A flow identification method, device, equipment and computer storage medium

Abstract

The present application discloses a traffic identification method, device, equipment and computer storage medium. The method includes: obtaining a first Hypertext Transfer Protocol Security (HTTPS) traffic; identifying the first HTTPS traffic according to a rule base to obtain a first full-scale identified XDR call list and an unidentified second HTTPS traffic; extracting a target feature vector of the second HTTPS traffic to obtain an unidentified XDR call list; inputting the unidentified XDR call list into a target identification model, identifying the unidentified XDR call list through the target identification model, and obtaining a second full-scale identified XDR call list; the target identification model is trained with the feature vector of the HTTPS traffic sample as input and the traffic type of the HTTPS traffic sample as output. The traffic identification method disclosed in the present application identifies HTTPS traffic by combining a target identification model with a rule base, thereby improving the ability to identify network traffic types and realizing a wide range of network traffic types.

Description

Technical Field

[0001] The present application belongs to the field of big data business, and in particular relates to a traffic identification method, device and computer storage medium. Background Art

[0002] With the rapid development of the Internet, Internet security has become a focus of attention. As a result, Hyper Text Transfer Protocol over Secure Socket Layer (HTTPS) has been adopted by more and more application software, and the proportion of HTTPS traffic has also increased.

[0003] Since the HTTPS protocol adds the TLS / SSL protocol to the Hyper Text Transfer Protocol (HTTP) to encrypt the transmitted data at layer 4.5, which is different from the plain text transmission of the HTTP protocol, the deep packet inspection (DPI) technology can go deep into the application layer to identify the HTTP traffic service type. Therefore, current operators use brute force decryption, man-in-the-middle attacks and exploit Secure Sockets Layer (SSL) protocol vulnerabilities to decrypt and identify HTTPS traffic. In addition, operators also use the correlation between the IP address and other related information between HTTP traffic and HTTPS traffic to cooperate with the DPI system to identify the HTTPS traffic service type.

[0004] However, the identification of HTTPS traffic types through the former method itself has certain ethical and legal constraints, and is very consuming and generally inefficient. It cannot achieve large-scale batch processing of HTTPS traffic and cannot be applied to existing DPI systems. Although the latter method can identify HTTPS traffic types, it can only identify a limited range, and most HTTPS traffic business types cannot be identified.

[0005] In summary, the prior art has the problem that the HTTPS traffic type identification capability is poor and cannot realize large-scale identification of HTTPS traffic types. Summary of the invention

[0006] The embodiments of the present application provide a traffic identification method, device, and computer storage medium, which can greatly improve the identifiable ability of HTTPS traffic types and realize large-scale identification of network traffic types.

[0007] In a first aspect, a traffic identification method is provided, comprising: obtaining first Hypertext Transfer Protocol Security (HTTPS) traffic;

[0008] Identify the first HTTPS traffic according to the rule base to obtain the first full amount of identified XDR call records and the unidentified second HTTPS traffic;

[0009] Extract the target feature vector of the second HTTPS traffic to obtain an unidentified XDR call record;

[0010] Inputting the unrecognized XDR call record into the target recognition model, and recognizing the unrecognized XDR call record by the target recognition model to obtain a second full amount of recognized XDR call records;

[0011] The target recognition model is trained by taking the feature vector of the HTTPS traffic sample as input and the traffic type of the HTTPS traffic sample as output.

[0012] In one embodiment, the method includes:

[0013] The target recognition model includes convolutional layers, pooling layers, and fully connected layers.

[0014] Inputting the unrecognized XDR call record into the target recognition model, and recognizing the unrecognized XDR call record by the target recognition model to obtain a second full amount of recognized XDR call records, specifically including:

[0015] The common features of the unidentified XDR call records are extracted according to the convolution layer to obtain a feature map of the unidentified XDR call records;

[0016] The key features in the feature graph of the unrecognized XDR call record are filtered out according to the pooling layer to obtain a reduced-dimensional feature graph of the unrecognized XDR call record;

[0017] The dimensionality reduction feature graph of the unrecognized XDR call record is classified and identified according to the fully connected layer to obtain the second full amount of recognized XDR call records.

[0018] In one embodiment, the method comprises:

[0019] The rule base includes a certificate base and an associated identification base;

[0020] The first HTTPS traffic is identified according to the rule base to obtain the first full amount of identified XDR call records and the unidentified second HTTPS traffic, specifically including:

[0021] Get the certificate information of the first HTTPS traffic;

[0022] Match the certificate information with the preset information of the certificate library to obtain a third identified XDR call record and an unidentified third HTTPS traffic, wherein the third identified XDR call record includes a traffic type corresponding to the certificate information matching the preset information, and the third HTTPS traffic includes a first HTTPS traffic corresponding to the certificate information not matching the preset information;

[0023] Decoding the Internet Protocol IP five-tuple information of the third HTTPS traffic to obtain the first IP address information of the third HTTPS traffic;

[0024] Extracting first non-HTTPS traffic consistent with the first IP address information;

[0025] Get the key information of the first non-HTTPS traffic;

[0026] Identify key information according to preset information of the associated identification library to obtain a fourth identified XDR call record and an unidentified second HTTPS traffic;

[0027] The third identified XDR call record and the fourth identified XDR call record are integrated to obtain the first full amount of identified call records.

[0028] In a second aspect, a flow identification device is provided, comprising:

[0029] A first acquisition module, used for acquiring a first HTTPS flow;

[0030] A first identification module is used to identify the first HTTPS traffic according to the rule base to obtain a first full amount of identified XDR call records and an unidentified second HTTPS traffic;

[0031] A first extraction module is used to extract a feature vector of the second HTTPS traffic to obtain an unidentified XDR call record;

[0032] A target identification module, used for identifying the input unidentified XDR call record to obtain a second full amount of identified XDR call records;

[0033] The target recognition module is trained by taking the feature vector of the HTTPS traffic sample as input and the traffic type of the HTTPS traffic sample as output.

