fingerprint using the JA3 fingerprint and the ServerName field value;

[0009] The preset fingerprint library is queried through the target SN-JA3 fingerprint to determine whether the TLS encrypted traffic to be detected is abnormal encrypted traffic, wherein the preset fingerprint library stores multiple SN-JA3 fingerprints and the probability of each SN-JA3 fingerprint appearing in non-abnormal encrypted traffic.

[0010] In one embodiment, generating a target SN-JA3 fingerprint using the JA3 fingerprint and the ServerName field value specifically includes:

[0011] The target SN-JA3 fingerprint is generated by concatenating the JA3 fingerprint and the ServerName field value.

[0012] In one embodiment, querying a preset fingerprint database using the target SN-JA3 fingerprint to determine whether the TLS encrypted traffic to be detected is abnormal encrypted traffic specifically includes:

[0013] Querying a preset fingerprint database using the target SN-JA3 fingerprint to determine whether the preset fingerprint database includes the target SN-JA3 fingerprint;

[0014] In a case where the preset fingerprint library includes the target SN-JA3 fingerprint, determining a probability corresponding to the target SN-JA3 fingerprint;

[0015] If the probability is greater than a preset threshold, it is determined that the TLS encrypted traffic to be detected is not abnormal encrypted traffic; or, if the probability is less than or equal to the preset threshold, it is determined that the TLS encrypted traffic to be detected is abnormal encrypted traffic.

[0016] In one embodiment, the method further includes:

[0017] When the preset fingerprint library does not include the target SN-JA3 fingerprint, it is determined that the TLS encrypted traffic to be detected is abnormal encrypted traffic.

[0018] In one embodiment, the method further includes:

[0019] Using a preset probability calculation function, calculate the probability of the target SN-JA3 fingerprint appearing in non-abnormal encrypted traffic;

[0020] The target SN-JA3 fingerprint and the calculated probability are added to the preset fingerprint library accordingly.

[0021] In one embodiment, the method further includes:

[0022] Get multiple TLS encrypted flows;

[0023] Determine the JA3 fingerprint of each TLS encrypted flow and the ServerName field value in the ClientHello packet of each TLS encrypted flow;

[0024] Generate the SN-JA3 fingerprint of each TLS encrypted flow using the JA3 fingerprint of each TLS encrypted flow and the ServerName field value in the ClientHello packet of each TLS encrypted flow;

[0025] Using a preset probability calculation function, the probability of the SN-JA3 fingerprint of each TLS encrypted traffic appearing in non-abnormal encrypted traffic is calculated.

[0026] The preset fingerprint library is generated by using the SN-JA3 fingerprint of each TLS encrypted traffic and the probability of the SN-JA3 fingerprint of each TLS encrypted traffic appearing in non-abnormal encrypted traffic.

[0027] A third aspect of an embodiment of the present application provides an abnormal encrypted traffic detection device, including:

[0028] An acquisition unit, used to acquire TLS encrypted traffic to be detected;

[0029] a determining unit, configured to determine a JA3 fingerprint of the TLS encrypted traffic to be detected and a ServerName field value in a ClientHello packet of the TLS encrypted traffic to be detected;

[0030] a generating unit, configured to generate a target SN-JA3 fingerprint using the JA3 fingerprint and the ServerName field value;

[0031] The detection unit is configured to query a preset fingerprint library using the target SN-JA3 fingerprint to determine whether the TLS encrypted traffic to be detected is abnormal encrypted traffic, wherein the preset fingerprint library stores multiple SN-JA3 fingerprints and the probability of each SN-JA3 fingerprint appearing in non-abnormal encrypted traffic.

[0032] In one embodiment, the generating unit specifically includes a generating subunit, wherein:

[0033] The generating subunit is configured to generate the target SN-JA3 fingerprint by concatenating the JA3 fingerprint and the ServerName field value.

[0034] A third aspect of the embodiments of the present application provides an electronic device, including:

[0035] processor;

[0036] A memory for storing processor-executable instructions; wherein the processor is configured to execute the method described in any one of the first aspects of the embodiments of the present application.

