A traffic data information detection method, device, equipment and storage medium

Abstract

This invention discloses a method, apparatus, device, and storage medium for detecting traffic data information, comprising: acquiring plaintext traffic sample data and encrypted traffic sample data of a target application; determining privacy information tags for the plaintext traffic sample data based on a privacy information database; determining whether there is associated encrypted traffic data corresponding to the plaintext traffic sample data based on the five-tuple information corresponding to the plaintext traffic sample data and the encrypted traffic sample data; if so, determining the privacy information tags for the associated encrypted traffic data based on the privacy information tags for the plaintext traffic sample data; and constructing a encrypted privacy information detection model based on the privacy information tags and feature information corresponding to the associated encrypted traffic data. The technical solution of this invention can ensure the accuracy of privacy detection results in encrypted traffic data.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method, apparatus, device and storage medium for detecting traffic data information. Background Technology

[0002] With the development of mobile internet, analyzing mobile device traffic data has become an important task in the internet industry. By detecting privacy information involved in the traffic data of applications, developers can improve their applications and protect user privacy and security.

[0003] In existing technologies, when detecting privacy information in traffic data, the installation program of the application is usually analyzed to detect which privacy permissions are requested in the installation program, and the privacy information that may be involved in the application traffic data is determined based on these privacy permissions.

[0004] However, existing methods only use privacy permissions to determine whether an application uses a specific device, such as a storage device or a camera, and cannot accurately detect the actual user information involved in the application, thus causing significant misjudgments. Secondly, more and more applications are using encryption technology to protect traffic data when transmitting it, which leads to omissions in privacy information detection results and makes the detection process more difficult. Summary of the Invention

[0005] This invention provides a method, apparatus, device, and storage medium for detecting traffic data information, which can ensure the accuracy of privacy detection results in encrypted traffic data.

[0006] In a first aspect, embodiments of the present invention provide a method for detecting traffic data information, the method comprising:

[0007] Obtain plaintext traffic sample data and encrypted traffic sample data corresponding to the target application, and determine the privacy information tag corresponding to the plaintext traffic sample data according to the preset privacy information database;

[0008] Based on the quintuple information corresponding to the plaintext traffic sample data and the encrypted traffic sample data, determine whether there is associated encrypted traffic data corresponding to the plaintext traffic sample data.

[0009] If there is associated encrypted traffic data corresponding to plaintext traffic sample data, then the privacy information tag corresponding to the associated encrypted traffic data is determined based on the privacy information tag corresponding to the plaintext traffic sample data.

[0010] Based on the privacy information tags corresponding to the associated encrypted traffic data and the feature information corresponding to the associated encrypted traffic data, a ciphertext privacy information detection model is constructed to detect information in subsequent encrypted traffic data of the target application according to the ciphertext privacy information detection model.

[0011] Optionally, after determining whether there is associated encrypted traffic data corresponding to plaintext traffic sample data, the method further includes:

[0012] If there is no associated encrypted traffic data corresponding to the plaintext traffic sample data, a plaintext privacy information detection model is constructed based on the privacy information tag corresponding to the plaintext traffic sample data, so as to detect information in the subsequent plaintext traffic data of the target application according to the plaintext privacy information detection model.

[0013] Optionally, based on a preset privacy information database, determine the privacy information tags corresponding to the plaintext traffic sample data, including:

[0014] Based on the traffic transmission protocol corresponding to the plaintext traffic sample data, the plaintext traffic sample data is parsed to obtain the target information corresponding to the plaintext traffic sample data;

[0015] A preset privacy information database is obtained, and the target information corresponding to the plaintext traffic sample data is matched with the privacy information database to obtain the privacy information tag corresponding to the plaintext traffic sample data.

[0016] Optionally, before constructing the encrypted privacy information detection model based on the privacy information tags corresponding to the associated encrypted traffic data and the feature information corresponding to the associated encrypted traffic data, the method further includes:

[0017] Obtain the original features corresponding to the associated encrypted traffic data, and expand the original features to obtain the updated features corresponding to the associated encrypted traffic data;

[0018] The original features and updated features corresponding to the associated encrypted traffic data are used as the feature information corresponding to the associated encrypted traffic data.

[0019] Optionally, after constructing the encrypted privacy information detection model based on the privacy information tags corresponding to the associated encrypted traffic data and the feature information corresponding to the associated encrypted traffic data, the method further includes:

[0020] Obtain the traffic data to be tested corresponding to the target application, and determine whether the traffic data to be tested is plaintext traffic data;

[0021] If so, the plaintext privacy information detection model is used to detect the traffic data to be tested, and the privacy detection result corresponding to the traffic data to be tested is obtained;

[0022] If not, the encrypted privacy information detection model is used to detect the traffic data to be tested, and the privacy detection result corresponding to the traffic data to be tested is obtained.

