A network provenance method, system and apparatus

Abstract

The present application relates to the technical field of network security, in particular to a network tracing method, system and device, the present application obtains the first TCP SYN packet data of TCP request initiator and the second TCP SYN packet data of TCP request receiver, extracts the data information in the first / second TCP SYN packet data to obtain the first / second data information, matches the first and second data information to obtain the actual IP and actual port of TCP request initiator, the actual IP and actual port of TCP request receiver, in the technical scheme of the present application, when matching, only the TCP SYN packet data of TCP request sender and receiver needs to be processed and the data information is extracted according to the packet data, without concerning the NAT conversion process in network topology and network path, which greatly reduces the difficulty and complexity of network tracing, and the user experience is good.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and specifically to a network tracing method, system, and apparatus. Background Technology

[0002] Network attribution is a fundamental method of network behavior analysis. Network attribution generally involves two steps:

[0003] 1. The server reports access logs to the network behavior analysis platform. The access logs include: accessing machine IP, accessing machine port, server IP, and server port.

[0004] 2. The network behavior analysis platform analyzes access logs to create access relationship views based on accessing machines and access relationship views based on servers, providing network administrators with assistance in prediction and tracing.

[0005] However, Network Address Translation (NAT) technology causes problems for network attribution. If there is a NAT device between the accessing machine and the server, when the accessing machine accesses the server, the accessing machine's IP address and port will be replaced by the NAT device with the new accessing machine's IP address and port. When the server reports the access log, it will report the new accessing machine's IP address and port, which is not the real information, thus making it impossible to accurately locate the accessing machine in network attribution.

[0006] To solve this problem, the existing technology employs the following methods:

[0007] The NAT device is required to report its NAT translation logs to the network behavior analysis platform. The network behavior analysis platform will then combine the server's access logs with the NAT device's NAT translation logs to reconstruct the accessing machine's IP address and port.

[0008] However, this method greatly increases the computational difficulty of the network behavior analysis platform. If there are multiple NAT devices on the access path, the network behavior analysis will be more complex, requiring a reverse lookup based on the network topology to complete the reconstruction, resulting in low efficiency and a poor user experience. Summary of the Invention

[0009] In view of this, the purpose of the present invention is to provide a network tracing method, system and apparatus to solve the problems of high computational difficulty of existing network behavior analysis platforms, the fact that network behavior analysis becomes more complicated if there are multiple NAT devices on the access path, the need to sequentially reverse the network topology to complete the reconstruction, low efficiency and poor user experience.

[0010] According to a first aspect of the present invention, a network tracing method is provided, comprising:

[0011] Obtain the first TCP SYN packet data from the TCP request initiator and the second TCP SYN packet data from the TCP request receiver;

[0012] The first data information is obtained by extracting the data information from the first TCP SYN packet data;

[0013] The second data information is obtained by extracting the data information from the second TCP SYN packet data;

[0014] The first data information and the second data information are matched to obtain the actual IP and port of the TCP request initiator and the actual IP and port of the TCP request receiver.

[0015] Preferably, the first data information includes at least: the initiator's IP address, the initiator's port, the receiver's IP address, the receiver's port, and the TCP sequence number of the TCP SYN packet;

[0016] The second data information includes at least: the converted initiator IP, the converted initiator port, the receiver IP, the receiver port, and the TCP sequence number of the TCP SYN packet.

[0017] Preferably, the initiator is the accessing machine, and the receiver is the server.

[0018] Preferably, the step of matching the first data information and the second data information to obtain the TCP request initiator IP and initiator port, and the TCP request receiver IP and receiver port, specifically involves:

[0019] The first data information and the second data information are sent to the network behavior analysis platform for TCP sequence number matching;

[0020] If a match is successful, the access machine IP and access machine port in the first data information will be used as the actual IP and actual port of the TCP access machine; the server IP and server port in the second data information will be used as the actual IP and actual port of the TCP server.

[0021] Preferably, before obtaining the first TCP SYN packet data from the TCP request initiator and the second TCP SYN packet data from the TCP request receiver, the following steps are included:

[0022] A connection is established between the TCP request initiator and the TCP request receiver according to the TCP protocol.