[0034] In one embodiment, the device comprises:

[0035] The first identification module includes a second acquisition module, a certificate module, a decoding module, an extraction module, a third acquisition module, an associated identification module, and an integration module, wherein:

[0036] A second acquisition module, used to obtain the certificate information of the first HTTPS traffic;

[0037] A certificate module, used to match the certificate information with the preset information of the certificate library, to obtain a third identified XDR call record and an unidentified third HTTPS traffic, wherein the third identified XDR call record includes a traffic type corresponding to the certificate information that matches the preset information, and the third HTTPS traffic includes a first HTTPS traffic corresponding to the certificate information that does not match the preset information;

[0038] A decoding module, used for decoding the IP five-tuple information of the third HTTPS traffic to obtain the first IP address information of the third HTTPS traffic;

[0039] An extraction module, used to extract first non-HTTPS traffic consistent with the first IP address information;

[0040] A third acquisition module is used to obtain key information of the first non-HTTPS traffic;

[0041] An association identification module, used to identify key information according to preset information of the association identification library, and obtain a fourth identified XDR call record and the unidentified second HTTPS traffic;

[0042] An integration module is used to integrate the third identified XDR call record with the fourth identified XDR call record to obtain a first full-quantity identified call record.

[0043] According to a third aspect, a computer storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, a traffic identification method as provided in an embodiment of the present application is implemented.

[0044] Compared with the prior art, the traffic identification method provided in the embodiment of the present application can obtain the first full amount of identified XDR call records and the unidentified second HTTPS traffic corresponding to the part of HTTPS traffic that can be identified, after using the rule base to identify the first HTTPS traffic. Then, the target feature vector of the second HTTPS traffic is extracted to obtain the unidentified XDR call record, and then the unidentified XDR call record is identified using the target identification model to obtain the second full amount of identified XDR call records. In this way, the embodiment of the present application not only uses the rule base to identify part of the HTTPS traffic, but also uses the target identification model to identify the HTTPS traffic that has not been identified using the identification library, so that more HTTPS traffic can be identified.

[0045] In addition, by combining the rule base outside the target recognition model to identify HTTPS traffic, the overall range of identifiable HTTPS traffic is expanded, the recognition capability and range of HTTPS traffic are improved, and there is no attack on HTTPS traffic. The efficiency of HTTPS traffic identification is improved while overcoming ethical and legal constraints. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solution of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0047] Figure 1 It is a schematic diagram of a method for identifying HTTP traffic in the prior art;

[0048] Figure 2 It is the corresponding relationship diagram between the payload information of a certain HTTPS traffic and the grayscale image;

[0049] Figure 3 Schematic diagram of a flow identification solution in an embodiment of the present application

[0050] Figure 4 It is a flow chart of the flow identification method of the embodiment of the present application;

[0051] Figure 5 It is a flowchart of the rule base identification method of the embodiment of the present application;

[0052] Figure 6 This is a schematic diagram of the same-source IP association identification process in an embodiment of the present application;

[0053] Figure 7 This is a schematic diagram of the same-source DNS query association identification process in an embodiment of the present application;

[0054] Figure 8 It is a flowchart of a method for obtaining a target feature vector according to an embodiment of the present application;

[0055] Fig. 9 This is a schematic diagram of the target recognition model training process in an embodiment of the present application;

[0056] Fig.10 It is a schematic diagram of the recognition method flow of the target recognition model of the embodiment of the present application;

[0057] Fig.11 This is a schematic diagram of the application scenario of the DPI system of the embodiment of the present application;

[0058] Fig.12 It is a schematic diagram of the structure of the flow identification device according to an embodiment of the present application. DETAILED DESCRIPTION

[0059] The features and exemplary embodiments of various aspects of the present application will be described in detail below. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain the present application, rather than to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is only to provide a better understanding of the present application by illustrating the examples of the present application.

[0060] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "include..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0061] First, the professional terms involved in this application specification are introduced:

[0062] Packet: Data packet, packet or grouping is the result of packaging network traffic information.

[0063] IP quintuple information: a collection of information consisting of source IP address, source port, destination IP address, destination port and transport layer protocol.

[0064] XDR: x Detailed Record, a general term for all types of service detailed records.

[0065] Domain Name System: DNS is a distributed database on the Internet that maps domain names to IP addresses. It enables users to access the Internet more conveniently without having to remember IP number strings that can be directly read by machines.

[0066] DNS query: In this application, it refers to querying the resource records on the DNS server to obtain the IP address, alias record and other information corresponding to the domain name.

[0067] Max Pooling function: One of the pooling functions, used to find the maximum value function in each matrix window

[0068] Deep packet inspection, DPI, is a system for monitoring, analyzing and managing Internet traffic in the operator's network channel. It consists of hardware and software, and generally includes a user acquisition machine and a synthesis layer.

[0069] In the existing technology, since HTTPS traffic is encrypted at layer 4.5, it is impossible to obtain valid information above the transport layer, making it impossible for operators to Figure 1 After obtaining the IP five-tuple information of the traffic as in the method for identifying HTTP traffic in the prior art shown, it is also possible to deeply mine the application protocol header information and payload information of the traffic to identify the type of traffic corresponding to the traffic. Although the operator will use the association relationship between the IP address and other related information between HTTP traffic and HTTPS traffic to cooperate with the DPI system to identify the HTTPS traffic type, its identification range is limited, which overall limits the operator's ability to identify HTTPS traffic and the large-scale identification of HTTPS traffic.

[0070] The inventor found that although the payload information of HTTPS traffic captured by the operator cannot clearly indicate the meaning of the information, the range of each byte is between 00 and FF, which just corresponds to 0 to 255 of the grayscale image (0 is black and 255 is white). Therefore, the payload information can be converted into the corresponding grayscale image, as shown in the following figure. Figure 2 The inventor then found that the texture features of the grayscale image correspond to the traffic type of HTTPS traffic, and that different traffic types have different texture features. In addition, the inventor also found that after capturing the packet information of HTTPS traffic, some one-dimensional vector information obtained also has one-dimensional feature information similar to the texture features of the grayscale image obtained through the load information. In addition, the inventor also found that some of the plaintext information carried by the packets of HTTPS traffic contains highly directional information, and the type of some HTTPS traffic can be obtained by parsing this information.