[0037] A fourth aspect of the embodiments of the present application provides a storage medium, wherein the storage medium stores a computer program, and the computer program can be executed by a processor to complete any method described in the first aspect of the embodiments of the present application.

[0038] The abnormal encrypted traffic detection method provided in the embodiment of the present application includes obtaining the TLS encrypted traffic to be detected, then determining the JA3 fingerprint of the TLS encrypted traffic to be detected, and the ServerName field value in the ClientHello data packet of the TLS encrypted traffic to be detected, and then using the JA3 fingerprint and the ServerName field value to generate a target SN-JA3 fingerprint, and then querying the preset fingerprint library through the target SN-JA3 fingerprint. Since the preset fingerprint library stores multiple SN-JA3 fingerprints and the probability of each SN-JA3 fingerprint appearing in non-abnormal encrypted traffic, it is possible to determine whether the TLS encrypted traffic to be detected is abnormal encrypted traffic, which is used to detect abnormal encrypted traffic. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without creative work.

[0040] Figure 1 A schematic diagram of the structure of an electronic device provided in one embodiment of the present application;

[0041] Figure 2 A schematic diagram of interaction between an electronic device and a terminal provided in an embodiment of the present application;

[0042] Figure 3 A schematic diagram of a specific process of detecting abnormal encrypted traffic according to another embodiment of the present application;

[0043] Figure 4 A schematic diagram of the specific structure of an abnormal encrypted traffic detection device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0044] The technical solutions in the embodiments of the present application will be described below in conjunction with the accompanying drawings. In the description of the present application, terms such as "first," "second," and "third" are used only to distinguish descriptions and should not be understood as indicating or implying relative importance or order.

[0045] As mentioned earlier, some malware interacts with the control server by usually using the TLS protocol to encrypt the network traffic during the interaction process, thereby generating abnormal encrypted traffic. This abnormal encrypted traffic is confused with the network traffic generated by users during network activities (also encrypted using the TLS protocol), making it difficult to distinguish. Therefore, it is necessary to detect the abnormal encrypted traffic.

[0046] Based on this, the embodiments of the present application provide a method, device, electronic device and storage medium for detecting abnormal encrypted traffic, which can be used to detect abnormal encrypted traffic. Figure 1 As shown, this embodiment provides an electronic device 1, which includes: at least one processor 11 and a memory 12, Figure 1 A processor 11 and a memory 12 may be connected via a bus 10. The memory 12 stores instructions executable by the processor 11. The instructions are executed by the processor 11 so that the electronic device 1 can execute all or part of the process of the method in the following embodiment.

[0047] In practical applications, the electronic device 1 can be a mobile phone, a laptop computer, a desktop computer, or a large server or server cluster composed thereof. For example, in combination with a specific application scenario, in the process of detecting abnormal encrypted traffic, the electronic device 1 can be a server or server cluster used to detect abnormal encrypted traffic.

[0048] like Figure 2 As shown, the electronic device 1 can be connected to one or more terminals 2, thereby being able to communicate with the terminal 2. For example, before sending encrypted traffic to the terminal 2, the electronic device 1 first detects whether the encrypted traffic is abnormal encrypted traffic using the method provided in the embodiment of the present application, and only sends the encrypted traffic to the terminal 2 if it is detected that the encrypted traffic is not abnormal encrypted traffic. Of course, if it is detected that the encrypted traffic is abnormal encrypted traffic, it will not be sent to the terminal 2. In addition, the terminal 2 can also send encrypted traffic to the electronic device 1. At this time, after receiving the encrypted traffic, the electronic device 1 can also detect whether the encrypted traffic is abnormal encrypted traffic using the method provided in the embodiment of the present application, and then perform corresponding processing based on the detection result.

[0049] like Figure 3 The abnormal encrypted traffic detection method provided by the embodiment of the present application is shown as follows. Figure 1 The method is performed by the electronic device 1 shown, and includes the following steps:

[0050] Step S31: Obtain the TLS encrypted traffic to be detected.