[0023] Preferably, the second TCP SYN packet data is a TCP SYN packet after address translation by a NAT device.

[0024] According to a second aspect of the present invention, a network tracing device is provided, comprising:

[0025] Access to machine, server, and network behavior analysis platforms;

[0026] The access machine includes a first acquisition plugin for acquiring the first TCPSYN packet data from the TCP request initiator.

[0027] The server includes a second acquisition plugin for acquiring the second TCP SYN packet data from the TCP request receiver;

[0028] The network behavior analysis platform is used to match the data information collected by the first collection plugin and the second collection plugin to obtain the actual IP and actual port of the TCP request initiator and the actual IP and actual port of the TCP request receiver.

[0029] Preferably, the first acquisition plugin includes at least: the initiator's IP address, the initiator's port, the receiver's IP address, the receiver's port, and the TCP sequence number of the TCP SYN packet;

[0030] The second acquisition plugin includes at least: the converted initiator IP, the converted initiator port, the receiver IP, the receiver port, and the TCP sequence number of the TCP SYN packet.

[0031] Preferably, the network behavior analysis platform is used to match the data information collected by the first collection plugin and the second collection plugin to obtain the TCP request initiator IP and initiator port, and the TCP request receiver IP and receiver port, specifically:

[0032] The data collected by the first and second acquisition plugins are sent to the network behavior analysis platform for TCP sequence number matching;

[0033] If a match is successful, the access machine IP and access machine port collected by the first collection plugin will be used as the actual IP and actual port of the TCP access machine; the server IP and server port collected by the second collection plugin will be used as the actual IP and actual port of the TCP server.

[0034] According to a third aspect of the present invention, a network tracing system is provided, comprising: an acquisition module, configured to acquire first TCP SYN packet data of a TCP request initiator and second TCP SYN packet data of a TCP request receiver;

[0035] The first extraction module is used to extract data information from the first TCP SYN packet data to obtain the first data information;

[0036] The second extraction module is used to extract data information from the second TCP SYN packet data to obtain the second data information;

[0037] The matching module is used to match the first data information and the second data information to obtain the actual IP and actual port of the TCP request initiator and the actual IP and actual port of the TCP request receiver.

[0038] The technical solutions provided by the embodiments of the present invention may include the following beneficial effects:

[0039] This invention obtains the first TCP SYN packet data from the TCP request initiator and the second TCP SYN packet data from the TCP request receiver, extracts data information from the first / second TCP SYN packet data to obtain first / second data information, and matches the first and second data information to obtain the actual IP and port of the TCP request initiator and the actual IP and port of the TCP request receiver. In the technical solution of this invention, during the matching process, only the TCP SYN packet data of the TCP request sender and receiver needs to be processed and data information extracted from the packet data, without needing to concern themselves with the network topology and NAT translation process in the network path, which greatly reduces the difficulty and complexity of network tracing and provides a better user experience.

[0040] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit the invention. Attached Figure Description

[0041] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0042] Figure 1 This is a flowchart illustrating a network tracing method according to an exemplary embodiment;

[0043] Figure 2 This is a flowchart illustrating the workflow of an accessing machine initiating a TCP connection establishment request to a server, according to an exemplary embodiment.

[0044] Figure 3 This is a flowchart illustrating the workflow after a message reaches the server, according to an exemplary embodiment.

[0045] Figure 4 This is a block diagram illustrating a network tracing device according to an exemplary embodiment;

[0046] Figure 5 This is a diagram of a network tracing system according to an exemplary embodiment. Detailed Implementation

[0047] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Rather, they are merely examples of apparatuses and methods consistent with some aspects of the invention as detailed in the appended claims.

[0048] Example 1

[0049] In one embodiment, see Figure 1 , Figure 1 This is a flowchart illustrating a network tracing method according to an exemplary embodiment, such as... Figure 1 As shown, the method includes:

[0050] Step S01: Obtain the first TCP SYN packet data from the TCP request initiator and the second TCP SYN packet data from the TCP request receiver;

[0051] Step S02: Extract the data information from the first TCP SYN packet data to obtain the first data information;

[0052] Step S03: Extract the data information from the second TCP SYN packet data to obtain the second data information;

[0053] Step S04: Match the first data information and the second data information to obtain the actual IP and actual port of the TCP request initiator and the actual IP and actual port of the TCP request receiver.