[0071] Therefore, the inventor adopts a "white box" + "black box" approach to Figure 3Taking the schematic diagram of a traffic identification method of the present application as an example, the "white box" + "black box" method is mainly as follows: first, according to the network protocol of the transport layer security (TLS) in the identification data of the collected data, the HTTPS traffic with the network protocol being HTTPS is obtained; secondly, the certificate information matching the HTTPS traffic is queried through the SSL certificate library in the "white box", and the traffic type of the HTTPS traffic can be obtained after a successful match, and the HTTPS traffic that cannot be matched by the SSL certificate library is supplemented by the identification of the SSL library through the IP and DNS association identification in the "white box", and the result is output together with the result of the SSL certificate library as identification result 1; thirdly, the HTTPS traffic that cannot be identified by the SSL certificate library in the "white box" and the IP and DNS association identification is identified through the "black box", specifically, the TLS header information and other information such as the payload of the HTTPS traffic that the "white box" cannot identify is extracted, and then the HTTPS traffic is identified by training a convolutional neural network (CNN), and the identification result is output as identification result 2, and the identification result 1 and the identification result 2 are used as the HTTPS traffic identification results, and the final identification result is output. The inventors improved the recognition and capability of HTTPS traffic through the “white box” + “black box” method.

[0072] In order to solve the problem that the prior art has poor HTTPS traffic type identification capability and cannot realize large-scale identification of HTTPS traffic types, the embodiments of the present application provide a traffic identification method, apparatus, device and computer storage medium. The traffic identification method provided by the embodiments of the present application is first introduced below.

[0073] Figure 4 The flow chart of the flow identification method of the embodiment of the present application is shown, and the method shown includes:

[0074] S410, obtaining first Hypertext Transfer Protocol Security (HTTPS) traffic;

[0075] S420, identifying the first HTTPS traffic according to the rule base, and obtaining a first full amount of identified XDR call records and unidentified second HTTPS traffic;

[0076] S430, extracting a target feature vector of the second HTTPS traffic to obtain an unidentified XDR call record;

[0077] S440, inputting the unrecognized XDR call records into the target recognition model, and recognizing the unrecognized XDR call records through the target recognition model to obtain a second full amount of recognized XDR call records;

[0078] The target recognition model is trained by taking the feature vector of the HTTPS traffic sample as input and the traffic type of the HTTPS traffic sample as output.

[0079] In an embodiment of the present application, a method for traffic identification is provided. After the first HTTPS traffic is identified by using a rule base, a first full amount of identified XDR call records corresponding to the part of the HTTPS traffic that can be identified and an unidentified second HTTPS traffic are obtained. Then, the target feature vector of the second HTTPS traffic is extracted to obtain an unidentified XDR call record. After that, the unidentified XDR call record is identified by a target identification model to obtain a second full amount of identified call records. In this way, the identification result of the first HTTPS traffic can be obtained. A part of the traffic is identified by the rule base, and the traffic that is not identified by the rule base is identified by the target identification model. The combination of the two expands the range of identifiable HTTPS traffic. Using the target identification model to identify the traffic that is not identified by the rule base further improves the overall identification capability of HTTPS traffic.

[0080] The above steps are described in detail below.

[0081] In S410, specifically, at least one HTTPS traffic is obtained as the first HTTPS traffic.

[0082] In one embodiment, HTTPS traffic can be captured by a network packet capture tool and / or system, which is not limited in the present application. The original code stream data on the network can also be captured by a DPI system. The DPI system separates the code stream data with the network protocol as HTTPS based on the network protocol information in the original code stream data, and uses it as the first HTTPS traffic, so that the traffic types subsequently identified are all HTTPS traffic, thereby avoiding identification errors and improving the accuracy of identifying HTTPS traffic.

[0083] The above is a specific implementation of S410 , and the following describes a specific implementation of S420 .

[0084] In S420, specifically, the first HTTPS traffic is identified through the rule base, and the identification result is saved in the XDR call record to obtain the first full amount of identified XDR call record, and the first HTTPS traffic that cannot be identified by the rule base is used as the unidentified second HTTPS traffic.

[0085] In one embodiment, the rule base in the embodiment of the present application may include a certificate base and an associated identification base, and S420 may include the following: Figure 5 The flowchart of the rule base identification method of the embodiment of the present application is shown, and the method shown includes:

[0086] S421, obtaining certificate information of the first HTTPS traffic;

[0087] S422, matching the certificate information with the preset certificate information in the certificate library, and obtaining a third identified XDR bill and an unidentified third HTTPS traffic, wherein the third identified XDR bill includes a traffic type corresponding to the certificate information matching the preset certificate information, and the third HTTPS traffic includes the first HTTPS traffic corresponding to the certificate information not matching the preset information;

[0088] S423, decoding the Internet Protocol IP quintuple information of the third HTTPS traffic to obtain the first IP address information of the third HTTPS traffic;

[0089] S424, extracting first non-HTTPS traffic consistent with the first IP address information;

[0090] S425, obtaining key information of the first non-HTTPS traffic;

[0091] S426, identifying key information according to preset information of the associated identification library, and obtaining a fourth identified XDR call record and an unidentified second HTTPS traffic;

[0092] S427: Integrate the third identified XDR call record with the fourth identified XDR call record to obtain the first full identified call record.

[0093] This embodiment uses the certificate library to identify the first HTTSP traffic, obtains the third identified XDR bill and the third HTTPS traffic, and then uses the associated identification library to identify the first non-HTTPS traffic to obtain the fourth identified XDR bill, and then obtains the first full identified XDR bill by integrating the third identified XDR bill and the fourth identified XDR bill, identifies part of the first HTTPS traffic through the certificate library, and then identifies the third HTTPS traffic that is not identified by the certificate library through the associated identification library, thereby expanding the identification scope of the first HTTPS traffic. In addition, the certificate information and IP address information of the first HTTPS traffic can be obtained by parsing the plaintext information of the HTTPS traffic, without extracting other characteristic information, thereby improving the efficiency of information acquisition and further improving the efficiency of identifying HTTPS traffic.

[0094] The following is a detailed introduction to S421-S427.

[0095] In S421, specifically, at least one certificate information of the first HTTPS traffic is obtained. In one embodiment, the certificate information may include server name ServerName information. The obtained ServerName information has strong directionality, and the traffic type of the HTTPS traffic can be identified through the ServerName information.

[0096] For example, the ServerName information of a certain HTTPS traffic obtained is "zos.alipayobjects.com", where the traffic type pointed to by "alipay" is Alipay service, then the traffic type of the HTTPS traffic is Alipay service.

[0097] In S422, specifically, the preset certificate information of the certificate library corresponds to the traffic type. After the certificate information of the first HTTPS traffic successfully matches the preset certificate information, the traffic type of the first HTTPS traffic is the traffic type corresponding to the preset certificate information. The identification result of the first HTTPS traffic is saved in the XDR call record, and a third identified XDR call record is obtained. The certificate library cannot identify that the traffic type of the first HTTPS traffic is the third HTTPS traffic.