[0051] In actual applications, a traffic collector can be set up on a server, such as at the network entrance and exit of an enterprise server. This traffic collector can obtain TLS encrypted traffic at the network entrance and exit, and use this TLS encrypted traffic as the TLS encrypted traffic to be detected to detect whether it is abnormal encrypted traffic. Specifically, the TLS encrypted traffic is the encrypted traffic obtained by encrypting the network traffic using the TLS protocol.

[0052] Of course, when the traffic collector collects a large amount of TLS encrypted traffic, these TLS encrypted traffic can be used as TLS encrypted traffic to be detected. For example, a queue can be built first, and then these TLS encrypted traffic can be added to the queue in the order of acquisition time, and then the TLS encrypted traffic can be obtained from the queue in the order of the queue, and detected as TLS encrypted traffic to be detected.

[0053] Step S32: Determine the JA3 fingerprint of the TLS encrypted traffic to be detected and the ServerName field value in the ClientHello data packet of the TLS encrypted traffic to be detected.

[0054] The TLS encrypted traffic to be detected includes a ClientHello packet, so the TLS encrypted traffic to be detected can be parsed according to the relevant rules of the TLS protocol to extract the ClientHello packet from the TLS encrypted traffic to be detected. The ClientHello packet includes multiple fields, such as a ServerName field, an SSLVersion field, a Ciphers field, an Extensions field, an EllipticCurves field, and an EllipticCurvePointFormats field, and the fields may include corresponding field values ​​(the field values ​​of some fields may be empty, in which case they may be replaced by default values ​​or left blank).

[0055] After obtaining the ClientHello data packet, the ServerName field value (i.e., the field value of the ServerName field), SSLVersion field value (i.e., the field value of the SSLVersion field), Ciphers field value (i.e., the field value of the Ciphers field), Extensions field value (i.e., the field value of the Extensions field), EllipticCurves field value (i.e., the field value of the EllipticCurves field), and EllipticCurvePointFormats field value (i.e., the field value of the EllipticCurvePointFormats field) in the ClientHello data packet can be further obtained. After obtaining the above field values, the JA3 fingerprint of the TLS encrypted traffic to be detected can be generated using the SSLVersion field value, Ciphers field value, Extensions field value, EllipticCurves field value, and EllipticCurvePointFormats field value according to the JA3 fingerprint generation rules.

[0056] Specifically, the SSLVersion field value, Ciphers field value, Extensions field value, EllipticCurves field value, and EllipticCurvePointFormats field value can be first converted into decimal values; then, the decimal values ​​are concatenated in the order of the SSLVersion field value, the Ciphers field value, the Extensions field value, the EllipticCurves field value, and the EllipticCurvePointFormats field value, wherein the decimal values ​​of the field values ​​of different fields are separated by a first separator (the first separator can be, for example, ","); when there are multiple field values ​​in the same field, the decimal values ​​of the field values ​​of the same field are separated by a second separator (the second separator can be, for example, "-"); then, the concatenated string is calculated using a hash algorithm to generate a JA3 fingerprint of the TLS encrypted traffic to be detected, wherein the hash algorithm can be an MD5 hash algorithm or other hash algorithm.

[0057] Step S33: Generate a target SN-JA3 fingerprint using the JA3 fingerprint and the ServerName field value.

[0058] After determining the JA3 fingerprint of the TLS encrypted traffic to be detected and the ServerName field value in the ClientHello packet of the TLS encrypted traffic to be detected in step S32, the JA3 fingerprint and the ServerName field value can be further used to generate an SN-JA3 fingerprint as the target SN-JA3 fingerprint. The target SN-JA3 fingerprint can be generated by concatenating the ServerName field value with the JA3 fingerprint, for example, by adding a third separator between the ServerName field value and the JA3 fingerprint to concatenate the two into the target SN-JA3 fingerprint. Furthermore, there is no restriction on the order in which the ServerName field value and the JA3 fingerprint are concatenated.

[0059] Step S34: query the preset fingerprint library through the target SN-JA3 fingerprint to determine whether the TLS encrypted traffic to be detected is abnormal encrypted traffic.