[0023] Optionally, after constructing the encrypted privacy information detection model based on the privacy information tags corresponding to the associated encrypted traffic data and the feature information corresponding to the associated encrypted traffic data, the method further includes:

[0024] Obtain multiple traffic data points corresponding to the target application, as well as the privacy detection results corresponding to each traffic data point;

[0025] Based on the privacy detection results corresponding to each traffic data point, a single-user traffic model for the target application is constructed.

[0026] Optionally, after constructing the single-user traffic model corresponding to the target application, the following may also be included:

[0027] Obtain all traffic data of the target application within a preset time period, and determine the first number of users of the target application within the time period based on the unique user identifier corresponding to each traffic data.

[0028] The traffic data is matched with the single-user traffic model to obtain the second number of users corresponding to the target application within the time period.

[0029] The sum of the first number of users and the second number of users is taken as the number of user accesses to the target application during the time period.

[0030] Secondly, embodiments of the present invention also provide a traffic data information detection device, the device comprising:

[0031] The data acquisition module is used to acquire plaintext traffic sample data and encrypted traffic sample data corresponding to the target application, and determine the privacy information tag corresponding to the plaintext traffic sample data according to the preset privacy information database.

[0032] The traffic data judgment module is used to determine whether there is associated encrypted traffic data corresponding to plaintext traffic sample data based on the five-tuple information corresponding to plaintext traffic sample data and encrypted traffic sample data, respectively.

[0033] The information tag determination module is used to determine the privacy information tag corresponding to the associated encrypted traffic data based on the privacy information tag corresponding to the plaintext traffic sample data if there is associated encrypted traffic data corresponding to the plaintext traffic sample data.

[0034] The ciphertext model construction module is used to construct a ciphertext privacy information detection model based on the privacy information tags corresponding to the associated encrypted traffic data and the feature information corresponding to the associated encrypted traffic data, so as to detect information in subsequent encrypted traffic data of the target application based on the ciphertext privacy information detection model.

[0035] Thirdly, embodiments of the present invention also provide an electronic device, the electronic device comprising:

[0036] One or more processors;

[0037] Storage device for storing one or more programs;

[0038] When the one or more programs are executed by the one or more processors, the one or more processors execute the programs to implement the traffic data information detection method provided in any embodiment of the present invention.

[0039] Fourthly, embodiments of the present invention also provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements the traffic data information detection method provided in any embodiment of the present invention.

[0040] Fifthly, embodiments of the present invention also provide a computer program product, the computer program product including a computer program, which, when executed by a processor, implements the traffic data information detection method provided in any embodiment of the present invention.

[0041] The technical solution of this invention provides an effective way to detect privacy information in encrypted traffic data by acquiring plaintext traffic sample data and encrypted traffic sample data corresponding to a target application, determining the privacy information tags of the plaintext traffic sample data based on a privacy information database, determining whether there is associated encrypted traffic data corresponding to the plaintext traffic sample data based on the five-tuple information corresponding to the plaintext traffic sample data and the encrypted traffic sample data, and if so, determining the privacy information tags corresponding to the associated encrypted traffic data based on the privacy information tags corresponding to the plaintext traffic sample data, and constructing a ciphertext privacy information detection model based on the privacy information tags corresponding to the associated encrypted traffic data and feature information. This ensures the accuracy of privacy detection results in encrypted traffic data.

[0042] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0043] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0044] Figure 1 This is a flowchart of a traffic data information detection method provided in Embodiment 1 of the present invention;

[0045] Figure 2 This is a flowchart of a traffic data information detection method according to Embodiment 2 of the present invention;

[0046] Figure 3 This is a flowchart of a traffic data information detection method provided in Embodiment 3 of the present invention;

[0047] Figure 4 This is a schematic diagram of the structure of a traffic data information detection device according to Embodiment 4 of the present invention;

[0048] Figure 5 This is a schematic diagram of the structure of an electronic device that implements the traffic data information detection method of this invention. Detailed Implementation

[0049] The present invention will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it. Furthermore, it should be noted that, for ease of description, the accompanying drawings show only the parts relevant to the present invention, and not all of the structures.

