Proxy forwarding traffic detection method and device, electronic equipment and storage medium

Abstract

This invention discloses a method, apparatus, electronic device, and storage medium for detecting proxy forwarding traffic. The method includes: acquiring session information of multiple sessions in network traffic, wherein the session information of each session includes at least the payload packet time sequence and 5-tuple information of that session; determining that a first session and a second session are associated sessions based on the session information, wherein the destination IP of the first session and the source IP of the second session are the same; and determining that the network traffic corresponding to the first session and the second session is proxy forwarding traffic when the similarity between the payload packet time sequence of the first session and the payload packet time sequence of the second session meets a preset time threshold. This invention can identify common proxy forwarding traffic with relatively low computational load and CPU utilization.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method, apparatus, electronic device, and storage medium for detecting proxy forwarding traffic. Background Technology

[0002] With the development of computer and network technology, convenient access to the Internet and sharing of abundant network resources have become the norm in life. While people enjoy these conveniences of online life, cases of computer and network data leaks are increasing year by year, and network security is becoming increasingly serious.

[0003] Currently, network traffic detection is a common analysis and processing method used by network security products. Network proxy forwarding technology allows clients to establish connections with remote servers through proxy servers for data communication. This technology plays a role in protecting internal network communication, but it is also frequently used for internal network penetration, protection bypassing, and other network attacks. Therefore, when a host forwards network traffic through a proxy, it can hide its real IP address, bypass firewall protection policies, and access overseas websites. Moreover, many proxy tools encrypt data, making it difficult for security products to detect this type of proxy-forwarded traffic.

[0004] To detect traffic forwarded by proxies, existing technologies typically use the entropy characteristics of the payload and the message length characteristics of the flow for encrypted traffic, and employ machine learning models for identification. However, this method can only train models for specific protocols and requires a large number of samples. The quality and quantity of samples directly affect the accuracy of identification. At the same time, machine learning consumes a lot of CPU resources and time, and is only effective for encrypted traffic of specific protocols. Summary of the Invention

[0005] This invention provides a method, apparatus, electronic device, and storage medium for detecting proxy forwarding traffic, which can overcome the technical problems existing in the prior art and can identify common proxy forwarding traffic with lower computational load and CPU utilization.

[0006] This invention provides a method for detecting proxy forwarding traffic, comprising:

[0007] Obtain session information for multiple sessions in network traffic. The session information for each session shall include at least the time sequence of the payload packets and the 5-tuple information for that session.

[0008] Based on the session information, the first session and the second session are determined to be associated sessions, and the destination IP of the first session is the same as the source IP of the second session;

[0009] When the similarity between the time series of the payload messages of the first session and the time series of the payload messages of the second session meets a preset time threshold, the network traffic corresponding to the first session and the second session is determined to be proxy forwarding traffic.

[0010] The present invention also provides a proxy forwarding traffic detection device, comprising:

[0011] The acquisition module is used to acquire session information of multiple sessions in network traffic. The session information of each session includes at least the time sequence of the payload packets and the five-tuple information of that session.

[0012] The association determination module is used to determine that the first session and the second session are associated sessions based on session information, wherein the destination IP of the first session and the source IP of the second session are the same;

[0013] The proxy detection module is used to determine the network traffic corresponding to the first session and the second session as proxy forwarding traffic when the similarity between the time series of the payload packets of the first session and the time series of the payload packets of the second session meets a preset time threshold.

[0014] This invention also provides a proxy forwarding traffic detection system, comprising:

[0015] The session generation section is used to receive packets in network traffic and extract session information of the session to which the packets belong. The session information includes: session start time, five-tuple information, number of uplink and downlink payload packets, and payload packet time sequence.

[0016] The session storage section is used to store the session information;

[0017] The session detection section is used to determine that the first session and the second session are associated sessions based on session information, and that the destination IP of the first session and the source IP of the second session are the same. When the similarity between the time series of the payload packets of the first session and the time series of the payload packets of the second session meets a preset time threshold, the network traffic corresponding to the first session and the second session is determined to be proxy forwarding traffic.

[0018] The present invention also provides an electronic device, a processor, a memory, and a computer program stored in the memory and executable on the processor;

[0019] The processor implements the above-described method when running the computer program.

[0020] The present invention also provides a computer-readable storage medium storing a computer program that can be executed to implement the above-described method.