[0098] In one embodiment, failure to identify the traffic type of the first HTTPS traffic through the certificate library may include that part or all of the acquired certificate information of the first HTTPS traffic does not match the preset certificate information in the certificate library.

[0099] In S423, specifically, the IP 5-tuple information of the third HTTPS traffic is decoded to obtain the IP address of the third HTTPS traffic.

[0100] In S424, specifically, the IP quintuple information of the non-HTTPS traffic is decoded, and when the IP address in the IP quintuple information is consistent with the first IP address, the non-HTTPS traffic corresponding to the IP address is the first non-HTTPS traffic.

[0101] It is worth noting that the tool for decoding IP quintuple information can be a decoder or a called decoding algorithm, or software or system capable of decoding, and this application does not limit this.

[0102] In S425, specifically, at least one key information of the first non-HTTPS traffic is obtained.

[0103] In one embodiment, the key information may include at least one of uniform resource locator URL information, host name HOST information, feature code information, port information, IP information, and source address referer information.

[0104] In S426, specifically, the preset information of the associated identification library corresponds to the traffic type of the non-HTTPS traffic. After the key information of the first non-HTTPS traffic successfully matches the preset information, the traffic type corresponding to the preset information is used as the traffic type of the first non-HTTPS traffic. Since each IP address can only be assigned one traffic type, the traffic type corresponding to the first non-HTTPS traffic consistent with the first IP address information is the traffic type of the third HTTPS traffic. The first non-HTTPS traffic identification result is saved in the XDR call record to obtain the fourth identified XDR call record. The first HTTPS traffic whose traffic type cannot be identified by the associated identification library is the second HTTPS traffic.

[0105] For example, when a service visits a web page, it enters with the HTTP protocol, but the HTTP protocol jumps to the HTTPS protocol after entering the web page, which makes the service traffic have both HTTP traffic and HTTPS traffic. The IP address of the HTTP traffic of the service is consistent with the IP address of the HTTPS traffic, and one IP address corresponds to one service. Therefore, the DPI system can be used to identify the HTTP traffic that is consistent with the IP address of the HTTPS traffic, and the traffic type of the HTTP traffic is used as the identification result of the HTTPS traffic. Figure 6 The schematic diagram of the same-source IP association identification process of the embodiment of the present application shown in the figure includes:

[0106] S610, obtaining header information of HTTP traffic;

[0107] Specifically, the header information of the captured HTTP traffic is obtained. Exemplarily, the header information of the HTTP traffic can be captured by a DPI system.

[0108] S620, decoding IP quintuple information of HTTPS traffic;

[0109] Specifically, the IP five-tuple information in the HTTPS traffic SSL is decoded. For example, after the DPI captures the HTTPS traffic, the IP five-tuple information in the HTTPS traffic SSL is decoded.

[0110] S630, extracting key information of the HTTP traffic that is consistent with the IP address of the HTTPS traffic;

[0111] Specifically, during the time when the IP address is retained, HTTP traffic with the same source IP address as that in the SSL of the HTTPS traffic is extracted. At this time, the traffic type corresponding to the HTTP traffic is the traffic type corresponding to the HTTPS traffic. In this embodiment, the IP address is retained for one hour.

[0112] S640, identifying key information of HTTP traffic and obtaining an identification result of HTTPS traffic;

[0113] Specifically, the key information in the HTTP traffic is parsed to obtain the traffic type of the HTTP traffic, and the traffic type of the HTTP traffic is used as the traffic type of the HTTPS traffic, and the identification result of the HTTPS traffic is backfilled. Exemplarily, the DPI system parses the key information such as HOST and / or URL in the HTTP traffic at this time, and then identifies the key information according to the preset information in the associated identification library to obtain the traffic type corresponding to the HTTP traffic, and uses the traffic type of the HTTP traffic as the identification result of the HTTPS traffic.

[0114] For example, when a service accesses a web page, a DNS query will be executed to return the URL and / or HOST information of the HTTP protocol corresponding traffic and the corresponding relationship with the IP address. Then, the DPI system can obtain the corresponding relationship after batch capturing HTTP traffic. Because each IP address corresponds to a traffic type, the DPI system can extract HTTPS traffic and HTTP traffic with the same IP address based on the obtained corresponding relationship, and then identify HTTP traffic based on the URL and / or HOST information in the HTTP traffic corresponding relationship, and use the traffic type of HTTP traffic as the identification result of HTTPS traffic. Figure 7 The schematic diagram of the homologous DNS query association identification process of the embodiment of the present application shown in the figure includes:

[0115] S710, DNS queries HTTP traffic to obtain the corresponding relationship between the URL and IP of the HTTP traffic;

[0116] Specifically, after DNS queries the HTTP traffic, the correspondence between the URL and the IP of the HTTP traffic is obtained. For example, after the HTTP traffic is captured in batches by the DPI system, the correspondence between the URL and the IP address of the HTTP traffic is obtained to obtain the IP address of the HTTP traffic.

[0117] S720, decoding IP quintuple information of HTTPS traffic;

[0118] Specifically, the IP five-tuple information in the HTTPS traffic SSL is decoded. For example, after the DPI captures the HTTPS traffic, the IP five-tuple information in the HTTPS traffic SSL is decoded.

[0119] S730, confirming the interface access IP;

[0120] Specifically, during the time that the IP address is reserved, the IP address of the HTTPS traffic that is the same as the HTTP traffic IP address is obtained through the correspondence between the HTTP traffic and the IP five-tuple information of the HTTPS traffic, and the IP accessed by the interface using the HTTPS protocol is obtained. At this time, the traffic type corresponding to the HTTP traffic is the traffic type of the HTTPS traffic. In this embodiment, the IP address is retained for one hour.

[0121] S740, identifying HTTP traffic according to the IP confirmation URL, and obtaining an identification result of HTTPS traffic.

[0122] Specifically, the URL information of the HTTP traffic is obtained according to the correspondence between the URL of the HTTP traffic and the IP according to the IP address of the HTTP traffic. The URL of the HTTP traffic has a strong directionality, so the traffic type of the HTTP traffic can be obtained through the URL information, and the traffic type is used as the identification result of the HTTPS traffic.

[0123] In one embodiment, failure to identify the traffic type of the third HTTPS traffic through the association identification library may include that part or all of the acquired IP address information of the third HTTPS traffic is inconsistent with the IP address information of the first non-HTTPS traffic.