[0060] The preset fingerprint library stores multiple SN-JA3 fingerprints and the probability of each SN-JA3 fingerprint appearing in non-abnormal encrypted traffic. For example, the preset fingerprint library stores a certain SN-JA3 fingerprint A and the probability of SN-JA3 fingerprint A appearing in non-abnormal encrypted traffic (non-abnormal encrypted traffic refers to normal encrypted traffic). A higher probability indicates a higher probability that SN-JA3 fingerprint A is not abnormal encrypted traffic, and a lower probability indicates a lower probability that SN-JA3 fingerprint A is not abnormal encrypted traffic.

[0061] Regarding the specific implementation of step S34, the preset fingerprint library may be queried using the target SN-JA3 fingerprint to determine whether the preset fingerprint library includes the target SN-JA3 fingerprint. There are two possible situations: the preset fingerprint library includes the target SN-JA3 fingerprint, or the preset fingerprint library does not include the target SN-JA3 fingerprint. The processing methods for the two situations are described below:

[0062] When the preset fingerprint library includes the target SN-JA3 fingerprint, the probability corresponding to the target SN-JA3 fingerprint can be determined first. Specifically, since the preset fingerprint library stores multiple SN-JA3 fingerprints and the probability of each SN-JA3 fingerprint appearing in non-abnormal encrypted traffic, when the preset fingerprint library includes the target SN-JA3 fingerprint, the probability corresponding to the target SN-JA3 fingerprint can be obtained from the preset fingerprint library. This probability is the probability of the target SN-JA3 fingerprint appearing in non-abnormal encrypted traffic.

[0063] After determining the probability corresponding to the target SN-JA3 fingerprint, the probability can be further compared with a preset threshold. If the probability is greater than the preset threshold, the TLS encrypted traffic to be detected is determined not to be abnormal encrypted traffic; alternatively, if the probability is less than or equal to the preset threshold, the TLS encrypted traffic to be detected is determined to be abnormal encrypted traffic. The preset threshold can generally be set based on actual needs, for example, 0.5, 0.6, or other values.

[0064] In addition, if the preset fingerprint library does not include the target SN-JA3 fingerprint, the first processing method may be to directly determine that the TLS encrypted traffic to be detected is abnormal encrypted traffic; the second processing method may be to use a preset probability measurement function to calculate the probability of the target SN-JA3 fingerprint appearing in non-abnormal encrypted traffic, and then compare this probability with a preset threshold. If the probability is greater than the preset threshold, the TLS encrypted traffic to be detected is determined not to be abnormal encrypted traffic; or if the probability is less than or equal to the preset threshold, the TLS encrypted traffic to be detected is determined to be abnormal encrypted traffic. The first processing method is generally more efficient, while the second processing method is generally more accurate. In actual applications, they can be applied according to specific application scenarios.

[0065] Of course, after adopting the first processing method mentioned above, when the server is in an idle period, the second processing method can be further adopted, that is, using the preset probability measurement function to calculate the probability of the target SN-JA3 fingerprint appearing in non-abnormal encrypted traffic, and then further adding the target SN-JA3 fingerprint and the calculated probability to the preset fingerprint library accordingly, so that in the subsequent process, it can be achieved by querying the preset fingerprint library.

[0066] It should be further explained that the preset probability calculation function can be a multinomial distribution probability distribution function or other preset probability calculation functions, wherein the multinomial distribution probability distribution function is a generalized form of the binomial distribution probability distribution function.

[0067] Using the multinomial distribution probability distribution function, when calculating the probability of the target SN-JA3 fingerprint appearing in non-abnormal encrypted traffic, we can set X = (x1, x2, ... x j ,...,x K ) represents a random variable, representing each SN-JA3 fingerprint stored in the preset fingerprint library, where x j (1≤j≤K) represents the number of times the SN-JA3 fingerprint j appears in n Bernoulli trials. The corresponding multinomial distribution probability distribution function is calculated as follows:

[0068]

[0069] In this calculation formula, Mu(x|n,p) is the calculated probability; x1, x2, x j 、x K Respectively represent the number of times SN-JA3 fingerprints 1, 2, j, and k appear in n Bernoulli trials; p j represents the probability corresponding to SN-JA3 fingerprint j; Used to represent the total number of Bernoulli trials.