[0054] It should be noted that the technical solution provided in this embodiment is applicable to scenarios where TCP requests access network source tracing are performed and the network source tracing uses NAT technology for address translation, making it impossible to locate the actual IP and port of the visitor.

[0055] The system consists of two parts: a first acquisition plugin on the accessing machine, which sends a first TCP SYN packet to the first acquisition plugin; the first acquisition plugin extracts the initiator IP, initiator port, receiver IP, receiver port, and TCP sequence number from the first TCP SYN packet; the first TCP SYN packet then undergoes one or more address translations via a NAT device to be converted into a second TCP SYN packet; and a second acquisition plugin on the server receives the second TCP SYN packet and sends it to the second acquisition plugin; the second acquisition plugin extracts the initiator IP, the translated initiator port, the receiver IP, the receiver port, and the TCP sequence number from the second TCP SYN packet after address translation via the NAT device. It should be noted that NAT does not change the TCP sequence number in the TCP SYN packet during address translation, so the TCP sequence number in the first and second data information is identical.

[0056] It should be noted that the extracted first and second data information are specifically: the source IP field of the IP header, the destination IP field of the IP header, the source port field of the TCP header, the destination port field of the TCP header, and the TCP sequence number of the TCP header.

[0057] It should be noted that the technical solution provided in this embodiment obtains the first TCP SYN packet data from the TCP request initiator and the second TCP SYN packet data from the TCP request receiver, extracts data information from the first / second TCP SYN packet data to obtain first / second data information, and matches the first and second data information to obtain the actual IP and port of the TCP request initiator and the actual IP and port of the TCP request receiver. In the technical solution of this invention, when performing the matching, it is only necessary to process the TCP SYN packet data of the TCP request sender and receiver and extract data information based on the packet data, without having to care about the network topology and the NAT translation process in the network path, which greatly reduces the difficulty and complexity of network tracing and provides a good user experience.

[0058] In practical applications, before obtaining the first TCP SYN packet data from the TCP request initiator and the second TCP SYN packet data from the TCP request receiver, the process includes: establishing a connection between the TCP request initiator and the TCP request receiver according to the TCP protocol.

[0059] In practical applications, the first data information includes at least: the initiator's IP, the initiator's port, the receiver's IP, the receiver's port, and the TCP sequence number of the TCP SYN packet; the second data information includes at least: the converted initiator's IP, the converted initiator's port, the receiver's IP, the receiver's port, and the TCP sequence number of the TCP SYN packet.

[0060] It should be noted that the translated initiator IP and port are obtained after the NAT device performs address translation on the first TCP SYN packet data, and are new, different from the data in the first data information.

[0061] In practical applications, the initiator is the accessing machine, and the receiver is the server.

[0062] In practical applications, matching the first data information and the second data information to obtain the TCP request initiator's IP and initiator's port, and the TCP request receiver's IP and receiver's port, specifically involves:

[0063] The first data information and the second data information are sent to the network behavior analysis platform for TCP sequence number matching;

[0064] If a match is successful, the access machine IP and access machine port in the first data information will be used as the actual IP and actual port of the TCP access machine; the server IP and server port in the second data information will be used as the actual IP and actual port of the TCP server.

[0065] It should be noted that the common NAT is SNAT, which only translates the IP address and port of the accessing machine; however, there are also NAT devices that are SNAT+DNAT: that is, they not only translate the IP address and port of the accessing machine, but also the IP address and port of the server. Therefore, by obtaining the actual IP address and port of the accessing machine from the first data and the server IP address and port from the second data, it can meet the needs of various scenarios.

[0066] In practical applications, the second TCP SYN packet data is the TCP SYN packet after address translation by the NAT device.