[0124] In one embodiment, the preset information may include the traffic type corresponding to the key information of the non-HTTPS traffic sample.

[0125] In S427, the third identified XDR call record and the fourth identified XDR call record are integrated as the first full identified call record.

[0126] Figure 4 The method shown is an implementation method of S420. The method first obtains the certificate information of the first HTTPS traffic and identifies part of the first HTTPS traffic through the certificate library. The certificate information is a part of the plaintext information of the HTTPS traffic and can be directly obtained without using other means such as decryption, thereby greatly improving the identification efficiency of the HTTPS traffic. Then, the associated identification library is used to associate and identify the unidentified HTTPS traffic with the non-HTTPS traffic, further expanding the identification scope of the certificate library.

[0127] The rule base of the above embodiment identifies the first HTTPS traffic, obtains the first full amount of identified XDR call records and the second HTTPS traffic, and then identifies the second HTTPS traffic to complete the identification of the first HTTPS traffic. In order to complete the identification of the second HTTPS traffic, the target identification model is used. Figure 3 S430-S440 using target recognition model for HTTPS traffic recognition.

[0128] In S430, specifically, a target feature vector of at least one second HTTPS traffic is extracted, the target feature vector is saved in an XDR call record, and an unidentified XDR call record is generated.

[0129] In one embodiment, S430 may include: Figure 8 The flowchart of the target feature vector acquisition method of the embodiment of the present application is shown, and the method shown includes:

[0130] S431, extracting the secure socket layer SSL header field information in the second HTTPS traffic to obtain a one-dimensional feature vector;

[0131] Specifically, at least one SSL header field information of the second HTTPS traffic is extracted to obtain an F*1-dimensional feature vector as a target feature vector of the second HTTPS traffic, where F is a positive integer.

[0132] In one embodiment, the SSL header field information may include at least one of stream metadata, packet length and time sequence, byte distribution, and transport layer security TLS handshake information.

[0133] In one embodiment, the stream metadata can be obtained by selecting the number of upstream bytes, the number of downstream bytes, the number of upstream packets, the number of downstream packets, the source port, the destination port and the total duration, and then normalizing them in seconds; the packet length and time series can be obtained by selecting the packet length and time of the first 50 packets and arranging them into a sequence, and the byte distribution can be obtained by selecting the first 160 bytes and the last 32 bytes of the payload information of the first 16 packets to obtain the byte distribution probability.

[0134] In one embodiment, the complete TLS handshake information may be extracted, and TLS cipher suite information, TLS extension information, and public key length information which may vary greatly depending on the traffic type may also be extracted.

[0135] S432: Generate the unrecognized XDR call record according to the one-dimensional feature vector.

[0136] Specifically, the F*1-dimensional feature vector information is saved in the XDR call record to generate an unidentified XDR call record.

[0137] In another embodiment, if Figure 8 The flowchart of the target feature vector acquisition method of the embodiment of the present application shown in FIG. 4 shows, S430 may also include S433-S434. Specifically,

[0138] S433, extracting the Payload information segment in the second HTTPS traffic to obtain an N*M dimensional feature vector, where N and M are both positive integers;

[0139] Specifically, at least one segment of Payload information of the second HTTPS traffic is extracted to obtain an N*M dimensional feature vector as a partial target feature vector of the second HTTPS traffic, where N and M are positive integers.

[0140] S434: Generate the unrecognized XDR call record according to the one-dimensional feature vector and the N*M-dimensional feature vector.

[0141] Specifically, the N*M dimensional feature vector information and the F*1 dimensional feature vector information obtained in S431 are saved together in the XDR call record to generate an unidentified XDR call record.

[0142] The above is a specific implementation method of S430. The following introduces a specific implementation method of S440.

[0143] In S440, specifically, the target recognition model is pre-trained based on the HTTPS traffic sample, and then the unidentified XDR call record including the second HTTPS traffic target feature vector is input into the target recognition model. The target recognition model matches the trained HTTPS feature vector with the target feature vector in the unidentified XDR call record to obtain the traffic type corresponding to the target feature vector, and outputs the result as the second full identified XDR call record.

[0144] In one embodiment, the HTTPS traffic sample can be obtained by capturing HTTPS traffic of a specific traffic type. For example, a mobile terminal only visits a website using the HTTPS protocol during a certain period of time, and only reads articles on the website during the visit. During this period of time, the HTTPS traffic of the mobile terminal is captured, and the traffic type of the captured HTTPS traffic is the reading service of the website, wherein the certain period of time can be in hours or days, and this application does not impose any restrictions.

[0145] The above is a specific implementation of S440. The above embodiment of the present application completes a large-scale identification of the first HTTPS traffic through the combination of the rule base and the target identification model, thereby improving the identification capability of the HTTPS traffic.

[0146] In one embodiment, if Fig. 9 The target recognition model training process diagram of the embodiment of the present application is shown, and the training method includes:

[0147] S910, obtain HTTPS traffic samples;

[0148] In one embodiment, the HTTPS traffic sample can be obtained by capturing HTTPS traffic of a specific traffic type. For example, a mobile terminal only visits a website using the HTTPS protocol during a certain period of time, and only reads articles on the website during the visit. During this period of time, the HTTPS traffic of the mobile terminal is captured, and the traffic type of the captured HTTPS traffic is the reading service of the website, wherein the certain period of time can be in hours or days, and this application does not impose any restrictions.

[0149] S920, extracting training feature information of the HTTPS traffic sample to obtain a one-dimensional feature vector and a multi-dimensional feature vector;

[0150] Specifically, the extraction of training feature information is similar to S431 and S433, and the one-dimensional feature vector may include the information of the number of uplink bytes, the number of downlink bytes, the number of uplink packets, the number of downlink packets and duration of the stream metadata, the information of the length sequence and the interval time sequence of the packet length and time sequence, the information of the byte distribution probability of the byte distribution, and the information of the TLS encryption suite, TLS extension and public key length of the TLS handshake information. The multi-dimensional feature vector may include the image information converted from bytes in the payload information segment.

[0151] S930, inputting the one-dimensional feature vector and the multi-dimensional feature vector into a first target recognition model and a second target recognition model to obtain a first recognition result and a second recognition result of the HTTPS traffic sample;

[0152] Specifically, after inputting the one-dimensional and multi-dimensional feature vectors of HTTPS traffic of known traffic types, the target recognition model performs common feature extraction, dimensionality reduction and classification on the one-dimensional and multi-dimensional feature vectors, and finally obtains the "strong feature" information of HTTPS traffic of known traffic types, that is, the information of the one-dimensional and multi-dimensional feature vectors extracted by the target recognition model that can point to the traffic type of HTTPS traffic.

