A risk assessment method based on port reuse and related equipment

Abstract

The present invention discloses a risk assessment method based on port reuse and related equipment. The method includes: obtaining network statistical information of specific sessions of different groups, wherein each group of specific sessions includes at least two network sessions, each of the above network sessions includes the same destination IP address and destination port, and the above network statistical information includes a statistical time range, application type information and the total number of application types; obtaining port reuse confidence based on the above statistical time range, the above application type information and the total number of application types; determining the port reuse risk level based on the above port reuse confidence. This application performs traffic model identification and tunnel detection for the scenario where the intranet server does not go out of the network, and the judgment method is to calculate with reference to the specified type of traffic, and to make confidence judgment based on the statistical frequency, application type and the number of application types. Compared with the method of manually identifying massive logs, the detection efficiency and detection capability are greatly improved.

Description

Technical Field

[0001] This specification relates to the field of communications, and more specifically, to a risk assessment method based on port multiplexing and related equipment. Background Art

[0002] Port reuse allows communication over an already open system port, performing only character matching on the input information without intercepting or copying network data. Therefore, it does not affect network data transmission performance. For this reason, port reuse has long been a common tactic used by Trojans. A Trojan binds to an already valid port to conceal its presence and launch an intrusion, posing a significant risk to servers. However, the current approach relies solely on identifying traffic based on a single flow. If the traffic does not carry malicious signatures, malicious activity cannot be detected. Summary of the Invention

[0003] The Summary of the Invention introduces a series of simplified concepts that will be further described in the Detailed Description of the Invention. The Summary of the Invention is not intended to limit the key features and essential features of the claimed technical solution, nor is it intended to determine the scope of protection of the claimed technical solution.

[0004] In order to reduce the risk of illegal programs invading servers by using port multiplexing, the present invention proposes a risk assessment method based on port multiplexing, which includes:

[0005] Obtaining network statistical information for different groups of specific sessions, wherein each group of specific sessions includes at least two network sessions, each of the network sessions includes the same destination IP address and destination port, and the network statistical information includes a statistical time range, application type information, and a total number of application types;

[0006] Obtaining port reuse confidence based on the statistical time range, the application type information, and the total number of application types;

[0007] The port reuse risk level is determined based on the port reuse confidence level.

[0008] Optionally, the obtaining of the port reuse confidence based on the statistical time range, the application type information, and the total number of application types includes:

[0009] Obtain the time range coefficient based on the above statistical time range;

[0010] Obtain the application type coefficient through the above application type information;

[0011] The port reuse confidence level is determined by the time range coefficient, the application type coefficient, and the total number of application types.

[0012] Optionally, determining the port reuse confidence by the time range coefficient, the application type coefficient, and the total number of application types includes:

[0013] The quotient of the product of the time range coefficient, the application type coefficient and the total number of application types is used as the port reuse confidence level.

[0014] Optionally, obtaining the application type coefficient through the application type information includes:

[0015] When the application type information is a proxy application, the application type coefficient is set to a first application type coefficient;

[0016] and / or,

[0017] In the case where the application type information is a common application, the application type coefficient is set to a second application type coefficient;

[0018] and / or,

[0019] In a case where the application type information is an unknown application, setting the application type coefficient to a third application type coefficient;

[0020] The first application type coefficient is greater than the second application type coefficient, and the second application type coefficient is greater than the third application type coefficient.

[0021] Optionally, the above method further includes:

[0022] When there is no other session with the same destination IP and destination port as the session to be monitored, there is no risk of port reuse for the session to be monitored.

[0023] Optionally, the above method further includes:

[0024] When all network sessions in a specific group of sessions are the same network session, there is no risk of port reuse for the group of network sessions.

[0025] Optionally, the above method further includes:

[0026] Each of the above-mentioned specific sessions is identified based on five-tuple data to distinguish the same session, wherein the above-mentioned five-tuple data includes source IP address, source port, destination IP address, destination port and protocol type.

[0027] In a second aspect, the present invention further proposes a risk assessment device based on port multiplexing, comprising:

[0028] a first acquiring unit, configured to acquire network statistical information of different groups of specific sessions, wherein each group of specific sessions includes at least two network sessions, each of the network sessions includes the same destination IP address and destination port, and the network statistical information includes a statistical time range, application type information, and a total number of application types;

[0029] A second acquiring unit is configured to acquire a port reuse confidence level based on the statistical time range, the application type information, and the total number of application types;

[0030] The determining unit is configured to determine a port reuse risk level based on the port reuse confidence level.