[0067] In one embodiment, see Figure 2 , Figure 2 This is a flowchart illustrating the workflow of an accessing machine initiating a TCP connection establishment request to a server, according to an exemplary embodiment:

[0068] Step S11: The accessing machine first sends the first TCP SYN packet data to the first acquisition plugin;

[0069] Step S12: The first acquisition plugin extracts the accessing machine IP, accessing machine port, server IP, server port and TCP sequence number from the message;

[0070] Step S13: Send the first TCP SYN packet data to the NAT device;

[0071] The extracted access machine IP, access machine port, server IP, server port, and TCP sequence number are sent to the network behavior analysis platform.

[0072] In one embodiment, see Figure 3 , Figure 3 This is a flowchart illustrating the workflow after a message reaches the server, according to an exemplary embodiment:

[0073] Step S21: The server receives the second TCP SYN packet data sent by the NAT device;

[0074] Step S22: The second acquisition plugin extracts the access machine IP, access machine port, server IP, server port, and TCP sequence number from the second TCP SYN packet data after it has been translated by the NAT device.

[0075] Step S23: The operating system continues to process the second TCP SYN packet data;

[0076] The access machine IP, access machine port, server IP, server port, and TCP sequence number, after being translated by NAT, are sent to the network behavior analysis platform.

[0077] Finally, the network behavior analysis platform obtains the actual IP and port of the TCP request initiator and the actual IP and port of the TCP request receiver by matching the TCP sequence numbers extracted from the first and second collection plugins.

[0078] It should be noted that the technical solution provided in this embodiment can obtain the actual IP and actual port of the accessing machine by matching the TCP sequence number in the first data information and the second data information. It does not require reconstructing the network topology by sequentially looking back, which reduces the difficulty and complexity of network tracing and can greatly improve the platform's working efficiency, resulting in a good user experience and high satisfaction.

[0079] Example 2

[0080] In one embodiment, see Figure 4 , Figure 4This is a block diagram of a network tracing device according to an exemplary embodiment, wherein the server provides TCP service, the accessing machine initiates a TCP access request to the server, and there is one or more NAT devices between the accessing machine and the server for address translation.

[0081] In practice, network tracing devices include: access machines, servers, and network behavior analysis platforms;

[0082] The access machine includes a first acquisition plugin for acquiring the first TCPSYN packet data from the TCP request initiator.

[0083] The server includes a second acquisition plugin for acquiring the second TCP SYN packet data from the TCP request receiver;

[0084] The network behavior analysis platform is used to match the data information collected by the first collection plugin and the second collection plugin to obtain the actual IP and actual port of the TCP request initiator and the actual IP and actual port of the TCP request receiver.

[0085] It should be noted that the technical solution provided in this embodiment is applicable to scenarios where TCP requests access network source tracing are performed and the network source tracing uses NAT technology for address translation, making it impossible to locate the actual IP and port of the visitor.

[0086] It should be noted that the first and second data collection plugins are a single software package, installed on the access machine and the server, respectively. The software on the access machine records the sent TCP SYN packet data and sends this data to the network behavior analysis platform. The software on the server records the received TCP SYN packet information and sends this information to the network behavior analysis platform. Both the access machine and the server must have this data collection software installed to report both sent and received SYN packet information to the network behavior analysis platform. Only after receiving information from both the sender and receiver can the network behavior analysis platform complete the association of access behavior.

[0087] A first data acquisition plugin is installed on the accessing machine. The accessing machine sends a first TCP SYN packet to the first acquisition plugin. The first acquisition plugin extracts the initiator's IP, initiator's port, receiver's IP, receiver's port, and the TCP sequence number of the TCP SYN packet from the first TCP SYN packet. Then, the first TCP SYN packet undergoes one or more address translations via a NAT device, transforming it into a second TCP SYN packet. A second data acquisition plugin is installed on the server. The server receives the second TCP SYN packet and sends it to the second acquisition plugin. The second acquisition plugin extracts the initiator's IP, the translated initiator's port, the receiver's IP, receiver's port, and the TCP sequence number from the second TCP SYN packet after address translation via NAT. It should be noted that NAT does not change the TCP sequence number in the TCP SYN packet during address translation, so the TCP sequence numbers in the first and second data information are exactly the same. The network behavior analysis platform obtains the actual IP and port of the TCP request initiator and the actual IP and port of the TCP request receiver by matching the TCP sequence numbers extracted by the first and second acquisition plugins.