[0021] This invention identifies associated sessions by determining the session information of the session to which the packets in the network traffic belong, and then determines whether the associated sessions are proxy forwarding traffic by detecting the time series similarity of the payload packets of the mutually associated sessions. This method does not require a large number of traffic samples for machine learning training, is computationally simple, saves CPU computing resources, and has no restrictions on the transmission protocol used or whether the data is encrypted, making it more widely applicable. Moreover, it identifies proxy servers while identifying proxy forwarding traffic. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 A flowchart of a proxy forwarding traffic detection method provided in an embodiment of the present invention;

[0024] Figure 2 This is a schematic diagram of the proxy forwarding traffic structure in an embodiment of the present invention;

[0025] Figure 3 A flowchart for session generation is provided as an embodiment of the present invention;

[0026] Figure 4 A flowchart for specific session generation provided in an embodiment of the present invention;

[0027] Figure 5 A flowchart of another proxy forwarding traffic detection method provided in an embodiment of the present invention;

[0028] Figure 6 This is a schematic diagram of the structure of a proxy forwarding traffic detection device provided in an embodiment of the present invention;

[0029] Figure 7 This is a schematic diagram of another proxy forwarding traffic detection device provided in an embodiment of the present invention;

[0030] Figure 8 This is a schematic diagram of the structure of a proxy forwarding traffic detection system provided in an embodiment of the present invention;

[0031] Figure 9 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0032] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of the embodiments of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0033] This invention addresses the problem of machine learning models in proxy traffic identification relying heavily on sample size and consuming excessive CPU resources. It identifies common proxy forwarding traffic, including SSH port forwarding and SOCKS5 protocol, with lower computational cost and CPU utilization. Regardless of the transmission protocol used or whether the data is encrypted, the characteristic of proxy forwarding is that it forwards packets sent by the client to the destination server. Therefore, network traffic between the client and the proxy server, and between the proxy server and the destination server, has similarities. This invention detects and identifies proxy forwarding traffic based on this similarity, achieving accurate identification without the need to train a machine learning model.

[0034] To make the technical solution of the present invention clearer, the embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0035] Figure 1 This is a flowchart illustrating a proxy forwarding traffic detection method provided in an embodiment of the present invention. The executing entity in this embodiment can be a proxy forwarding traffic detection device, specifically a proxy monitoring server or network traffic detection device in a network security product. The following description uses a network traffic detection device as the executing entity. Figure 1 As shown, the proxy forwarding traffic detection method in this embodiment includes:

[0036] Step 101: Obtain session information for multiple sessions in network traffic. The session information for each session shall include at least the time sequence of the payload packets and the 5-tuple information of that session.

[0037] In network traffic processing, a five-tuple is typically used to identify a session. The five-tuple refers to the source IP, destination IP, source port, destination port, and protocol of a network communication. Figure 2 This is a schematic diagram of the proxy forwarding traffic structure in an embodiment of the present invention, as shown below. Figure 2As shown, taking SSH local port forwarding as an example, if the client host C can access the proxy host A but not the server host B, enabling port forwarding on host A allows host C to access host B through the proxy, thus enabling message transmission between the client host C and the destination server host B. When host C accesses host A, it initiates a network connection to host A's proxy port. Its 5-tuple consists of: hostCIP, hostC source port, hostAIP, hostA port, and transport protocol. Session A between host C and host A can be identified using this 5-tuple information. When host A receives the request from host C, it forwards the message to the actual destination server host B. Its 5-tuple consists of: hostAIP, hostA source port, hostBIP, hostB port, and transport protocol. Session B between host B and host A can be identified using this 5-tuple information. Therefore, to detect whether network traffic is proxy-forwarded traffic, the session information of multiple sessions in the network traffic is first obtained. The session information must include at least the 5-tuple information.

[0038] Step 102: Determine that the first session and the second session are associated sessions based on the session information, and that the destination IP of the first session is the same as the source IP of the second session.

[0039] For network traffic detection devices, if the destination IP of session A and the source IP of session B are the same within a certain time range, these two sessions are considered related sessions. As mentioned above, if network traffic is forwarded via a proxy, the destination IP of session A and the source IP of session B, or vice versa, must be the same. Therefore, based on the five-tuple information of the session information obtained in step 101, the first and second sessions that are related sessions can be determined.

[0040] Step 103: When the similarity between the time series of the payload messages of the first session and the time series of the payload messages of the second session meets the preset time threshold, the network traffic corresponding to the first session and the second session is determined to be proxy forwarding traffic.

[0041] After obtaining the associated sessions, this step determines whether the traffic is forwarded by proxy by detecting the similarity of the associated sessions. In this invention, the time-series similarity of packet transmissions before and after proxy forwarding in the associated sessions is used to evaluate whether the session is forwarded by proxy. There are many methods for calculating time-series similarity, such as calculating Euclidean distance, autocorrelation coefficient distance, and Maharaj distance. This embodiment of the invention does not limit the calculation method for time-series similarity. In specific applications, one calculation method can be selected, or multiple calculation methods can be selected simultaneously to improve the accuracy of calculating time-series similarity.