[0070] The abnormal encrypted traffic detection method provided in the embodiment of the present application includes obtaining the TLS encrypted traffic to be detected, then determining the JA3 fingerprint of the TLS encrypted traffic to be detected, and the ServerName field value in the ClientHello data packet of the TLS encrypted traffic to be detected, and then using the JA3 fingerprint and the ServerName field value to generate a target SN-JA3 fingerprint, and then querying the preset fingerprint library through the target SN-JA3 fingerprint. Since the preset fingerprint library stores multiple SN-JA3 fingerprints and the probability of each SN-JA3 fingerprint appearing in non-abnormal encrypted traffic, it is possible to determine whether the TLS encrypted traffic to be detected is abnormal encrypted traffic, which is used to detect abnormal encrypted traffic.

[0071] In the above steps, a preset fingerprint library is mentioned. The preset fingerprint library can be pre-generated in the following way: first, multiple TLS encrypted flows are obtained. For example, the TLS encrypted flows collected by the flow collector set at the entrance and exit of the enterprise server network within a period of time (for example, within 10 days or 1 month) are used as the multiple TLS encrypted flows obtained; then, the JA3 fingerprint of each TLS encrypted flow and the ServerName field value in the ClientHello data packet of each TLS encrypted flow are determined respectively. For the specific implementation method, for example, the relevant content in the above step S32 can be referred to, which will not be repeated here; then, the JA3 fingerprint of each TLS encrypted flow and the ClientHello value of each TLS encrypted flow are used respectively. The ServerName field value in the ntHello data packet is used to generate the SN-JA3 fingerprint of each TLS encrypted traffic. For the specific implementation method, for example, you can refer to the relevant content in the above step S33, which will not be repeated here; then, the preset probability calculation function is used to calculate the probability of the SN-JA3 fingerprint of each TLS encrypted traffic appearing in non-abnormal encrypted traffic, wherein the preset probability calculation function can be a multinomial distribution probability distribution function. For the specific implementation method, you can refer to the relevant content in the above step S34, which will not be repeated here; then, the SN-JA3 fingerprint of each TLS encrypted traffic and the probability of the SN-JA3 fingerprint of each TLS encrypted traffic appearing in non-abnormal encrypted traffic are used to generate a preset fingerprint library.

[0072] Table 1

[0073] serial number SN-JA3 fingerprint Probability 1 xxxxxx a 2 yyyyyyyy b …… …… ……

[0074] For example, in actual applications, the above method can be used to generate a preset fingerprint library as shown in Table 1. The preset fingerprint library shown in Table 1 includes an SN-JA3 fingerprint field and a probability field. The SN-JA3 fingerprint field is used to store the SN-JA3 fingerprint of each TLS encrypted traffic, and the probability field is used to store the probability of the SN-JA3 fingerprint of each TLS encrypted traffic appearing in non-abnormal encrypted traffic.

[0075] Based on the same inventive concept as the abnormal encrypted traffic detection method provided in the embodiment of the present application, the embodiment of the present application also provides an abnormal encrypted traffic detection device. For any unclear points in the embodiment of the device, please refer to the corresponding content of the method embodiment. Figure 4 FIG. 4 is a schematic diagram of a specific structure of the device 40 , which includes: an acquisition unit 401 , a determination unit 402 , a generation unit 403 , and a detection unit 404 , wherein:

[0076] An acquisition unit 401 is configured to acquire TLS encrypted traffic to be detected;

[0077] A determining unit 402 is configured to determine a JA3 fingerprint of the TLS encrypted traffic to be detected and a ServerName field value in a ClientHello packet of the TLS encrypted traffic to be detected;

[0078] A generating unit 403 is configured to generate a target SN-JA3 fingerprint using the JA3 fingerprint and the ServerName field value;

[0079] The detection unit 404 is configured to query a preset fingerprint library using the target SN-JA3 fingerprint to determine whether the TLS encrypted traffic to be detected is abnormal encrypted traffic, wherein the preset fingerprint library stores multiple SN-JA3 fingerprints and the probability of each SN-JA3 fingerprint appearing in non-abnormal encrypted traffic.