[0031] In a third aspect, an electronic device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor is configured to implement the steps of the port multiplexing-based risk assessment method as described in any one of the first aspects above when executing the computer program stored in the memory.

[0032] In a fourth aspect, the present invention further proposes a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the risk assessment method based on port multiplexing according to any one of the above items in the first aspect.

[0033] In summary, the risk assessment method based on port reuse in the embodiment of the present application includes: obtaining network statistical information of specific sessions in different groups, wherein each group of specific sessions includes at least two network sessions, each of the above network sessions includes the same destination IP address and destination port, and the above network statistical information includes a statistical time range, application type information, and the total number of application types; obtaining a port reuse confidence based on the above statistical time range, the above application type information, and the total number of application types; and determining the port reuse risk level based on the above port reuse confidence. The risk assessment method based on port reuse proposed in the embodiment of the present application groups network sessions based on the same destination IP address and destination port, obtains network statistical information including the statistical time range, application type information, and the total number of application types in each group of specific sessions, calculates the port reuse confidence based on the above network statistical information, and determines the port reuse risk level based on the port reuse confidence. The present application performs traffic model identification and tunnel detection for the scenario where the intranet server does not go out of the network, and the judgment method is to calculate with reference to the specified type of traffic, and to make a confidence judgment based on the statistical frequency, application type, and the number of application types. Compared with the method of manually identifying massive logs, the detection efficiency and detection capability are greatly improved.

[0034] The risk assessment method based on port reuse of the present invention, and other advantages, objectives and features of the present invention will be partially reflected in the following description, and will also be partially understood by those skilled in the art through research and practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Various other advantages and benefits will become apparent to those skilled in the art upon reading the detailed description of the preferred embodiment below. The accompanying drawings are for illustration purposes only and are not to be considered as limiting the present description. The same reference symbols are used throughout the drawings to represent the same components. In the drawings:

[0036] Figure 1 A flow chart of a risk assessment method based on port reuse provided in an embodiment of the present application;

[0037] Figure 2 A schematic diagram of a risk assessment principle based on port multiplexing provided in an embodiment of the present application;

[0038] Figure 3 A schematic diagram of an alarm processing principle based on port multiplexing provided in an embodiment of the present application;

[0039] Figure 4 A schematic structural diagram of a risk assessment device based on port multiplexing provided in an embodiment of the present application;

[0040] Figure 5 A schematic structural diagram of a risk assessment electronic device based on port multiplexing provided in an embodiment of the present application. DETAILED DESCRIPTION

[0041] The risk assessment method based on port reuse proposed in the embodiment of the present application groups network sessions based on the same destination IP address and destination port. Network statistical information, including the statistical time range, application type information, and the total number of application types, is obtained from each specific group of sessions. The port reuse confidence level is calculated based on the above network statistical information, and the port reuse risk level is determined based on the port reuse confidence level. This application performs traffic model identification and tunnel detection for scenarios where intranet servers are not connected to the network. The determination method is to calculate based on a specified type of traffic, and to make a confidence determination based on the statistical frequency, application type, and number of application types. This significantly improves detection efficiency and capabilities compared to manual identification of massive logs.

[0042] The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described herein can be implemented in a sequence other than that illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or that are inherent to these processes, methods, products or devices. The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the embodiments described are only part of the embodiments of the present application, not all of the embodiments.

[0043] See also Figure 1 , which is a flow chart of a risk assessment method based on port reuse provided in an embodiment of the present application, which may specifically include:

[0044] S110. Obtain network statistical information of different grouped specific sessions, where each group of specific sessions includes at least two network sessions, each of the network sessions includes the same destination IP address and destination port, and the network statistical information includes a statistical time range, application type information, and the total number of application types;

[0045] For example, common covert tunnel identification is for outbound services, such as DNS, ICMP, etc., and the implementation method is to identify according to traffic characteristics. This application performs traffic model identification and tunnel detection for the scenario where the intranet server does not go out of the network, automatically marks the intranet server according to the characteristics of the traffic, and classifies and counts according to the destination IP address and destination port, and classifies network sessions with the same destination IP address and destination port into the same group of specific sessions. The network statistical information of each group of specific sessions is counted separately, including the statistical time range, such as 5 minutes, 10 minutes or 15 minutes or even more, and also includes application type information, which can be a proxy application, a normal application or an unidentified unknown application. The total number of application types is determined according to the number of network sessions included in each group of specific sessions.