[0042] To calculate time series similarity, the time series of payload messages for each session is extracted simultaneously when obtaining session information. This payload message time series can be the arrival time series of each payload message in each session, or it can be a time series composed of the arrival time intervals of adjacent uplink or downlink payload messages in each session. Since the arrival time intervals of adjacent payload messages are very small, for ease of recording and storage, in this embodiment of the invention, the payload message time series is a time series composed of the arrival time intervals of adjacent uplink or downlink payload messages in each session. Therefore, detecting whether the similarity between the payload message time series of the first session and the payload message time series of the second session meets a preset time threshold can specifically include: calculating a first distance between the payload message time series of the first session and the payload message time series of the second session, where the first distance is the Euclidean distance, the autocorrelation coefficient distance, and / or the Maharaj distance; if the first distance is less than the preset time threshold, then the similarity between the payload message time series of the first session and the payload message time series of the second session is considered to meet the preset time threshold, thereby determining that the network traffic corresponding to the first session and the second session is proxy forwarding traffic. There are many methods for calculating time series similarity. In this embodiment, Euclidean distance calculation is used as an example for illustration.

[0043] First, extract the time interval between the two payload packets in each session to form the session's time series. For example, for two related sessions S1 and S2, the uplink payload interval time series is S1 = {t10, t11, t12, ..., t1...} n}, S2={t20, t21, t22,…., t2 n There are four commonly used Euclidean distance norms, with the L1 and L2 norms being the most frequently used. The two calculation methods can be chosen based on the specific situation, as shown in Formula 1 and Formula 2 below:

[0044]

[0045]

[0046] Network traffic inspection devices process each received packet, parsing the IP and TCP headers, and recording the number of packets with payloads in both the uplink and downlink directions for each session. Due to differences in network environment and software implementation, the total number of packets in session A and session B may not be the same. However, due to the characteristics of proxy forwarding, the number of packets with payloads is always the same. Therefore, when obtaining session information, the uplink and downlink payload packet counts for each session can also be extracted simultaneously. For two related sessions, if the uplink and downlink payload packet counts are the same, time series similarity can be used to further confirm whether it is proxy traffic. That is, before detecting that the similarity between the payload packet time series of the first session and the payload packet time series of the second session meets the preset conditions, it also includes: determining that the uplink and downlink payload packet counts of the first session are equal to those of the second session. If the number of packets with uplink and downlink payloads in two related sessions is the same, and the Euclidean distance between their uplink and downlink payload time series is less than a preset time threshold L, then these two sessions are considered to be related and similar sessions. While confirming the related and similar sessions, it can also be confirmed that this traffic is proxy forwarding traffic and hostA is the proxy server. That is, it is confirmed that the host corresponding to the destination IP of the first session or the source IP of the second session is the proxy server.

[0047] This invention identifies associated sessions by determining the session information of the session to which the packets in the network traffic belong, and then determines whether the associated sessions are proxy forwarding traffic by detecting the time series similarity of the payload packets of the mutually associated sessions. This method does not require a large number of traffic samples for machine learning training, is computationally simple, saves CPU computing resources, and has no restrictions on the transmission protocol used or whether the data is encrypted, making it more widely applicable. Moreover, it identifies proxy servers while identifying proxy forwarding traffic.

[0048] In practical applications, before proxy traffic detection, network traffic detection devices typically process and store session data for retrieval during proxy traffic detection. That is, obtaining session information from multiple sessions in network traffic in step 101 above can be done directly from network communication traffic, or sessions can be pre-generated and stored, and then retrieved from the session storage during detection. The following provides a detailed explanation of session generation.

[0049] Figure 3 This is a flowchart of session generation provided in an embodiment of the present invention. In the proxy forwarding traffic detection method of the present invention, session generation is as follows: Figure 3 As shown, the session generation includes:

[0050] Step 201: Receive packets from network traffic and parse out the 5-tuple information of the packets.

[0051] Network traffic detection devices receive network packets from the network and can parse and extract the five-tuple information of the packet.

[0052] Step 202: Query the configured session list based on the five-tuple information of the message.

[0053] The network traffic inspection device is equipped with a session list for temporarily storing session data. This session list temporarily stores session information to which the packets received by the device belong. The session information includes the start time of each session, five-tuple information, the number of uplink and downlink payload packets, and the time sequence of the payload packets. When a session ends, the device sends the session information of that session to the session storage for subsequent proxy traffic inspection and identification.