[0080] The device 40 provided in the embodiment of the present application is used. Since the device 40 adopts the same inventive concept as the abnormal encrypted traffic detection method provided in the embodiment of the present application, on the premise that this method can solve the technical problem, the device 40 can also solve the technical problem, and no further details will be given here.

[0081] In addition, in actual applications, the technical effects achieved by combining the device 40 with specific hardware equipment, cloud technology, etc. are also within the scope of protection of this application. For example, different units in the device 40 are arranged in different nodes in the distributed cluster in a distributed cluster manner, thereby improving efficiency; or, some units in the device 40 are arranged in the cloud, thereby reducing costs, etc.

[0082] In practical applications, the generating unit 403 may specifically include a generating subunit, wherein: the generating subunit is configured to generate the target SN-JA3 fingerprint by concatenating the JA3 fingerprint and the ServerName field value.

[0083] The detection unit 404 may specifically include a detection subunit, which is used to query a preset fingerprint library through the target SN-JA3 fingerprint to determine whether the preset fingerprint library includes the target SN-JA3 fingerprint; when the preset fingerprint library includes the target SN-JA3 fingerprint, determine the probability corresponding to the target SN-JA3 fingerprint; if the probability is greater than a preset threshold, determine that the TLS encrypted traffic to be detected is not abnormal encrypted traffic; or, if the probability is less than or equal to the preset threshold, determine that the TLS encrypted traffic to be detected is abnormal encrypted traffic.

[0084] The device 40 may further include a second detection unit, configured to determine that the TLS encrypted traffic to be detected is abnormal encrypted traffic when the preset fingerprint library does not include the target SN-JA3 fingerprint.

[0085] The apparatus may further comprise a probability calculation unit and an adding unit, wherein:

[0086] A probability calculation unit is used to calculate the probability of the target SN-JA3 fingerprint appearing in non-abnormal encrypted traffic using a preset probability measurement function; an adding unit is used to add the target SN-JA3 fingerprint and the calculated probability to the preset fingerprint library accordingly.

[0087] The device may also include a preset fingerprint library generation unit for obtaining multiple TLS encrypted flows; determining the JA3 fingerprint of each TLS encrypted flow and the ServerName field value in the ClientHello data packet of each TLS encrypted flow respectively; generating the SN-JA3 fingerprint of each TLS encrypted flow by using the JA3 fingerprint of each TLS encrypted flow and the ServerName field value in the ClientHello data packet of each TLS encrypted flow respectively; using a preset probability measurement function, calculating the probability of the SN-JA3 fingerprint of each TLS encrypted flow appearing in non-abnormal encrypted flow; using the SN-JA3 fingerprint of each TLS encrypted flow and the probability of the SN-JA3 fingerprint of each TLS encrypted flow appearing in non-abnormal encrypted flow to generate the preset fingerprint library.

[0088] An embodiment of the present invention further provides a storage medium storing a computer program that can be executed by a processor to complete all or part of the process of the method in the embodiment of the present application. The storage medium can be a disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory (Flash Memory), a hard disk drive (HDD) or a solid-state drive (SSD). The storage medium can also include a combination of the above-mentioned types of memory.

[0089] Although the embodiments of the present invention have been described with reference to the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention. Such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A method for detecting abnormal encrypted traffic, characterized in that: The method comprises: Obtain the TLS encrypted traffic to be tested; Determine the JA3 fingerprint of the TLS encrypted traffic to be detected and the ServerName field value in the ClientHello packet of the TLS encrypted traffic to be detected; Generate a target SN-JA3 fingerprint using the JA3 fingerprint and the ServerName field value; Querying a preset fingerprint library using the target SN-JA3 fingerprint to determine whether the TLS encrypted traffic to be detected is abnormal encrypted traffic, wherein the preset fingerprint library stores multiple SN-JA3 fingerprints and the probability of each SN-JA3 fingerprint appearing in non-abnormal encrypted traffic; The method of querying a preset fingerprint database using the target SN-JA3 fingerprint to determine whether the TLS encrypted traffic to be detected is abnormal encrypted traffic specifically includes: Querying a preset fingerprint database using the target SN-JA3 fingerprint to determine whether the preset fingerprint database includes the target SN-JA3 fingerprint; In a case where the preset fingerprint library includes the target SN-JA3 fingerprint, determining a probability corresponding to the target SN-JA3 fingerprint; If the probability is greater than a preset threshold, it is determined that the TLS encrypted traffic to be detected is not abnormal encrypted traffic; or, if the probability is less than or equal to the preset threshold, it is determined that the TLS encrypted traffic to be detected is abnormal encrypted traffic.