[0050] Example 1

[0051] Figure 1 This is a flowchart of a traffic data information detection method provided in Embodiment 1 of the present invention. This embodiment is applicable to the detection of traffic data in applications. The method can be executed by a traffic data information detection device. The traffic data information detection device can be implemented by software and / or hardware, and is generally integrated into an electronic device with data processing capabilities. Specifically, it includes the following steps:

[0052] Step 110: Obtain plaintext traffic sample data and encrypted traffic sample data corresponding to the target application, and determine the privacy information tag corresponding to the plaintext traffic sample data according to the preset privacy information database.

[0053] In this embodiment, the target application can be an application (APP) that is prepared for information detection. Before performing information detection on the target APP, unencrypted traffic sample data (i.e., plaintext traffic sample data) and encrypted traffic sample data corresponding to the target APP can be obtained first.

[0054] After obtaining the aforementioned sample data, the plaintext traffic sample data can be matched with multiple privacy information items pre-stored in the privacy information database, and the matching results can be used as privacy information tags for the plaintext traffic sample data. Specifically, before obtaining the traffic sample data corresponding to the target APP, a large amount of privacy information related to the APP can be obtained in advance, and a privacy information database can be established based on this privacy information.

[0055] Step 120: Based on the quintuple information corresponding to the plaintext traffic sample data and the encrypted traffic sample data, determine whether there is associated encrypted traffic data corresponding to the plaintext traffic sample data.

[0056] In this step, optionally, the quintuple information of each traffic in the plaintext traffic sample data can be compared with the quintuple information of each traffic in the encrypted traffic sample data, and the encrypted traffic sample data with consistent comparison results can be used as the associated encrypted traffic data corresponding to the plaintext traffic sample data.

[0057] The 5-tuple information may include the source IP address, source port, destination IP address, destination port, and transport layer protocol.

[0058] Step 130: If there is associated encrypted traffic data corresponding to plaintext traffic sample data, then determine the privacy information tag corresponding to the associated encrypted traffic data based on the privacy information tag corresponding to the plaintext traffic sample data.

[0059] In this step, if there is associated encrypted traffic data in the encrypted traffic sample data, the privacy information tag corresponding to the plaintext traffic sample data can be used as the privacy information tag corresponding to the associated encrypted traffic data.

[0060] Step 140: Based on the privacy information tags corresponding to the associated encrypted traffic data and the feature information corresponding to the associated encrypted traffic data, construct a ciphertext privacy information detection model, so as to detect information in subsequent encrypted traffic data of the target application according to the ciphertext privacy information detection model.

[0061] Optionally, in this step, the characteristic information of the associated encrypted traffic data can be obtained based on the transport protocol corresponding to the associated encrypted traffic data. Specifically, assuming that the associated encrypted traffic data corresponds to a Transport Layer Security (TLS) protocol, the TLS protocol version, client request cipher suite list, extended field type list, server name identifier extension, application layer negotiation list, elliptic curve list, server certificate, encrypted application layer data length, and data packet timestamp can be used as the characteristic information corresponding to the associated encrypted traffic data.

[0062] In this step, after obtaining the privacy information tags and feature information corresponding to the associated encrypted traffic data, the privacy information tags and feature information can be used to train a preset machine learning model to obtain a model for detecting privacy information in encrypted traffic data (i.e., a ciphertext privacy information detection model).

[0063] In one specific embodiment, a preset decision tree algorithm can be used to train the machine learning model, and the model parameters can be adjusted in real time based on the training results until the training results meet preset requirements. Specifically, preset indicators (such as query rate and recall rate) can be used to determine whether the training results meet the requirements; if not, the model parameters can be further adjusted.

[0064] In this embodiment, by constructing a encrypted privacy information detection model based on the privacy information tags corresponding to the associated encrypted traffic data and the feature information corresponding to the associated encrypted traffic data, an effective way to detect privacy information in encrypted traffic data is provided. This can avoid misjudgments in privacy detection results and thus improve the accuracy of privacy information detection results for traffic data.

[0065] The technical solution of this invention provides an effective way to detect privacy information in encrypted traffic data by acquiring plaintext traffic sample data and encrypted traffic sample data corresponding to a target application, determining the privacy information tags of the plaintext traffic sample data based on a privacy information database, determining whether there is associated encrypted traffic data corresponding to the plaintext traffic sample data based on the five-tuple information corresponding to the plaintext traffic sample data and the encrypted traffic sample data, and if so, determining the privacy information tags corresponding to the associated encrypted traffic data based on the privacy information tags corresponding to the plaintext traffic sample data, and constructing a ciphertext privacy information detection model based on the privacy information tags corresponding to the associated encrypted traffic data and feature information. This ensures the accuracy of privacy detection results in encrypted traffic data.