[0054] There are three scenarios for the message received by the device: if the 5-tuple information of the session to which the message belongs already exists in the session list, and the message is an uplink message, then proceed to step 203; if the 5-tuple information of the session to which the message belongs already exists in the session list, and the message is a downlink message, then proceed to step 204; if the 5-tuple information of the session to which the message belongs does not exist in the session list, meaning the message is a message from a new session, then proceed to step 205. Steps 203-205 are repeated operations. As long as the device has not received a session end message, any message received by the device can perform one of these three operations. The following is a detailed explanation of the three operation steps.

[0055] Step 203: If a session with the same 5-tuple information is found, and the source IP of the packet is the same as the source IP of the found session, then the packet is confirmed as an uplink packet of the current session. If the payload of the uplink packet is not 0, then the uplink payload packet count is incremented by 1, and the arrival time of the uplink packet is recorded. In this step, the uplink packet payload being not 0 indicates that the packet is a payload packet. By incrementing the uplink payload packet count by 1 to record the payload packets of the current session, preparation is made for comparing the payload packet counts of the sessions later. The intermediate information of these records is temporarily stored in the session list. When the session ends, the corresponding record is the session information of the current session.

[0056] Step 204: If a session with the same five-tuple information is found, and the source IP of the packet is the same as the destination IP of the found session, then the packet is confirmed as a downlink packet of the current session. If the payload of the downlink packet is not 0, then the number of payload packets in the downlink direction is incremented by 1, and the arrival time of the downlink packet is recorded.

[0057] Step 205: If no session with the same 5-tuple information is found, the packet is confirmed as a new session packet. The 5-tuple information of the packet is saved in the session list. At the same time, the direction from the source IP to the destination IP of the packet is marked as the uplink direction. The time when the packet is received is recorded as the session start time of the new session.

[0058] Step 206: If a message indicating the end of transmission is received or no message is received after a predetermined time, then confirm that the current session has ended.

[0059] In network communication, the end of a session is usually indicated by including a marker in the message indicating the end of transmission. For example, setting the FIN or RST bit in the TCP header signifies the end of the session. Alternatively, if no messages are received within a preset time period, the session is also considered to have ended.

[0060] Step 207: Store the session information of the current session in the session storage. The session information of the current session includes the start time of the current session, the five-tuple information, the number of uplink and downlink payload packets, and the payload message time sequence.

[0061] When a session ends, the session information, such as the number of uplink and downlink payload packets and the payload message time series, is finalized. The session information of ended sessions in the session list can be sent to the session storage for later detection and identification. By pre-generating sessions, subsequent detection can perform packet reception, session information extraction, and traffic detection in parallel pipelined execution.

[0062] Figure 4 This invention provides a flowchart of a specific session generation method. In practical applications, session generation in a proxy forwarding traffic detection method is as follows: Figure 4 As shown, this embodiment mainly includes the following operations:

[0063] 1. Receive packets from network traffic, parse the IP header and TCP header of the packets, and extract the source IP, destination IP, source port, destination port and protocol of the packets.

[0064] 2. Locate the session list based on the five-tuple information of the current message.

[0065] 3. If there is no session with the current packet's five-tuple, then the current packet is considered a new session. Memory is allocated to store the source IP, destination IP, source port, destination port, and protocol of the current packet. At the same time, the direction from the source IP to the destination IP of the current packet is marked as uplink. The time when this packet was received is recorded as the session start time.

[0066] 4. If a session with the current 5-tuple exists, and the source IP of the current packet is equal to the source IP of the session, then the current packet is considered an uplink packet. If the payload of this packet is not 0, then the uplink payload packet count is incremented by 1, and the arrival time of this uplink payload is recorded as Te-k. The time difference between Te-k and Te-k-1 is obtained as te-k, where te-k is the time interval between the arrival times of adjacent uplink payload packets Te-k and Te-k-1. That is, te-k is the uplink payload interval time sequence S1 = {t10, t11, t12, ..., t1}. n} or S2={t20,t21,t22,….,t2 n t1 in} k Or t2 k If this payload is the first uplink message, then te-0 = 0.

[0067] 5. If a session with the current 5-tuple exists, and the source IP of the current packet is equal to the destination IP of the session, then the current packet is considered to be a downlink packet. If the payload of this packet is not 0, then the downlink payload packet count is incremented by 1, and the arrival time of this uplink payload is recorded as Ti-k. The time difference between Ti-k and Ti-k-1 is obtained as ti-k. This ti-k is the time interval between the arrival times of adjacent downlink payload packets Ti-k and Ti-k-1. If this payload is the first downlink packet, then ti-0 = 0.

[0068] 6. If the FIN or RST bit in the TCP header of a message is set, the session is considered to have ended.

[0069] 7. If no message is received within a certain time (e.g., 5 minutes), the session is considered to have ended.