2. The method according to claim 1, characterized in that Generate a target SN-JA3 fingerprint using the JA3 fingerprint and the ServerName field value, specifically including: The target SN-JA3 fingerprint is generated by concatenating the JA3 fingerprint and the ServerName field value.

3. The method according to claim 1, characterized in that The method further comprises: When the preset fingerprint library does not include the target SN-JA3 fingerprint, it is determined that the TLS encrypted traffic to be detected is abnormal encrypted traffic.

4. The method according to claim 3, characterized in that The method further comprises: Using a preset probability calculation function, calculate the probability of the target SN-JA3 fingerprint appearing in non-abnormal encrypted traffic; The target SN-JA3 fingerprint and the calculated probability are added to the preset fingerprint library accordingly.

5. The method according to claim 1, wherein The method further comprises: Get multiple TLS encrypted flows; Determine the JA3 fingerprint of each TLS encrypted flow and the ServerName field value in the ClientHello packet of each TLS encrypted flow; Generate the SN-JA3 fingerprint of each TLS encrypted flow using the JA3 fingerprint of each TLS encrypted flow and the ServerName field value in the ClientHello packet of each TLS encrypted flow; Using a preset probability calculation function, the probability of the SN-JA3 fingerprint of each TLS encrypted traffic appearing in non-abnormal encrypted traffic is calculated. The preset fingerprint library is generated by using the SN-JA3 fingerprint of each TLS encrypted traffic and the probability of the SN-JA3 fingerprint of each TLS encrypted traffic appearing in non-abnormal encrypted traffic.

6. An abnormal encrypted traffic detection device, characterized in that: include: An acquisition unit, used to acquire TLS encrypted traffic to be detected; a determining unit, configured to determine a JA3 fingerprint of the TLS encrypted traffic to be detected and a ServerName field value in a ClientHello packet of the TLS encrypted traffic to be detected; a generating unit, configured to generate a target SN-JA3 fingerprint using the JA3 fingerprint and the ServerName field value; a detection unit, configured to query a preset fingerprint library using the target SN-JA3 fingerprint to determine whether the TLS encrypted traffic to be detected is abnormal encrypted traffic, wherein the preset fingerprint library stores a plurality of SN-JA3 fingerprints and a probability of each SN-JA3 fingerprint appearing in non-abnormal encrypted traffic; The method of querying a preset fingerprint database using the target SN-JA3 fingerprint to determine whether the TLS encrypted traffic to be detected is abnormal encrypted traffic specifically includes: Querying a preset fingerprint database using the target SN-JA3 fingerprint to determine whether the preset fingerprint database includes the target SN-JA3 fingerprint; In a case where the preset fingerprint library includes the target SN-JA3 fingerprint, determining a probability corresponding to the target SN-JA3 fingerprint; If the probability is greater than a preset threshold, it is determined that the TLS encrypted traffic to be detected is not abnormal encrypted traffic; or, if the probability is less than or equal to the preset threshold, it is determined that the TLS encrypted traffic to be detected is abnormal encrypted traffic.

7. The device according to claim 6, characterized in that The generating unit specifically includes a generating subunit, wherein: The generating subunit is configured to generate the target SN-JA3 fingerprint by concatenating the JA3 fingerprint and the ServerName field value.

8. An electronic device, characterized in that: include: processor; A memory for storing processor-executable instructions; wherein the processor is configured to perform the method according to any one of claims 1 to 7.

9. A storage medium, characterized in that: The storage medium stores a computer program, and the computer program can be executed by a processor to implement the method according to any one of claims 1 to 7.

Images