[0153] S904: Integrate the first recognition result and the second recognition result into a recognition result through an integration algorithm.

[0154] Specifically, the final classification result of the input HTTPS traffic of known traffic type is used as the identification output, which facilitates the classification and identification of HTTPS traffic of unknown traffic type in the future.

[0155] In one embodiment, the training of the target recognition model may include a target recognition model performing common feature extraction, dimensionality reduction, and classification processing on one-dimensional feature information of HTTPS traffic samples of known traffic types.

[0156] The following specifically introduces a method for identifying HTTPS traffic of unknown traffic types using a target recognition model.

[0157] In one embodiment, the target recognition model may include an input layer, a convolutional layer, a pooling layer, a fully connected layer, and an output layer. Fig.10 A schematic diagram of a recognition method flow of a target recognition model according to an embodiment of the present application is shown, and the method includes:

[0158] S1010, extracting common features of the unrecognized XDR call record according to the convolution layer to obtain a feature graph of the unrecognized XDR call record;

[0159] Specifically, the input layer sends the input unidentified XDR call record containing the original target feature vector to the convolution layer. The convolution layer uses the convolution kernel to perform convolution processing on the original target feature vector in the input unidentified XDR call record, and uses the excitation function processing result for nonlinear excitation to obtain the feature vector of the original target feature vector. This feature vector is the common feature, and the output is the feature map of the unidentified XDR call record to the pooling layer.

[0160] S1020, filtering key features in the feature graph of the unrecognized XDR call record according to the pooling layer to obtain a reduced-dimensional feature graph of the unrecognized XDR call record;

[0161] Specifically, the pooling layer receives the feature map of the unidentified XDR call record from the convolutional layer, extracts the feature vector in the feature map using a filter, and then uses the pooling function to reduce the dimension of the extracted feature vector to obtain the reduced-dimensional feature map of the unidentified XDR call record, and sends the reduced-dimensional feature map to the fully connected layer.

[0162] S1030: Classify and identify the reduced-dimensional feature graph of the unrecognized XDR call record according to the fully connected layer to obtain the second full amount of recognized XDR call records.

[0163] Specifically, the dimensionality reduction feature map of the pooling layer is received, and the dimensionality reduction feature map is classified and identified using a classifier according to the pre-trained result, and the classification result is sent to the output layer to output the second full amount of identified XDR call records.

[0164] The target recognition model of the present application extracts common features in unidentified XDR call records containing HTTPS traffic target feature vectors through a convolutional layer, and screens key features in the feature map through a pooling layer, further strengthening the feature vectors of HTTPS traffic, avoiding the recognition and processing of feature vectors that cannot clearly display the type of HTTPS traffic, saving the computing power of the target recognition model, and identifying and classifying HTTPS traffic by targeting the strengthened feature vectors that can clearly know the type of HTTPS traffic after processing, thereby accelerating the response time of the target recognition model and improving the recognition efficiency of HTTPS traffic.

[0165] In one embodiment, the original target feature vector input to the output layer can be a feature vector of F*1 dimension, where F is a positive integer, the convolution layer can have three layers, the convolution kernel can select a convolution kernel of 3*1 or 5*1 size, and the excitation function can be a Relu function. The pooling layer can have three layers, which are arranged alternately with the convolution layer, namely, convolution layer 1 pooling layer 1, convolution layer 2 pooling layer 2 and convolution layer 3 pooling layer 3, the filter size can be 4*1, and the pooling function can select the Max Pooling function. After the pooling layer processes the feature map of the convolution layer, the pooling layer 3 outputs the reduced dimension feature map as an F / 4*1 dimensional vector. The fully connected layer receives the reduced dimension feature map sent by the pooling layer 3, and uses the softmax classifier to classify and identify the reduced dimension feature map, wherein the classification result is in the form of a vector, and each vector element is the probability of each traffic type corresponding to the reduced dimension feature map, and the traffic type corresponding to the largest probability is selected as the classification result of the reduced dimension feature map, and the classification result is sent to the output layer to output the second full amount of identified XDR call records.

[0166] In another embodiment, the original target feature vector input to the output layer may also include an M*N dimensional feature vector, where N and M are positive integers, the convolution layer may have three layers, the convolution kernel may select a 3*3 or 5*5 size convolution kernel, and the excitation function may be a Relu function. The pooling layer may have three layers, arranged alternately with the convolution layer, namely, convolution layer 1 pooling layer 1, convolution layer 2 pooling layer 2 and convolution layer 3 pooling layer 3, the filter size may be 4*4, and the pooling function may select the Max Pooling function. After the pooling layer processes the feature map of the convolution layer, the pooling layer 3 outputs the reduced dimension feature map as an M / 4*M / 4 dimensional vector. The fully connected layer receives the reduced dimension feature map sent by the pooling layer 3, and uses the softmax classifier to classify and identify the reduced dimension feature map, wherein the classification result is in the form of a vector, and each vector element is the probability of each traffic type corresponding to the reduced dimension feature map, and the traffic type corresponding to the largest probability is selected as the classification result of the reduced dimension feature map.

[0167] In addition, the classifier of the fully connected layer is not limited in this application, and it can be a softmax classifier or a dropout classifier or other classifiers.

[0168] In order to more intuitively introduce the traffic identification method of the embodiment of the present application, the technical solution is described in detail by taking the existing DPI system identification scenario as an example:

[0169] like Fig.11 The schematic diagram of the application scenario of the DPI system of the embodiment of the present application is shown,

[0170] First, the DPI system captures network traffic in batches, identifies the original code stream of HTTPS traffic with a network protocol of HTTPS, and inputs it into the user collector. The user collector uses the accumulated certificate library to identify the original code stream of the captured HTTPS traffic, and generates a third identified XDR call record and a third HTTPS traffic XDR call record based on the identification results and sends them to the synthesis layer of the DPI system.

[0171] Secondly, the synthesis layer of the DPI system receives the third identified XDR bill and the third HTTPS traffic, and uses the accumulated associated data identification library to identify the XDR bill of the third HTTPS traffic, and generates a fourth identified XDR bill based on the identification result. The target feature vector information in the XDR bill of the third HTTPS traffic that cannot be identified by the associated identification library is intercepted to generate an unidentified XDR bill, and the unidentified XDR bill is sent to the target identification model.