[0070] 8. If the session ends, the session start time, 5-tuple information, number of uplink and downlink payload messages, and payload message time sequence are recorded in the session storage section.

[0071] 9. Since TCP long connections may last for an hour or longer, no session termination message will be sent. If the session continues for a certain period of time (e.g., 1 hour) without ending, the start time of the current session, the five-tuple information, the number of uplink and downlink payload messages, the time series, and the payload message time series will be recorded in the session storage part, and the start time of the session and the number of uplink and downlink payload messages will be cleared to zero.

[0072] The session generation process described above completes the extraction and storage of information required for subsequent traffic detection. In practical applications, the time window for session detection can be determined based on the accuracy of the detection during subsequent traffic detection. Since a shorter time window results in more accurate detection but also consumes more resources, the time window for session detection can be set according to requirements.

[0073] Figure 5 A flowchart of another proxy forwarding traffic detection method provided in an embodiment of the present invention is shown below. Figure 5 As shown, in the detection method of this embodiment, a traffic detection time range is first preset according to requirements, and then the corresponding sessions are extracted from the session storage as a set of sessions to be detected based on the preset traffic detection time range. Specifically, the method of this embodiment includes:

[0074] Step 301: Extract all sessions whose start time matches the preset traffic detection time range from the session storage as the set of sessions to be inspected, and obtain the session information of each session in the set of sessions to be inspected.

[0075] Step 302: Extract the source IP set and destination IP set of all sessions in the session set to be inspected.

[0076] Since the set of sessions to be inspected contains multiple sessions, the source IPs of all sessions in the set of sessions to be inspected are extracted to form a source IP set, and the destination IPs of all sessions are extracted to form a destination IP set.

[0077] Step 303: Intersect the destination IP set with the source IP set to obtain the associated IP set.

[0078] As described above, if the destination IP of one session is the same as the source IP of another session, then these two sessions are considered related sessions. Within the set of related IPs, a session with any one of the related IPs in the set as its destination IP is designated as the first session, and a session with any one of the related IPs as its source IP is designated as the second session. The set of related IPs can contain multiple related IPs, and each related IP corresponds to a pair of mutually related first and second sessions.

[0079] Step 304: Traverse the associated IP set. For each associated IP, extract the first session set whose destination IP is the associated IP and the second session set whose source IP is the associated IP from the session set to be inspected.

[0080] Step 305: Compare the number of uplink and downlink payload packets for each session in the first session set with the number of uplink and downlink payload packets for each session in the second session set, and obtain the first session in the first session set and the second session in the second session set with the same number of uplink and downlink payload packets.

[0081] Step 306: Extract the payload message time series of the first session and the second session with the same number of uplink and downlink payload packets, and calculate the first distance, which is the Euclidean distance, the autocorrelation coefficient distance and / or the Maharaj distance.

[0082] Step 307: If the first distance is less than the preset time threshold, then the first session and the second session are related similar sessions, the first session and the second session are proxy forwarding traffic, and the host corresponding to the corresponding associated IP is the proxy server.

[0083] In practical applications, if it is necessary to detect whether the sessions within 5 seconds before the current time are proxy forwarding traffic, the following will describe the above embodiment in detail with the first session set as session set A, the second session set as session set B, and the associated session IP set I.

[0084] First, when the detection timer configured in the device expires, the detection device retrieves sessions whose start time is within 5 seconds before the current time from the session storage; it then extracts the source IP set and destination IP set of all sessions, takes the intersection of the source IP set and the destination IP set, and obtains the IP list of associated sessions, i.e., associated session IP set I.

[0085] For each IPi in the associated session IP set I, extract the session set A with destination IP IPi and the session set B with source IP IPi.

[0086] For each session Aj in session set A and each session Bk in session set B, first compare the number of uplink and downlink payload packets of Aj and Bk. If they are equal, proceed to the next step of similarity calculation.

[0087] Take the load time series Tj of session Aj and the load time series Tk of session Bk, and calculate the Euclidean distance L. If L is less than the set time threshold Lt, then sessions Aj and Bk are considered to be related and similar sessions, and Aj and Bk are proxy forwarding traffic, where the host where the related IPi is located is the proxy server.

[0088] This embodiment extracts associated IP sets and session sets through set computation and temporary storage, making data computation and retrieval more convenient. The detection time range can be configured according to the detection accuracy and resource consumption requirements to generate a corresponding range of session sets, making it more applicable and providing more comprehensive detection.