[0046] S120. Obtaining port reuse confidence based on the statistical time range, the application type information, and the total number of application types;

[0047] For example, because the network sessions in each group of monitored specific sessions all include the same destination IP address and destination port, port reuse may exist between these network sessions. The confidence level of port reuse is calculated based on the application type and the total number of application types within the statistical time range. The confidence level of port reuse may vary during different statistical time periods. Different application types also have different corresponding risk weights. For example, socks traffic and http proxy traffic have high weights, while FTP and database traffic have low weights. S130. Based on the above port reuse confidence level, the port reuse risk level is determined.

[0048] For example, the risk level of port reuse is determined according to the port reuse confidence level. The higher the confidence level, the higher the risk level of port reuse, and the more likely it is that a Trojan horse program will create a covert tunnel to invade the server through port reuse.

[0049] In summary, the risk assessment method based on port reuse proposed in the embodiment of the present application groups network sessions based on the same destination IP address and destination port, obtains network statistical information including the statistical time range, application type information, and the total number of application types in each specific group of sessions, and calculates the port reuse confidence based on the above network statistical information. The port reuse risk level is determined by the port reuse confidence. This application performs traffic model identification and tunnel detection for the scenario where the intranet server does not go out of the network, and the judgment method is to calculate with reference to the specified type of traffic, and to make a confidence judgment based on the statistical frequency, application type, and the number of application types. Compared with the method of manually identifying massive logs, the detection efficiency and detection capability are greatly improved.

[0050] In some examples, obtaining the port reuse confidence based on the statistical time range, the application type information, and the total number of application types includes:

[0051] Obtain the time range coefficient based on the above statistical time range;

[0052] Obtain the application type coefficient through the above application type information;

[0053] The port reuse confidence level is determined by the time range coefficient, the application type coefficient, and the total number of application types.

[0054] Exemplarily, the time range coefficient is obtained based on the statistical time range. The larger the statistical time range, the smaller the corresponding time range coefficient. For example, the statistical time range can be 5 minutes, 10 minutes or 15 minutes, and the corresponding time range coefficients are 1.0, 0.5 and 0.25 respectively. The type coefficient is obtained based on the type information. The type information may include proxy applications, ordinary applications or unidentified applications, etc. The port reuse confidence is determined based on the range coefficient, the application type coefficient and the total number of application types.

[0055] In summary, the risk assessment method based on port reuse proposed in the embodiment of the present application, which obtains the time range coefficient and application type coefficient by statistically analyzing the time range and application type information, and the port reuse confidence obtained by combining the total number of application types, can well characterize the risk of port reuse.

[0056] In some examples, determining the port reuse confidence by the time range coefficient, the application type coefficient, and the total number of application types includes:

[0057] The quotient of the product of the time range coefficient, the application type coefficient and the total number of application types is used as the port reuse confidence level.

[0058] For example, the port reuse confidence can be obtained by the formula:

[0059] Port reuse confidence = time range coefficient * application type coefficient / total number of application identification types

[0060] For example, the corresponding coefficients of the time range are 1.0, 0.5, and 0.25 for 5 minutes, 10 minutes, and 15 minutes respectively;

[0061] The corresponding relationship between application type information and application identification type coefficient can be:

[0062] High-risk application types: such as proxy applications, the corresponding coefficient is 5.0;

[0063] Medium-risk application type: such as ordinary applications, the corresponding coefficient is 2.5;

[0064] Low-risk application type: If the application is not identified, the corresponding coefficient is 1.

[0065] Table 1 shows the network session information for a specific set of sessions monitored within 5 minutes:

[0066]

[0067] Table 1

[0068] HTTP corresponds to common applications, and socks proxy corresponds to common applications. Therefore, the port reuse confidence corresponding to Table 1 = 1.0*2.5*5.0 / 2 = 6.25;

[0069] The confidence range interval can be determined according to the port reuse confidence value, for example: high confidence range: >5, 5≥ medium confidence range>2.5, 2.5≥ low confidence range>0.

[0070] In summary, the risk assessment method based on port reuse proposed in the embodiment of the present application uses the product of the time range coefficient, the application type coefficient and the total number of application types as the quotient of the port reuse confidence, which can accurately analyze the risk of illegal intrusion caused by port reuse.