[0066] Example 2

[0067] This embodiment is a further refinement of the above embodiments. The same or corresponding terms as those in the above embodiments will not be repeated in this embodiment. Figure 2 This is a flowchart of a traffic data information detection method provided in Embodiment 2. In this embodiment, the technical solution can be combined with one or more methods from the above embodiments, such as... Figure 2 As shown, the method provided in this embodiment may further include:

[0068] Step 210: Obtain plaintext traffic sample data and encrypted traffic sample data corresponding to the target application, and determine the privacy information tag corresponding to the plaintext traffic sample data according to the preset privacy information database.

[0069] In one embodiment of this example, determining the privacy information tag corresponding to plaintext traffic sample data according to a preset privacy information database includes: parsing the plaintext traffic sample data according to the traffic transmission protocol corresponding to the plaintext traffic sample data to obtain target information corresponding to the plaintext traffic sample data; obtaining the preset privacy information database, and matching the target information corresponding to the plaintext traffic sample data with the privacy information database to obtain the privacy information tag corresponding to the plaintext traffic sample data.

[0070] In a specific embodiment, assuming that the plaintext traffic sample data corresponds to the Hypertext Transfer Protocol (HTTP), the plaintext traffic sample data can be parsed according to the HTTP protocol to obtain the following target information: key-value pairs corresponding to the Uniform Resource Identifier (URI) in the GET message, and dictionary-style data corresponding to the DATA data in the POST message, such as key-value pairs in JSON format.

[0071] In this embodiment, the privacy information database pre-stores a number of privacy information items, such as "IMEI": IMEI value, "PHONE": mobile phone number, "MAC": device MAC address, etc.

[0072] In a specific embodiment, each Value in the plaintext traffic sample data parsing result can be compared with each privacy information in the privacy information database to obtain the privacy information carried by the Key in the parsing result, and a matching result (i.e., privacy information tag) can be generated based on this privacy information. For example, {"IMEI": [{"Host": message Host information, "Method": ["GET"|"POST"], "Path": URI path, "Key": matched keyword, "SESSION": 5-tuple information}...], "PHONE":...}.

[0073] Step 220: Based on the quintuple information corresponding to the plaintext traffic sample data and the encrypted traffic sample data, determine whether there is associated encrypted traffic data corresponding to the plaintext traffic sample data. If yes, proceed to steps 230-240; otherwise, proceed to step 250.

[0074] Step 230: Determine the privacy information tag corresponding to the associated encrypted traffic data based on the privacy information tag corresponding to the plaintext traffic sample data.

[0075] Step 240: Based on the privacy information tags corresponding to the associated encrypted traffic data and the feature information corresponding to the associated encrypted traffic data, construct a ciphertext privacy information detection model, so as to detect information in subsequent encrypted traffic data of the target application according to the ciphertext privacy information detection model.

[0076] In one embodiment of this example, before constructing the encrypted privacy information detection model based on the privacy information tag corresponding to the associated encrypted traffic data and the feature information corresponding to the associated encrypted traffic data, the method further includes: obtaining the original feature corresponding to the associated encrypted traffic data, and expanding the original feature to obtain the updated feature corresponding to the associated encrypted traffic data; and using the original feature and the updated feature corresponding to the associated encrypted traffic data as the feature information corresponding to the associated encrypted traffic data.

[0077] In this embodiment, to improve the effectiveness of the encrypted privacy information detection model, the original features corresponding to the associated encrypted traffic data can be expanded before model training to enrich the feature information of the associated encrypted traffic data. Specifically, when expanding the original features, the original features can be processed to obtain updated features, and the original features and updated features are used together as feature information.

[0078] In one specific embodiment, the update characteristics corresponding to the associated encrypted traffic data may include the number of data packets, the total amount of data packets, the TLS fingerprinting method (e.g., JA3 and JA3S), and the communication time length.

[0079] Step 250: Construct a plaintext privacy information detection model based on the privacy information tags corresponding to the plaintext traffic sample data, so as to detect information in subsequent plaintext traffic data of the target application based on the plaintext privacy information detection model.

[0080] In this embodiment, if there is no associated encrypted traffic data corresponding to the plaintext traffic sample data, a model for detecting privacy information in plaintext traffic data (i.e., plaintext privacy information detection model) can be constructed based on the privacy information tags corresponding to the plaintext traffic sample data.