[0089] Figure 6 This is a schematic diagram of a proxy forwarding traffic detection device provided in an embodiment of the present invention, as shown below. Figure 6As shown, the apparatus in this embodiment includes: an acquisition module 10, used to acquire session information of multiple sessions in network traffic, wherein the session information of each session includes at least the payload packet time sequence and 5-tuple information of the session; an association determination module 20, used to determine that the first session and the second session are associated sessions based on the session information, wherein the destination IP of the first session and the source IP of the second session are the same; and a proxy detection module 30, used to determine that the network traffic corresponding to the first session and the second session is proxy forwarding traffic when the similarity between the payload packet time sequence of the first session and the payload packet time sequence of the second session meets a preset time threshold.

[0090] In this embodiment, the acquisition module 10 extracts the session information required for traffic detection, the association determination module 20 determines the associated session based on the five-tuple information in the session information, and the proxy detection module 30 further determines the traffic corresponding to the associated session as proxy forwarding traffic based on the time series similarity.

[0091] The working principle and technical effects achieved in this embodiment are similar to those in the above-described method embodiments, and will not be repeated here.

[0092] In a specific embodiment, the proxy detection module 30 may include: a first detection unit and a second detection unit; the first detection unit is used to detect and determine that the number of uplink and downlink payload packets in the first session is equal to the number of uplink and downlink payload packets in the second session; the second detection unit is used to calculate a first distance between the payload packet time series of the first session and the payload packet time series of the second session, wherein the first distance is Euclidean distance, autocorrelation coefficient distance and / or Maharaj distance; if the first distance is less than a preset time threshold, then the similarity between the payload packet time series of the first session and the payload packet time series of the second session meets the preset time threshold, and the network traffic corresponding to the first session and the second session is determined to be proxy forwarding traffic.

[0093] In another embodiment, such as Figure 7 The schematic diagram shown below illustrates another proxy forwarding traffic detection device provided in an embodiment of the present invention, namely, in the above-mentioned... Figure 6The illustrated embodiment may further include: a session generation module 40, configured to receive packets in network traffic, parse out the 5-tuple information of the packets; query the configured session list based on the 5-tuple information of the packets; if a session with the same 5-tuple information is found, and the source IP of the packet is the same as the source IP of the found session, then the packet is confirmed as an uplink packet of the current session; if the payload of the uplink packet is not zero, then the uplink payload packet count is incremented by 1, and the arrival time of the uplink packet is recorded; if a session with the same 5-tuple information is found, and the source IP of the packet is the same as the destination IP of the found session, then the packet is confirmed as a downlink packet of the current session; if the downlink packet... If the payload is non-zero, increment the downlink payload packet count by 1 and record the arrival time of the downlink message. If no session with the same 5-tuple information is found, confirm that the message is a new session message, save the 5-tuple information of the message in the session list, mark the source IP to destination IP direction of the message as the uplink direction, and record the time of receiving the message as the session start time of the new session. If a transmission end message is received or no message is received after a predetermined time, confirm that the current session ends. Store the session information of the current session in the session storage. The session information of the current session includes the start time of the current session, 5-tuple information, uplink and downlink payload packet counts, and payload message time sequence.

[0094] In this embodiment, by adding a session generation module, the session information required for detection can be pre-stored and executed in parallel with the detection operation.

[0095] In practical applications, a detection time window, i.e., a traffic detection time range, can be configured according to different requirements for detection accuracy and resource consumption. Thus, in the above embodiment, the acquisition module 10 is specifically used to acquire a preset traffic detection time range; and to extract all sessions whose start times from the session storage meet the preset traffic detection time range as the set of sessions to be inspected, and to acquire the session information of each session in the set of sessions to be inspected. The association determination module 20 is specifically used to extract the source IP set and destination IP set of all sessions in the set of sessions to be inspected; to obtain the associated IP set by intersecting the destination IP set and the source IP set; then, the session with any associated IP in this associated IP set as the destination IP is the first session, and the session with any associated IP as the source IP is the second session. The proxy detection module 30 is specifically used to traverse the associated IP set. For each associated IP, it extracts a first session set whose destination IP is an associated IP and a second session set whose source IP is an associated IP from the session set to be inspected. It compares the number of uplink and downlink payload packets of each session in the first session set with the number of uplink and downlink payload packets of each session in the second session set, and obtains the first session in the first session set and the second session in the second session set with the same number of uplink and downlink payload packets. It extracts the payload packet time series of the first session with the same number of uplink and downlink payload packets and the payload packet time series of the second session, and calculates the first distance, which is the Euclidean distance, the autocorrelation coefficient distance, and / or the Maharaj distance. If the first distance is less than a preset time threshold, the first session and the second session are associated similar sessions, the first session and the second session are proxy forwarding traffic, and the host corresponding to the associated IP is the proxy server.