[0071] In some examples, obtaining the application type coefficient through the application type information includes:

[0072] When the application type information is a proxy application, the application type coefficient is set to a first application type coefficient;

[0073] and / or,

[0074] In the case where the application type information is a common application, the application type coefficient is set to a second application type coefficient;

[0075] and / or,

[0076] In a case where the application type information is an unknown application, setting the application type coefficient to a third application type coefficient;

[0077] The first application type coefficient is greater than the second application type coefficient, and the second application type coefficient is greater than the third application type coefficient.

[0078] For example, the correspondence between application type information and application identification type coefficients can be: a high-risk application type can be a proxy application, with a corresponding coefficient of 5.0; a medium-risk application type can be a normal application, with a corresponding coefficient of 2.5; and a low-risk application type can be an unidentified application, with a corresponding coefficient of 1. As the risk levels of proxy applications, normal applications, and unidentified applications gradually decrease, the application type coefficients are also set to gradually decrease.

[0079] In summary, the risk assessment method based on port reuse proposed in the embodiment of the present application sets different type coefficients according to different application types. The calculated port reuse confidence can match the characteristics of the application, and the result obtained is more accurate.

[0080] In some examples, the method further includes:

[0081] When there is no other session with the same destination IP and destination port as the session to be monitored, there is no risk of port reuse for the session to be monitored.

[0082] For example, when there is no other session with the same destination IP and destination port as the network session to be detected, that is, there is no port reuse phenomenon, then the session to be detected does not have the risk of port reuse.

[0083] In some examples, the method further includes:

[0084] When all network sessions in a specific group of sessions are the same network session, there is no risk of port reuse for the group of network sessions.

[0085] For example, before performing the port reuse confidence calculation in the above embodiment, network sessions in the same group are first identified. If these sessions are the same session, there is no risk of port reuse.

[0086] In some examples, the method further includes:

[0087] Each of the above-mentioned specific sessions is identified based on five-tuple data to distinguish the same session, wherein the above-mentioned five-tuple data includes source IP address, source port, destination IP address, destination port and protocol type.

[0088] For example, through traffic identification, the marked intranet server is added to the session monitoring list. First, the binary classification session statistics are performed based on the destination IP and destination port: the intranet IP: 192.168.1.1 and the port 80 are identified to have an "HTTP / 1.1 200OK" response message. The destination IP: 192.168.1.1 and the destination port 80 are added to the session monitoring list as matching conditions, as shown in Table 2:

[0089]

[0090]

[0091] Table 2

[0092] Before performing the port reuse confidence calculation in the above embodiment, the network sessions in the same group are first identified again based on the five-tuple data. The five-tuple data is the IP address, source port, destination IP address, destination port and protocol type. If these five types of data are the same for some network sessions, these sessions are considered to be the same session, and there is no risk of port reuse.

[0093] In summary, the port reuse-based risk assessment method proposed in the embodiment of the present application automatically identifies network sessions in each group of specific sessions through quintuple data, which can effectively screen out identical network sessions and avoid the risk of misidentification.

[0094] In some examples, such as Figure 3 and Figure 4 The following is another risk assessment method based on port reuse, which mainly includes:

[0095] Intranet servers are automatically tagged based on traffic volume, session frequency monitoring is configured, and models are configured for different services or applications within the same time period. Intranet server traffic is classified and counted based on destination IP and port. If no network sessions with the same destination IP and port exist, there is no port reuse covert tunnel. If there are network sessions with the same destination IP and port, these sessions are identified based on five-tuple data: IP address, source port, destination IP address, destination port, and protocol type. If these five data types are identical for certain network sessions, they are considered identical and no port reuse covert tunnel exists. If they are not identical sessions, these sessions are identified and, based on the identified traffic type, weighted queries are performed within built-in rules, such as for socks traffic and HTTP proxy traffic. Based on the built-in weights, a confidence rating is assigned to the possible port reuse covert tunnel risk, combined with the session analysis frequency configuration. Risky traffic is stored and an alarm event is generated.

[0096] See also Figure 4 An embodiment of the risk assessment device based on port multiplexing in the embodiment of the present application may include:

[0097] a first acquiring unit 21 configured to acquire network statistical information of different groups of specific sessions, wherein each group of specific sessions includes at least two network sessions, each of the network sessions includes the same destination IP address and destination port, and the network statistical information includes a statistical time range, application type information, and a total number of application types;

[0098] A second obtaining unit 22 is configured to obtain a port reuse confidence level based on the statistical time range, the application type information, and the total number of application types;

[0099] The determining unit 23 is configured to determine a port reuse risk level based on the port reuse confidence level.