[0172] Again, the target recognition model generates a second full set of recognized XDR call records from the recognition results of the unrecognized XDR call records and sends them to the synthesis layer.

[0173] Again, the synthesis layer integrates the received third identified XDR call record, the fourth identified XDR call record and the second full identified XDR call record, and outputs the full identified XDR call record as the identification result of the captured HTTPS traffic in this batch.

[0174] It is worth noting that in the above scenario, there is no limitation on the specific location of the rule base in the DPI system, that is, the certificate base and the associated identification base can be in the user-side collector or in the synthesis layer, or one of them can be in the user-side collector and the other in the synthesis layer, or neither in the user collector nor in the synthesis layer. In addition, the act of intercepting the target feature vector of the HTPPS traffic that the rule base cannot identify can also be completed in the user collector, not limited to the synthesis layer. The target recognition model can be installed in the DPI system or located outside the DPI system, and is called through the program call interface when in use, which is not limited in this application.

[0175] In one embodiment, the traffic identification method of the present application is applied to the DPI system to obtain the sampling evaluation table of an embodiment of the present application shown in the following table, in which a target identification model is used to save the computing power of the target identification model and the DPI system. The DPI system captures 350G of HTTPS traffic packets in the existing network for model training, of which there are 241 HTTPS traffic of known traffic types, and HTTPS traffic of unknown traffic types are classified into one category. Therefore, the total classification system of the target identification model has a total of 242 categories. For each of these 242 categories, 1,000 data are taken. The data of HTTPS traffic of each known traffic type is used as a positive sample, and the data of HTTPS traffic of unknown traffic types is used as a negative sample. A ten-fold cross validation is used to calculate the AUC and then take the average. The traffic identification evaluation indicators obtained are shown in the following table:

[0176]

[0177] In the test results shown in the table above, the recognition accuracy of HTTPS traffic is about 90%, and the recall rate is about 89%. The recognition capability of the traffic recognition method of this application can reduce the proportion of unrecognized HTTPS traffic in the entire network from the original 95% to 4.5%, greatly improving the recognition capability and recognition range of HTTPS traffic. In the future, with the improvement of algorithms and the continuous improvement of target recognition models, the traffic types of identifiable HTTPS traffic can be further enriched, the recognition accuracy of HTTPS traffic can be enhanced, and the value of operator big data can be improved.

[0178] Fig.12 The schematic diagram of the structure of the flow identification device according to the embodiment of the present application is shown as follows: Fig.12 As shown, the device comprises,

[0179] A first acquisition module 121, used to acquire a first HTPPS flow;

[0180] A first identification module 122 is used to identify the first HTTPS traffic according to a rule base to obtain a first full amount of identified XDR call records and an unidentified second HTTPS traffic;

[0181] A first extraction module 123 is used to extract a feature vector of the second HTTPS traffic to obtain an unidentified XDR call record;

[0182] The second recognition module 124 inputs the unrecognized XDR call record into a target recognition model, recognizes the unrecognized XDR call record through the target recognition model, and obtains a second full amount of recognized XDR call records;

[0183] The target recognition model is trained by taking the feature vector of the HTTPS traffic sample as input and the traffic type of the HTTPS traffic sample as output.

[0184] In one embodiment, the second identification module 1240 may include,

[0185] An input unit is used to input unrecognized XDR call records;

[0186] An extraction unit, configured to extract common features from the unrecognized XDR call record according to a convolutional layer to obtain a feature graph of the unrecognized XDR call record;

[0187] A dimensionality reduction unit, configured to filter key features in the feature graph of the unrecognized XDR call record according to the pooling layer to obtain a dimensionality reduction feature graph of the unrecognized XDR call record;

[0188] An identification unit is used to classify and identify the reduced dimension feature graph of the unidentified XDR call record according to the fully connected layer to obtain the second full amount of identified XDR call records

[0189] An output unit, configured to output the second full amount of identified XDR call records

[0190] In one embodiment, the first identification module 1220 may include,

[0191] A second obtaining unit, configured to obtain certificate information of the first HTTPS traffic;

[0192] A certificate matching unit, configured to match the certificate information with preset information of the certificate library to obtain a third identified XDR call record and an unidentified third HTTPS traffic, wherein the third identified XDR call record includes a traffic type corresponding to the certificate information that matches the preset information, and the third HTTPS traffic includes the first HTTPS traffic corresponding to the certificate information that does not match the preset information;

[0193] A decoding unit, used for decoding the IP quintuple information of the third HTTPS traffic to obtain the first IP address information of the third HTTPS traffic;

[0194] a third acquiring unit, configured to obtain key information of a first HTTP flow and the unidentified second HTTPS flow according to the first IP address information, wherein the first HTTP flow includes HTTP flow whose IP address information is consistent with the first IP address information, and the unidentified second HTTPS flow includes the third HTTPS flow corresponding to the first IP information which is inconsistent with the IP address information of the first HTTP flow;

[0195] An association identification unit, configured to identify the key information according to a preset rule of the association identification library to obtain a fourth identified XDR call record, wherein the preset rule includes a traffic type corresponding to the key information of the HTTP traffic sample;

[0196] An integration unit is used to integrate the third identified XDR call record with the fourth identified XDR call record to obtain the first full identified call record.

[0197] In addition, in combination with the traffic identification method in the above embodiment, an embodiment of the present application may provide a traffic identification device, which may include a processor and a memory storing computer program instructions, and the processor implements the above traffic identification method when executing the computer program instructions.

[0198] In addition, in combination with the flow identification method in the above embodiment, the embodiment of the present application can provide a computer storage medium, on which computer program instructions are stored, and when the computer program instructions are executed by the processor, the above flow identification method is implemented.

[0199] The processor may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present invention.

[0200] The memory may include read-only memory (ROM), random access memory (RAM), magnetic disk storage media devices, optical storage media devices, flash memory devices, electrical, optical or other physical / tangible memory storage devices. Thus, typically, the memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to an aspect of the present disclosure.

[0201] It should be clear that the present application is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present application is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present application.

[0202] The functional blocks shown in the above-described block diagram can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present application are programs or code segments that are used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link by a data signal carried in a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, optical fiber media, radio frequency (RF) links, etc. The code segment can be downloaded via a computer network such as the Internet, an intranet, etc.