[0088] It is understood that the technical solution provided in this embodiment obtains the first TCP SYN packet data of the TCP request initiator and the second TCP SYN packet data of the TCP request receiver, extracts data information from the first / second TCP SYN packet data to obtain first / second data information, and matches the first and second data information to obtain the actual IP and actual port of the TCP request initiator and the actual IP and actual port of the TCP request receiver. In the technical solution of the present invention, when performing the matching, it is only necessary to process the TCP SYN packet data of the TCP request sender and receiver and extract data information based on the packet data, without having to care about the network topology and the NAT translation process in the network path, which greatly reduces the difficulty and complexity of network tracing and provides a good user experience.

[0089] In practice, the first acquisition plugin includes at least: the initiator's IP address, the initiator's port, the receiver's IP address, the receiver's port, and the TCP sequence number of the TCP SYN packet;

[0090] The second acquisition plugin includes at least: the converted initiator IP, the converted initiator port, the receiver IP, the receiver port, and the TCP sequence number of the TCP SYN packet.

[0091] In practice, the network behavior analysis platform is used to match the data information collected by the first and second collection plugins to obtain the TCP request initiator IP and initiator port, and the TCP request receiver IP and receiver port, specifically:

[0092] The data collected by the first and second acquisition plugins are sent to the network behavior analysis platform for TCP sequence number matching;

[0093] If a match is successful, the access machine IP and access machine port collected by the first collection plugin will be used as the actual IP and actual port of the TCP access machine; the server IP and server port collected by the second collection plugin will be used as the actual IP and actual port of the TCP server.

[0094] Example 3

[0095] In one embodiment, see Figure 5 , Figure 5 A network tracing system 500, as illustrated in an exemplary embodiment, includes:

[0096] The acquisition module 501 is used to acquire the first TCP SYN packet data of the TCP request initiator and the second TCP SYN packet data of the TCP request receiver;

[0097] The first extraction module 502 is used to extract data information from the first TCP SYN packet data to obtain the first data information;

[0098] The second extraction module 503 is used to extract data information from the second TCP SYN packet data to obtain the second data information;

[0099] The matching module 504 is used to match the first data information and the second data information to obtain the actual IP and port of the TCP request initiator and the actual IP and port of the TCP request receiver. In practice, the system can be used as a separate archive file, embedded for third-party systems to call.

[0100] It should be noted that the technical solution provided in this embodiment is applicable to scenarios where TCP requests access network source tracing are performed and the network source tracing uses NAT technology for address translation, making it impossible to locate the actual IP and port of the visitor.

[0101] It is understood that the technical solution provided in this embodiment, through the acquisition module 501, is used to acquire the first TCP SYN packet data of the TCP request initiator and the second TCP SYN packet data of the TCP request receiver; the first extraction module 502 and the second extraction module 503 are used to extract data information from the first / second TCP SYN packet data to obtain the first / second data information; and the matching module 504 is used to match the first and second data information to obtain the actual IP and actual port of the TCP request initiator and the actual IP and actual port of the TCP request receiver. In the technical solution of the present invention, when performing matching, it is only necessary to process the TCP SYN packet data of the TCP request sender and receiver and extract data information based on the packet data, without having to care about the network topology and the NAT translation process in the network path, which greatly reduces the difficulty and complexity of network tracing and provides a good user experience.

[0102] The computer-readable storage media disclosed in this embodiment include, but are not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatuses, or devices, or any combination thereof. More specific examples of computer-readable storage media (a non-exhaustive list) include: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0103] It is understood that the same or similar parts in the above embodiments can be referred to each other, and the contents not described in detail in some embodiments can be referred to the same or similar contents in other embodiments.

[0104] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing a particular logical function or process, and the scope of the preferred embodiments of the invention includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as will be understood by those skilled in the art to which embodiments of the invention pertain.

[0105] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0106] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.

[0107] Furthermore, the functional units in the various embodiments of the present invention can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0108] The storage media mentioned above can be read-only memory, disk, or optical disk, etc.