[0096] Figure 8 This is a schematic diagram of the structure of a proxy forwarding traffic detection system provided in an embodiment of the present invention, as shown below. Figure 8 As shown, the system in this embodiment includes: a session generation section 50, used to receive packets in network traffic and extract session information of the session to which the packets belong, the session information including: session start time, five-tuple information, number of uplink and downlink payload packets and payload packet time sequence; a session storage section 60, used to store the session information; and a session detection section 70, used to determine that a first session and a second session are associated sessions based on the session information, wherein the destination IP of the first session and the source IP of the second session are the same; and when the similarity between the payload packet time sequence of the first session and the payload packet time sequence of the second session meets a preset time threshold, the network traffic corresponding to the first session and the second session is determined to be proxy forwarding traffic.

[0097] In this embodiment, the proxy forwarding traffic detection system generates sessions for packets in the received network traffic through a session generation section to facilitate subsequent detection. Since subsequent traffic detection is based on sessions, the session generation section generates sessions for the traffic in advance. The session storage section stores the session information generated by the session generation section so that the detection section can extract sessions within the required range as needed. The session detection section first filters associated sessions based on the session information stored in the session storage section, and then judges and confirms whether the associated sessions are proxy forwarding traffic based on the similarity of the payload packet time series.

[0098] The working principle and technical effects of the system in this embodiment are similar to those of the above-described method embodiments, and will not be repeated here.

[0099] Figure 9 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention, such as... Figure 9 As shown, the electronic device 100 of this embodiment includes: a processor 1001, a memory 1002, and a computer program stored in the memory 1002 and executable on the processor 1001; wherein, when the processor runs the computer program, it implements the proxy forwarding traffic detection method in the above embodiment.

[0100] This invention also provides a computer-readable storage medium storing a computer program that can execute the proxy forwarding traffic detection method described in the above embodiments.

[0101] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting proxy forwarding traffic, characterized in that, include: Acquire session information of multiple sessions in network traffic. The session information of each session includes at least the payload message time sequence, the number of uplink and downlink payload packets, and the five-tuple information of that session. The payload message time sequence is the arrival time sequence of each payload message in each session or the time sequence composed of the arrival time interval of adjacent uplink or downlink payload messages in each session. Based on the session information, the first session and the second session are determined to be associated sessions, and the destination IP of the first session is the same as the source IP of the second session; When it is determined that the number of uplink and downlink payload packets in the first session is equal to the number of uplink and downlink payload packets in the second session, the first distance between the payload packet time series of the first session and the payload packet time series of the second session is calculated. If the first distance is less than a preset time threshold, it is confirmed that the similarity between the payload packet time series of the first session and the payload packet time series of the second session meets the preset time threshold, and the network traffic corresponding to the first session and the second session is determined to be proxy forwarding traffic.

2. The method according to claim 1, characterized in that, The first distance is the Euclidean distance, the autocorrelation coefficient distance, and / or the Maharaj distance.

3. The method according to claim 1, characterized in that, Also includes: If the network traffic corresponding to the first session and the second session is determined to be proxy forwarding traffic, then the host corresponding to the destination IP of the first session or the source IP of the second session is confirmed to be the proxy server.

4. The method according to any one of claims 1-3, characterized in that, Before obtaining session information from multiple sessions in network traffic, the method further includes: Receive packets from network traffic and parse out the 5-tuple information of the packets; Based on the 5-tuple information of the message, the configured session list is queried. If a session with the same 5-tuple information is found, and the source IP of the message is the same as the source IP of the queried session, then the message is confirmed as an uplink message of the current session. If the payload of the uplink message is not 0, the uplink payload packet count is incremented by 1, and the arrival time of the uplink message is recorded. If a session with the same 5-tuple information is found, and the source IP of the message is the same as the destination IP of the queried session, then the message is confirmed as a downlink message of the current session. If the payload of the downlink message is not 0, the downlink payload packet count is incremented by 1, and the arrival time of the downlink message is recorded. If no session with the same 5-tuple information is found, then the message is confirmed as a message of a new session. The 5-tuple information of the message is saved in the session list, and the direction from the source IP to the destination IP of the message is marked as uplink. The time of receiving the message is recorded as the session start time of the new session. If a message indicating the end of transmission is received or no message is received within the predetermined time, the current session is confirmed to have ended. The session information of the current session is stored in the session storage. The session information of the current session includes the start time of the current session, the five-tuple information, the number of uplink and downlink payload packets, and the time sequence of the payload messages.

5. The method according to claim 4, characterized in that, Also includes: Obtain the preset traffic detection time range; Accordingly, session information for multiple sessions within network traffic is obtained, specifically: Extract all sessions whose start times match the preset traffic detection time range from the session storage as the set of sessions to be inspected, and obtain the session information for each session in the set of sessions to be inspected.