[0100] like Figure 5As shown, an embodiment of the present application also provides an electronic device 300, including a memory 310, a processor 320, and a computer program 311 stored in the memory 320 and executable on the processor. When the processor 320 executes the computer program 311, the steps of any of the above-mentioned methods of risk assessment based on port reuse are implemented.

[0101] Since the electronic device introduced in this embodiment is a device used to implement a risk assessment method based on port multiplexing in the embodiment of the present application, based on the method introduced in the embodiment of the present application, technical personnel in this field can understand the specific implementation of the electronic device of this embodiment and its various variations. Therefore, how the electronic device implements the method in the embodiment of the present application is no longer introduced in detail here. As long as the equipment used by technical personnel in this field to implement the method in the embodiment of the present application falls within the scope of protection of this application.

[0102] In the specific implementation process, the computer program 311 can be implemented when executed by the processor Figure 1 Any implementation manner in the corresponding embodiments.

[0103] It should be noted that, in the above embodiments, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant description of other embodiments.

[0104] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0105] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded computer, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0106] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0107] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0108] The present application also provides a computer program product, which includes computer software instructions. When the computer software instructions are executed on a processing device, the processing device is caused to execute the following Figure 1 This corresponds to the process of risk assessment based on port reuse in the embodiment.

[0109] A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function according to the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium can be any available medium that a computer can store or a data storage device such as a server or data center that includes one or more available media integrated. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid state drive (SSD)).

[0110] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0111] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of units is only a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other forms.

[0112] Units described as separate components may or may not be physically separate, and components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0113] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0114] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0115] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the above embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A risk assessment method based on port reuse, characterized in that: include: Obtaining network statistical information of different grouped specific sessions, wherein each group of specific sessions includes at least two network sessions, each of the network sessions includes the same destination IP address and destination port, and the network statistical information includes a statistical time range, application type information, and a total number of application types; Acquire port reuse confidence based on the statistical time range, the application type information, and the total number of application types; A port reuse risk level is determined based on the port reuse confidence level.

2. The method according to claim 1, wherein The obtaining of the port reuse confidence based on the statistical time range, the application type information, and the total number of application types includes: Obtaining a time range coefficient according to the statistical time range; Acquire an application type coefficient through the application type information; The port reuse confidence is determined by the time range coefficient, the application type coefficient, and the total number of application types.

3. The method according to claim 2, wherein The determining of the port reuse confidence by using the time range coefficient, the application type coefficient, and the total number of application types includes: The port reuse confidence is obtained by calculating a quotient of a product of the time range coefficient, the application type coefficient, and the total number of application types.

4. The method according to claim 2, wherein The acquiring the application type coefficient through the application type information includes: In a case where the application type information is a proxy application, setting the application type coefficient to a first application type coefficient; and / or, When the application type information is a common application, setting the application type coefficient to a second application type coefficient; and / or, When the application type information is an unknown application, setting the application type coefficient to a third application type coefficient; The first application type coefficient is greater than the second application type coefficient, and the second application type coefficient is greater than the third application type coefficient.

5. The method according to claim 1, wherein Also includes: When there is no other session with the same destination IP and destination port as the session to be detected, there is no risk of port reuse for the session to be detected.

6. The method according to claim 1, wherein Also includes: When all network sessions in a specific group of sessions are the same network session, there is no risk of port reuse for the group of network sessions.

7. The method according to claim 6, wherein Also includes: Each group of specific sessions is identified based on five-tuple data to distinguish the same session, wherein the five-tuple data includes a source IP address, a source port, a destination IP address, a destination port and a protocol type.

8. A risk assessment device based on port multiplexing, characterized in that: include: a first acquiring unit, configured to acquire network statistical information of different groups of specific sessions, wherein each group of specific sessions includes at least two network sessions, each of the network sessions includes the same destination IP address and destination port, and the network statistical information includes a statistical time range, application type information, and a total number of application types; A second acquiring unit, configured to acquire a port reuse confidence level based on the statistical time range, the application type information, and the total number of application types; A determining unit is configured to determine a port reuse risk level based on the port reuse confidence level.

9. An electronic device comprising: A memory and a processor, wherein the processor is configured to implement the steps of the port multiplexing-based risk assessment method according to any one of claims 1 to 7 when executing a computer program stored in the memory.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the risk assessment method based on port multiplexing according to any one of claims 1 to 7 is implemented.

Images