[0203] It should also be noted that the exemplary embodiments mentioned in this application describe some methods or systems based on a series of steps or devices. However, this application is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the embodiment, or in a different order from the embodiment, or several steps can be performed simultaneously.

[0204] Aspects of the present disclosure are described above with reference to the flowchart and / or block diagram of the method, device (system) and computer program product according to the embodiment of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device to produce a machine so that these instructions executed by the processor of the computer or other programmable data processing device enable the implementation of the function / action specified in one or more boxes of the flowchart and / or block diagram. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field programmable logic circuit. It can also be understood that each box in the block diagram and / or flowchart and the combination of boxes in the block diagram and / or flowchart can also be implemented by dedicated hardware that performs a specified function or action, or can be implemented by a combination of dedicated hardware and computer instructions.

[0205] The above is only a specific implementation of the present application. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, modules and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. It should be understood that the protection scope of the present application is not limited to this. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in this application, and these modifications or replacements should be included in the protection scope of this application.

Claims

1. A flow identification method, characterized in that: include: Get the first Hypertext Transfer Security Protocol HTTPS traffic; Identify the first HTTPS traffic according to the rule base to obtain the first full amount of identified XDR call records and the unidentified second HTTPS traffic; Extracting a target feature vector of the second HTTPS traffic to obtain an unidentified XDR call record; Inputting the unrecognized XDR call record into a target recognition model, and recognizing the unrecognized XDR call record by using the target recognition model to obtain a second full amount of recognized XDR call records; The target recognition model is obtained by training with the feature vector of the HTTPS traffic sample as input and the traffic type of the HTTPS traffic sample as output; The rule base includes a certificate base and an associated identification base; The identifying the first HTTPS traffic according to the rule base to obtain the first full amount of identified XDR call records and the unidentified second HTTPS traffic specifically includes: Obtaining certificate information of the first HTTPS traffic; Matching the certificate information with the preset certificate information of the certificate library to obtain a third identified XDR call record and an unidentified third HTTPS traffic, wherein the third identified XDR call record includes a traffic type corresponding to the certificate information that matches the preset certificate information, and the third HTTPS traffic includes the first HTTPS traffic corresponding to the certificate information that does not match the preset certificate information; Decoding the Internet Protocol IP quintuple information of the third HTTPS traffic to obtain the first IP address information of the third HTTPS traffic; Extracting first non-HTTPS traffic consistent with the first IP address information; Obtain key information of the first non-HTTPS traffic; Identify the key information according to the preset information of the association identification library to obtain a fourth identified XDR call record and the unidentified second HTTPS traffic; The third identified XDR call record and the fourth identified XDR call record are integrated to obtain the first full identified call record.

2. The method according to claim 1, characterized in that The step of extracting the target feature vector of the second HTTPS traffic to obtain an unidentified XDR call record specifically includes: Extracting Secure Sockets Layer (SSL) header field information from the second HTTPS traffic to obtain a one-dimensional feature vector; The unidentified XDR call record is generated according to the one-dimensional feature vector.

3. The method according to claim 2, characterized in that The step of extracting the target feature vector of the second HTTPS traffic to obtain an unidentified XDR call record further includes: Extract the Payload information fragment in the second HTTPS traffic to obtain an N*M dimensional feature vector, where N and M are both positive integers; Generating the unidentified XDR call record according to the one-dimensional feature vector specifically includes: The unidentified XDR call record is generated according to the one-dimensional feature vector and the N*M-dimensional feature vector.

4. The method according to claim 3, characterized in that The SSL header field information includes at least one of stream metadata, packet length and time sequence, byte distribution and transport layer security TLS handshake information.

5. The method according to any one of claims 2 to 4, characterized in that: The target recognition model includes a convolutional layer, a pooling layer and a fully connected layer. The step of inputting the unrecognized XDR call record into a target recognition model, and recognizing the unrecognized XDR call record by using the target recognition model to obtain a second full amount of recognized XDR call records specifically includes: Extract common features of the unrecognized XDR call record according to the convolution layer to obtain a feature graph of the unrecognized XDR call record; Filter the key features in the feature graph of the unrecognized XDR call record according to the pooling layer to obtain a reduced-dimensional feature graph of the unrecognized XDR call record; The dimensionality reduction feature graph of the unidentified XDR call record is classified and identified according to the fully connected layer to obtain the second full amount of identified XDR call records.

6. The method according to claim 1, characterized in that The preset information includes the traffic type corresponding to the key information of the non-HTTPS traffic sample; The key information includes at least one of uniform resource locator URL information, host name HOST information, feature code information, port information, IP information, and source address referer information.

7. A flow identification device, characterized in that: include, A first acquisition module, used to acquire first HTTPS traffic; A first identification module is used to identify the first HTTPS traffic according to a rule base to obtain a first full amount of identified XDR call records and unidentified second HTTPS traffic, wherein the rule base includes a certificate library and an associated identification library; A first extraction module is used to extract a feature vector of the second HTTPS traffic to obtain an unidentified XDR call record; A second recognition module inputs the unrecognized XDR call record into a target recognition model, recognizes the unrecognized XDR call record through the target recognition model, and obtains a second full amount of recognized XDR call records; The target recognition model is obtained by training with the feature vector of the HTTPS traffic sample as input and the traffic type of the HTTPS traffic sample as output; The first identification module is specifically used to obtain the certificate information of the first HTTPS traffic; match the certificate information with the preset certificate information of the certificate library to obtain a third identified XDR call record and an unidentified third HTTPS traffic, wherein the third identified XDR call record includes the traffic type corresponding to the certificate information that matches the preset certificate information, and the third HTTPS traffic includes the first HTTPS traffic corresponding to the certificate information that does not match the preset certificate information; decode the Internet Protocol IP five-tuple information of the third HTTPS traffic to obtain the first IP address information of the third HTTPS traffic; extract the first non-HTTPS traffic consistent with the first IP address information; obtain the key information of the first non-HTTPS traffic; identify the key information according to the preset information of the associated identification library to obtain a fourth identified XDR call record and the unidentified second HTTPS traffic; integrate the third identified XDR call record with the fourth identified XDR call record to obtain the first full amount of identified call records.

8. A flow identification device, characterized in that: The device comprises: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, the traffic identification method according to any one of claims 1 to 6 is implemented.

9. A computer storage medium, characterized in that The computer storage medium stores computer program instructions, which, when executed by a processor, implement the traffic identification method according to any one of claims 1 to 6.

Images