[0081] In one embodiment of this example, after constructing a encrypted privacy information detection model based on the privacy information tags corresponding to the associated encrypted traffic data and the feature information corresponding to the associated encrypted traffic data, the method further includes: obtaining the traffic data to be tested corresponding to the target application, and determining whether the traffic data to be tested belongs to plaintext traffic data; if so, using the plaintext privacy information detection model to detect the traffic data to be tested, and obtaining the privacy detection result corresponding to the traffic data to be tested; if not, using the encrypted privacy information detection model to detect the traffic data to be tested, and obtaining the privacy detection result corresponding to the traffic data to be tested.

[0082] The advantage of this setup is that by using a pre-built model to detect the traffic data to be tested, the time spent on detecting the traffic data to be tested can be saved, and the efficiency of information detection and the accuracy of detection results can be improved.

[0083] The technical solution of this invention provides an effective way to detect privacy information in traffic data by acquiring plaintext traffic sample data and encrypted traffic sample data corresponding to the target application, determining the privacy information tag corresponding to the plaintext traffic sample data based on a privacy information database, and determining whether there is associated encrypted traffic data corresponding to the plaintext traffic sample data based on the five-tuple information corresponding to the plaintext traffic sample data and the encrypted traffic sample data, if so, determining the privacy information tag corresponding to the associated encrypted traffic data based on the privacy information tag corresponding to the plaintext traffic sample data, and constructing a encrypted privacy information detection model based on the privacy information tag corresponding to the associated encrypted traffic data and feature information; if not, constructing a plaintext privacy information detection model based on the privacy information tag corresponding to the plaintext traffic sample data. This method ensures the accuracy of privacy information detection results in traffic data.

[0084] Example 3

[0085] This embodiment is a further refinement of the above embodiments. The same or corresponding terms as those in the above embodiments will not be repeated in this embodiment. Figure 3This is a flowchart of a traffic data information detection method provided in Embodiment 3. In this embodiment, the technical solution can be combined with one or more methods from the above embodiments, such as... Figure 3 As shown, the method provided in this embodiment may further include:

[0086] Step 301: Obtain plaintext traffic sample data and encrypted traffic sample data corresponding to the target application, and determine the privacy information tag corresponding to the plaintext traffic sample data according to the preset privacy information database.

[0087] Step 302: Based on the quintuple information corresponding to the plaintext traffic sample data and the encrypted traffic sample data, determine whether there is associated encrypted traffic data corresponding to the plaintext traffic sample data. If yes, proceed to steps 303-304; otherwise, proceed to step 305.

[0088] Step 303: Determine the privacy information tag corresponding to the associated encrypted traffic data based on the privacy information tag corresponding to the plaintext traffic sample data.

[0089] Step 304: Based on the privacy information tags corresponding to the associated encrypted traffic data and the feature information corresponding to the associated encrypted traffic data, construct a ciphertext privacy information detection model, so as to detect information in subsequent encrypted traffic data of the target application according to the ciphertext privacy information detection model.

[0090] Step 305: Construct a plaintext privacy information detection model based on the privacy information tags corresponding to the plaintext traffic sample data, so as to detect information in subsequent plaintext traffic data of the target application based on the plaintext privacy information detection model.

[0091] Step 306: Obtain multiple traffic data corresponding to the target application, and the privacy detection results corresponding to each traffic data.

[0092] In this step, the multiple traffic data may include both plaintext and encrypted traffic data. Specifically, the aforementioned encrypted privacy information detection model or plaintext privacy information detection model can be used to detect each traffic data and obtain the privacy detection results for each traffic data.

[0093] Step 307: Based on the privacy detection results corresponding to each traffic data, construct a single-user traffic model for the target application.

[0094] In this embodiment, the single-user traffic model is used to characterize the access patterns of a single user to the app. Optionally, after obtaining the privacy detection results corresponding to each traffic data, a single-user traffic model can be constructed based on the user access behavior corresponding to different traffic data. Specifically, since different user access behaviors of the same app have similarities and differences, and the same user access behavior corresponding to the same app has repetition, a single-user traffic model can be constructed based on the domain names accessed by users within a unit of time, the access order, frequency, and duration patterns of each domain name.

[0095] In a specific embodiment, after obtaining the privacy detection results corresponding to each traffic data point, a single-user traffic model needs to be constructed based on the following scenarios: a single user accessing the app multiple times, and multiple users accessing the app simultaneously. For the first scenario, it is necessary to calculate the similarity between users corresponding to multiple traffic data points. If the similarity exceeds a preset threshold, it is considered that these multiple traffic data points originate from the same user, and therefore, these multiple traffic data points can be merged and deduplicated. For the second scenario, if a single traffic data point can correspond to multiple users within the same time interval (i.e., user access behaviors overlap), then the multiple traffic data points can be split.