6. The method according to claim 5, characterized in that, Based on the session information, the first session and the second session are determined to be related sessions, specifically: Extract the source IP set and destination IP set of all sessions in the set of sessions to be inspected; The intersection of the destination IP set and the source IP set yields the associated IP set. A session with any associated IP in this associated IP set as the destination IP is the first session, and a session with any associated IP as the source IP is the second session.

7. A proxy forwarding traffic detection device, characterized in that, include: The acquisition module is used to acquire session information of multiple sessions in network traffic. The session information of each session includes at least the payload message time sequence, the number of uplink and downlink payload packets and the five-tuple information of the session. The payload message time sequence is the arrival time sequence of each payload message in each session or the time sequence composed of the arrival time interval of adjacent uplink or downlink payload messages in each session. The association determination module is used to determine that the first session and the second session are associated sessions based on session information, wherein the destination IP of the first session and the source IP of the second session are the same; The proxy detection module is used to calculate a first distance between the payload packet time series of the first session and the payload packet time series of the second session when the number of uplink and downlink payload packets in the first session is determined to be equal to the number of uplink and downlink payload packets in the second session. If the first distance is less than a preset time threshold, it is confirmed that the similarity between the payload packet time series of the first session and the payload packet time series of the second session meets the preset time threshold, and the network traffic corresponding to the first session and the second session is determined to be proxy forwarding traffic.

8. The apparatus according to claim 7, characterized in that, The first distance is the Euclidean distance, the autocorrelation coefficient distance, and / or the Maharaj distance.

9. The apparatus according to claim 7 or 8, characterized in that, Also includes: The session generation module is used to receive packets in network traffic and parse out the five-tuple information of the packets; The configured session list is queried based on the 5-tuple information of the message. If a session with the same 5-tuple information is found and the source IP of the message is the same as the source IP of the found session, then the message is confirmed as the uplink message of the current session. If the payload of the uplink message is not 0, the number of uplink payload packets is incremented by 1 and the arrival time of the uplink message is recorded. If a session with the same five-tuple information is found, and the source IP of the packet is the same as the destination IP of the found session, then the packet is confirmed as a downlink packet of the current session. If the payload of the downlink packet is not 0, then the number of payload packets in the downlink direction is incremented by 1, and the arrival time of the downlink packet is recorded. If no session with the same five-tuple information is found, the packet is confirmed as a new session packet. The five-tuple information of the packet is saved in the session list. At the same time, the direction from the source IP to the destination IP of the packet is marked as the uplink direction. The time when the packet is received is recorded as the session start time of the new session. If a transmission end message is received or no message is received within a predetermined time, the current session is confirmed to have ended. The session information of the current session is stored in the session storage, which includes the start time of the current session, the five-tuple information, the number of uplink and downlink payload packets, and the payload message time sequence.

10. The apparatus according to claim 9, characterized in that, The acquisition module is also used to acquire a preset traffic detection time range; and specifically, it is used to extract all sessions whose start time conforms to the preset traffic detection time range from the session storage as a set of sessions to be inspected, and acquire the session information of each session in the set of sessions to be inspected. The association determination module is specifically used to extract the source IP set and destination IP set of all sessions in the session set to be inspected; to obtain the associated IP set by intersecting the destination IP set and the source IP set; then, the session with any associated IP in the associated IP set as the destination IP is the first session, and the session with any associated IP as the source IP is the second session.

11. A proxy forwarding traffic detection system, characterized in that, include: The session generation section is used to receive packets in network traffic and extract session information of the session to which the packets belong. The session information includes: session start time, five-tuple information, number of uplink and downlink payload packets and payload packet time sequence. The payload packet time sequence is the arrival time sequence of each payload packet in each session or the time sequence composed of the arrival time interval of adjacent uplink or downlink payload packets in each session. The session storage section is used to store the session information; The session detection section is used to determine that the first session and the second session are associated sessions based on session information, and that the destination IP of the first session and the source IP of the second session are the same. When the detection determines that the number of uplink and downlink payload packets of the first session is equal to the number of uplink and downlink payload packets of the second session, the first distance between the time series of the payload packets of the first session and the time series of the payload packets of the second session is calculated. If the first distance is less than a preset time threshold, it is confirmed that the similarity between the time series of the payload packets of the first session and the time series of the payload packets of the second session meets the preset time threshold, and the network traffic corresponding to the first session and the second session is determined to be proxy forwarding traffic.

12. An electronic device, characterized in that, Processor, memory, and computer programs stored in said memory and executable on said processor; The processor, when running the computer program, implements the method as described in any one of claims 1 to 6.

13. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that can be executed to implement the method as claimed in any one of claims 1 to 6.

Images