[0109] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0110] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. A network tracing method, characterized in that, include: Obtain the first TCP SYN packet data from the TCP request initiator and the second TCP SYN packet data from the TCP request receiver; The first data information is obtained by extracting the data information from the first TCP SYN packet data; The second data information is obtained by extracting the data information from the second TCP SYN packet data; The first data information and the second data information are matched to obtain the actual IP and actual port of the TCP request initiator and the actual IP and actual port of the TCP request receiver. The first data information includes at least the TCP sequence number of the TCP SYN packet; the second data information includes at least the TCP sequence number of the TCP SYN packet; the matching of the first data information and the second data information includes matching based on the TCP sequence number in the first data information and the TCP sequence number in the second data information; The second TCP SYN packet data is the TCP SYN packet after address translation by the NAT device.

2. The method according to claim 1, characterized in that, The first data information also includes at least: the initiator's IP address, the initiator's port, the receiver's IP address, and the receiver's port; The second data information includes at least: the converted initiator IP, the converted initiator port, the receiver IP, and the receiver port.

3. The method according to claim 2, characterized in that, The initiator is the accessing machine, and the receiver is the server.

4. The method according to claim 3, characterized in that, The step of matching the first data information and the second data information to obtain the TCP request initiator IP and initiator port, and the TCP request receiver IP and receiver port, specifically involves: The first data information and the second data information are sent to the network behavior analysis platform for TCP sequence number matching; If the match is successful, the access machine IP and access machine port in the first data information will be used as the actual IP and actual port of the TCP access machine. Use the server IP and server port in the second data information as the actual IP and actual port of the TCP server.

5. The method according to claim 1, characterized in that, Before obtaining the first TCP SYN packet data from the TCP request initiator and the second TCP SYN packet data from the TCP request receiver, the following steps are included: A connection is established between the TCP request initiator and the TCP request receiver according to the TCP protocol.

6. The method according to any one of claims 1-5, characterized in that, The second TCP SYN packet data is the TCP SYN packet after address translation by the NAT device.

7. A network tracing device, employing the method described in any one of claims 1-6, characterized in that, include: Access to machine, server, and network behavior analysis platforms; The access machine includes a first acquisition plugin for acquiring the first TCP SYN packet data from the TCP request initiator. The server includes a second acquisition plugin for acquiring the second TCP SYN packet data from the TCP request receiver; The network behavior analysis platform is used to match the data information collected by the first collection plugin and the second collection plugin to obtain the actual IP and actual port of the TCP request initiator and the actual IP and actual port of the TCP request receiver.

8. The apparatus according to claim 7, characterized in that, The first acquisition plugin includes at least: the initiator's IP address, the initiator's port, the receiver's IP address, the receiver's port, and the TCP sequence number of the TCP SYN packet; The second acquisition plugin includes at least: the converted initiator IP, the converted initiator port, the receiver IP, the receiver port, and the TCP sequence number of the TCP SYN packet.

9. The apparatus according to claim 8, characterized in that, The network behavior analysis platform is used to match the data information collected by the first and second collection plugins to obtain the TCP request initiator IP and initiator port, and the TCP request receiver IP and receiver port, specifically: The data collected by the first and second acquisition plugins are sent to the network behavior analysis platform for TCP sequence number matching; If the match is successful, the access machine IP and access machine port collected by the first collection plugin will be used as the actual IP and actual port of the TCP access machine. Use the server IP and server port collected by the second acquisition plugin as the actual IP and actual port of the TCP server.

10. A network traceability system, characterized in that, include: The acquisition module is used to acquire the first TCP SYN packet data from the TCP request initiator and the second TCP SYN packet data from the TCP request receiver. The first extraction module is used to extract data information from the first TCP SYN packet data to obtain the first data information; The second extraction module is used to extract data information from the second TCP SYN packet data to obtain the second data information; The matching module is used to match the first data information and the second data information to obtain the actual IP and actual port of the TCP request initiator and the actual IP and actual port of the TCP request receiver. The first data information includes at least the TCP sequence number of the TCP SYN packet; the second data information includes at least the TCP sequence number of the TCP SYN packet; the matching of the first data information and the second data information includes matching based on the TCP sequence number in the first data information and the TCP sequence number in the second data information; The second TCP SYN packet data is the TCP SYN packet after address translation by the NAT device.

Images