[0096] In this embodiment, when constructing a single-user traffic model, a penalty factor can be determined based on the number of user accesses corresponding to other apps with unique identifiers, and the parameters of the single-user traffic model can be adjusted according to the penalty factor.

[0097] Step 308: Obtain all traffic data corresponding to the target application within a preset time period, and determine the first number of users corresponding to the target application within the time period based on the unique user identifier corresponding to each traffic data.

[0098] In this embodiment, all traffic data may include plaintext traffic data and encrypted traffic data. For traffic data with unique user identifiers (e.g., plaintext traffic data corresponds to a unique identifier, and encrypted traffic data corresponds to a unique fingerprint), the unique user identifiers can be statistically analyzed to obtain the first number of users corresponding to the target application within the stated time period.

[0099] Step 309: Match each traffic data with the single-user traffic model to obtain the number of second users corresponding to the target application within the time period.

[0100] In this embodiment, there may be traffic data that does not have a unique user identifier among all traffic data. In this case, these traffic data can be matched with the single-user traffic model to obtain the number of users that meet the single-user traffic model (i.e., the second number of users).

[0101] Step 310: Take the sum of the first number of users and the second number of users as the number of user accesses of the target application during the time period.

[0102] The advantage of this setup is that, compared to existing technologies that determine the number of users accessing an application solely based on the unique user identifier corresponding to traffic data, it can improve the accuracy of the application's user count calculation.

[0103] The technical solution of this invention obtains plaintext traffic sample data and encrypted traffic sample data of a target application, determines privacy information tags for the plaintext traffic sample data based on a privacy information database, determines whether there is associated encrypted traffic data based on the five-tuple information of each traffic sample data, if so, determines the privacy information tags corresponding to the associated encrypted traffic data based on the privacy information tags corresponding to the plaintext traffic sample data, and constructs a encrypted privacy information detection model based on the privacy information tags corresponding to the associated encrypted traffic data and feature information; if not, constructs a plaintext privacy information detection model based on the privacy information tags corresponding to the plaintext traffic sample data, obtains privacy detection results corresponding to multiple traffic data of the target application, constructs a single-user traffic model for the target application, obtains all traffic data of the target application within a preset time period, determines the first number of users based on the unique user identifier corresponding to each traffic data, matches each traffic data with the single-user traffic model to obtain the second number of users, and uses the sum of the first number of users and the second number of users as the number of user accesses of the target application within the time period. This technical means can ensure the accuracy of privacy information detection results in traffic data and improve the accuracy of application user count calculation results.

[0104] The acquisition of traffic data and the detection of privacy information related to traffic data in the technical solutions of this invention comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0105] Example 4

[0106] Figure 4 This is a schematic diagram of the structure of a traffic data information detection device provided in Embodiment 4 of the present invention, as shown below. Figure 4 As shown, the device includes: a data acquisition module 410, a traffic data judgment module 420, an information tag determination module 430, and a ciphertext model construction module 440.

[0107] The data acquisition module 410 is used to acquire plaintext traffic sample data and encrypted traffic sample data corresponding to the target application, and determine the privacy information tag corresponding to the plaintext traffic sample data according to the preset privacy information database.

[0108] The traffic data judgment module 420 is used to determine whether there is associated encrypted traffic data corresponding to plaintext traffic sample data based on the five-tuple information corresponding to plaintext traffic sample data and encrypted traffic sample data respectively.

[0109] The information tag determination module 430 is used to determine the privacy information tag corresponding to the associated encrypted traffic data based on the privacy information tag corresponding to the plaintext traffic sample data if there is associated encrypted traffic data corresponding to the plaintext traffic sample data.

[0110] The ciphertext model building module 440 is used to build a ciphertext privacy information detection model based on the privacy information tags corresponding to the associated encrypted traffic data and the feature information corresponding to the associated encrypted traffic data, so as to detect information in subsequent encrypted traffic data of the target application based on the ciphertext privacy information detection model.

[0111] The technical solution provided by this invention obtains plaintext traffic sample data and encrypted traffic sample data corresponding to a target application, determines the privacy information tag of the plaintext traffic sample data based on a privacy information database, and determines whether there is associated encrypted traffic data corresponding to the plaintext traffic sample data based on the five-tuple information corresponding to the plaintext traffic sample data and the encrypted traffic sample data, and if so, determines the privacy information tag corresponding to the associated encrypted traffic data based on the privacy information tag corresponding to the plaintext traffic sample data, and constructs a ciphertext privacy information detection model based on the privacy information tag corresponding to the associated encrypted traffic data and feature information, so as to perform information detection on subsequent encrypted traffic data based on the ciphertext privacy information detection model. This provides an effective way to detect privacy information in encrypted traffic data and ensures the accuracy of privacy detection results in encrypted traffic data.

[0112] Based on the above embodiments, the data acquisition module 410 includes:

[0113] The data parsing unit is used to parse the plaintext traffic sample data according to the traffic transmission protocol corresponding to the plaintext traffic sample data to obtain the target information corresponding to the plaintext traffic sample data.

[0114] The information matching unit is used to obtain a preset privacy information database, match the target information corresponding to the plaintext traffic sample data with the privacy information database, and obtain the privacy information tag corresponding to the plaintext traffic sample data.

[0115] The traffic data judgment module 420 includes:

[0116] The plaintext model construction unit is used to construct a plaintext privacy information detection model based on the privacy information tag corresponding to the plaintext traffic sample data if there is no associated encrypted traffic data corresponding to the plaintext traffic sample data. The model is then used to detect information in subsequent plaintext traffic data of the target application.

[0117] The ciphertext model building module 440 includes:

[0118] The feature extension unit is used to obtain the original features corresponding to the associated encrypted traffic data, and to extend the original features to obtain the updated features corresponding to the associated encrypted traffic data.

[0119] The feature determination unit is used to take the original features and updated features corresponding to the associated encrypted traffic data as feature information corresponding to the associated encrypted traffic data.

[0120] The traffic data information detection device further includes:

[0121] The test data acquisition module is used to acquire the test traffic data corresponding to the target application and determine whether the test traffic data is plaintext traffic data. If it is, the plaintext privacy information detection model is used to detect the test traffic data to obtain the privacy detection result corresponding to the test traffic data. If not, the encrypted privacy information detection model is used to detect the test traffic data to obtain the privacy detection result corresponding to the test traffic data.

[0122] The detection result acquisition module is used to acquire multiple traffic data corresponding to the target application, as well as the privacy detection results corresponding to each traffic data.

[0123] The single-user module building module is used to build a single-user traffic model for the target application based on the privacy detection results corresponding to each traffic data.

[0124] The first quantity statistics module is used to obtain all traffic data of the target application within a preset time period, and determine the first number of users of the target application within the time period based on the unique user identifier corresponding to each traffic data.

[0125] The second quantity statistics module is used to match each traffic data with the single-user traffic model to obtain the second number of users corresponding to the target application within the time period.

[0126] The user count determination module is used to take the sum of the first user count and the second user count as the number of user accesses to the target application within the time period.

[0127] The above-described apparatus can execute the methods provided in all the foregoing embodiments of the present invention, and has the corresponding functional modules and beneficial effects for executing the above methods. Technical details not described in detail in the embodiments of the present invention can be found in the methods provided in all the foregoing embodiments of the present invention.

[0128] Example 5

[0129] Figure 5 A schematic diagram of an electronic device 10 that can be used to implement embodiments of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0130] like Figure 5 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 may also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0131] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0132] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as traffic data information detection methods.

[0133] In some embodiments, the traffic data information detection method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the traffic data information detection method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the traffic data information detection method by any other suitable means (e.g., by means of firmware).

[0134] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0135] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0136] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0137] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0138] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0139] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0140] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and no limitation is imposed herein.

[0141] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for detecting traffic flow data information, characterized in that, The method includes: Obtain plaintext traffic sample data and encrypted traffic sample data corresponding to the target application, and determine the privacy information tag corresponding to the plaintext traffic sample data according to the preset privacy information database; Based on the quintuple information corresponding to the plaintext traffic sample data and the encrypted traffic sample data, determine whether there is associated encrypted traffic data corresponding to the plaintext traffic sample data. If there is associated encrypted traffic data corresponding to plaintext traffic sample data, then the privacy information tag corresponding to the associated encrypted traffic data is determined based on the privacy information tag corresponding to the plaintext traffic sample data. Based on the privacy information tags corresponding to the associated encrypted traffic data and the feature information corresponding to the associated encrypted traffic data, a ciphertext privacy information detection model is constructed to detect information in subsequent encrypted traffic data of the target application according to the ciphertext privacy information detection model. Obtain multiple traffic data points corresponding to the target application, as well as the privacy detection results corresponding to each traffic data point; construct a single-user traffic model for the target application based on the privacy detection results corresponding to each traffic data point; the single-user traffic model is used to characterize the access patterns of a single user to the APP; Obtain all traffic data of the target application within a preset time period, and determine the first number of users of the target application within the time period based on the unique user identifier corresponding to each traffic data. Traffic data without unique user identifiers is matched with a single-user traffic model to obtain the number of second users corresponding to the target application within the time period. The sum of the first number of users and the second number of users is taken as the number of user accesses to the target application during the time period.

2. The method according to claim 1, characterized in that, After determining whether there is associated encrypted traffic data corresponding to plaintext traffic sample data, the process also includes: If there is no associated encrypted traffic data corresponding to the plaintext traffic sample data, a plaintext privacy information detection model is constructed based on the privacy information tag corresponding to the plaintext traffic sample data, so as to detect information in the subsequent plaintext traffic data of the target application according to the plaintext privacy information detection model.

3. The method according to claim 1, characterized in that, Based on a pre-defined privacy information database, determine the privacy information tags corresponding to the plaintext traffic sample data, including: Based on the traffic transmission protocol corresponding to the plaintext traffic sample data, the plaintext traffic sample data is parsed to obtain the target information corresponding to the plaintext traffic sample data; A preset privacy information database is obtained, and the target information corresponding to the plaintext traffic sample data is matched with the privacy information database to obtain the privacy information tag corresponding to the plaintext traffic sample data.

4. The method according to claim 1, characterized in that, Before constructing the encrypted privacy information detection model based on the privacy information tags corresponding to the associated encrypted traffic data and the feature information corresponding to the associated encrypted traffic data, the following steps are also included: Obtain the original features corresponding to the associated encrypted traffic data, and expand the original features to obtain the updated features corresponding to the associated encrypted traffic data; The original features and updated features corresponding to the associated encrypted traffic data are used as the feature information corresponding to the associated encrypted traffic data.

5. The method according to claim 2, characterized in that, After constructing the encrypted privacy information detection model based on the privacy information tags corresponding to the associated encrypted traffic data and the feature information corresponding to the associated encrypted traffic data, the method further includes: Obtain the traffic data to be tested corresponding to the target application, and determine whether the traffic data to be tested is plaintext traffic data; If so, the plaintext privacy information detection model is used to detect the traffic data to be tested, and the privacy detection result corresponding to the traffic data to be tested is obtained; If not, the encrypted privacy information detection model is used to detect the traffic data to be tested, and the privacy detection result corresponding to the traffic data to be tested is obtained.

6. A traffic flow data information detection device, characterized in that, The device includes: The data acquisition module is used to acquire plaintext traffic sample data and encrypted traffic sample data corresponding to the target application, and determine the privacy information tag corresponding to the plaintext traffic sample data according to the preset privacy information database. The traffic data judgment module is used to determine whether there is associated encrypted traffic data corresponding to plaintext traffic sample data based on the five-tuple information corresponding to plaintext traffic sample data and encrypted traffic sample data, respectively. The information tag determination module is used to determine the privacy information tag corresponding to the associated encrypted traffic data based on the privacy information tag corresponding to the plaintext traffic sample data if there is associated encrypted traffic data corresponding to the plaintext traffic sample data. The ciphertext model building module is used to build a ciphertext privacy information detection model based on the privacy information tags corresponding to the associated encrypted traffic data and the feature information corresponding to the associated encrypted traffic data, so as to detect information in the subsequent encrypted traffic data of the target application based on the ciphertext privacy information detection model. The device is further configured to: acquire multiple traffic data corresponding to the target application, and privacy detection results corresponding to each traffic data; construct a single-user traffic model corresponding to the target application based on the privacy detection results corresponding to each traffic data; the single-user traffic model is used to characterize the access patterns of a single user to the APP; acquire all traffic data corresponding to the target application within a preset time period, and determine the first number of users corresponding to the target application within the time period based on the unique user identifier corresponding to each traffic data; match traffic data without a unique user identifier with the single-user traffic model to obtain the second number of users corresponding to the target application within the time period; and take the sum of the first number of users and the second number of users as the number of user accesses to the target application within the time period.

7. An electronic device, the electronic device comprising: One or more processors; Storage device for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors execute the programs to implement the traffic data information detection method as described in any one of claims 1-5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by the processor, the program implements the traffic data information detection method as described in any one of claims 1-5.

Images