A detection method for multi-level jump webpages

Abstract

The application discloses a detection method for multi-level jump webpages. The method comprises the following steps: detecting single-level pages respectively according to the protocol fingerprints and the page structure fingerprints of the TLS encrypted traffic of each level page, extracting the time attribute and the client IP attribute of each level page detection result, and associating the multi-level pages. The application can well cope with the current cloud platform by deeply mining existing features and introducing associated features in multiple dimensions, and can well detect the malicious webpage traffic under the cloud platform, so that the server resources of multiple applications are shared, multiple network services are carried by the same IP, and different services share the domain name.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security, and particularly relates to a detection method for multi-level jump webpages. BACKGROUND

[0002] Under the background of increasingly enhanced supervision, malicious webpages often show family characteristics, and malicious webpages of families often flow to each other through mutual jumping. The multi-level jump feature of a webpage is a feature describing the behavior of a user jumping from a primary page to a secondary page through a link when accessing the webpage from the perspective of user behavior. For the problem of malicious webpage detection, by introducing the multi-level jump feature, the existing feature space can be enriched, and the accuracy of malicious webpage flow detection can be improved.

[0003] With the deepening of the social digital transformation, network security threats such as false information, network fraud, security vulnerabilities, data breaches, and ransomware are increasingly prominent, and the carriers of these threats are often malicious webpages. According to the "2020 China Internet Network Security Situation Review" released by the National Internet Emergency Center (CNCERT), about 200,000 malicious impersonation pages were monitored in 2020, an increase of 1.4 times year-on-year; the 10 pilot browser manufacturers in China prompted and intercepted malicious phishing websites 390 million times in a year; most of the malicious webpages monitored are related to finance and telecommunications, but there are also many education and government-related malicious webpages. It can be seen that malicious webpages not only infringe on the thoughts and property of citizens, but also threaten social stability and national security. Therefore, the research on the detection and identification of malicious webpages has important practical significance.

[0004] For traditional HTTP malicious webpages, most research results are based on the static features of the webpage, mainly including three categories of host information, URL information, and page information. The host information mainly uses WHOIS and DNS information, the URL information mainly uses the length of the URL and its component strings, and the bag-of-words features of special characters, and the page information mainly includes HTML, Javascript information, and the proportion of HTTP requests inside and outside the domain. However, according to the statistics of the Netmarketshare agency, as of October 2019, more than 90% of global web traffic uses HTTPS encryption, and the use of encryption services limits the application scope of traditional detection techniques that rely on page content. The detection and analysis method based on traditional static features has poor practical effect at the gateway for actual control.

[0005] Currently, for malicious web HTTPS traffic, most of the research results are based on TLS plaintext load information, encrypted part of the data packet length sequence, inter-packet delay sequence and other characteristics to detect encrypted malicious web traffic. These characteristics can be generally summarized as two types of characteristics: packet level characteristics and session flow level characteristics. However, with the increasing maturity of cloud computing and CDN technology, more and more web pages are deployed to the cloud, and malicious web pages are mixed in them. In this background, the detection of encrypted malicious web traffic is also facing new challenges. The multi-application sharing resources, multiple network services carried by the same IP, and domain names shared by different services caused by cloud platform deployment (see the figure) all make it more difficult to distinguish malicious web encrypted traffic. In the face of these challenges, the commonly used packet level characteristics and session flow level characteristics cannot strongly represent the malicious web pages, and more angle features need to be introduced to enrich the existing feature space. SUMMARY

[0006] The present application aims at the problems existing in the prior art, and provides a detection method for multi-level jump web pages, so as to realize effective detection of target web pages.

[0007] The technical solution for realizing the present application is a detection method for multi-level jump web pages, which comprises the following steps:

[0008] Step 1: Extracting the load information of the TLS encrypted traffic data packets of each level of page, and comparing with the protocol fingerprint characteristics;

[0009] Step 2: Based on the page structure characteristics of each level of page, extracting the load length sequence of the page TLS encrypted traffic data packets;

[0010] Step 3: Extracting the client IP attribute and time attribute of the multi-level page detection log, and then accurately screening the detection log according to the association information between the client IP attribute and the time attribute of the different page detection logs to obtain the associated log.

[0011] Further, before the load information of the TLS encrypted traffic data packets of each level of page in step 1 is extracted, the following steps are further included:

[0012] Resolving the TCP data stream according to the source address, destination address, source port, destination port and protocol five-tuple;

[0013] Sorting the TCP data stream according to the sequence number and acknowledgement number;

[0014] Extracting the TLS protocol traffic from the TCP data stream through protocol screening means.

[0015] Further, the step 1 of extracting the load information of the page-level page TLS encrypted traffic data packet further comprises: acquiring the fingerprint feature information of the TLS protocol handshake part.

[0016] Further, the step 2 of comparing the protocol fingerprint feature comprises: comparing the acquired TLS fingerprint feature information with the pre-summarized TLS fingerprint feature information of the page-level page traffic.

[0017] Further, the fingerprint feature information of the TLS protocol handshake part comprises:

[0018] Clienthello packet information of the TLS handshake stage;

[0019] Serverhello packet information of the TLS handshake stage;

[0020] The Clienthello packet information comprises:

[0021] version field of the TLS layer and the handshake layer in the Clienthello packet;

[0022] Session ID field in the Clienthello packet;

[0023] SNI field and ALPN field in the extension field of the Clienthello packet;

[0024] The Serverhello packet information comprises:

[0025] Supported Version field in the Serverhello packet.

[0026] Further, the step 2 of extracting the load length sequence of the page TLS encrypted traffic data packet further comprises:

[0027] extracting the load length of the first 100 data packets with load before extracting the length sequence of the TLS traffic TCP data stream;

[0028] marking positive and negative according to the data packet direction: marking the client to server as uplink, the uplink as positive, the server to client as downlink, and the downlink as negative;

[0029] According to the pre-summarized page structure features of the page-level page, in the extracted 100 data packet load length sequence, the length sequence fragment corresponding to the specific page structure feature is found by the window sliding method;

[0030] According to the two-level fingerprints, i.e., the TLS protocol fingerprint feature of the webpage traffic and the length sequence feature based on the page structure, single-level webpages in the multi-level jump webpage chain are detected, and finally the detection log is output.

[0031] Further, the page structure features of the respective levels of pages include: webpage frames, website logos and specific static resources; the specific static resources include javascript, cascading style sheets (CSS) and background pictures.

[0032] Further, after the client IP attribute and the time attribute of the multi-level page detection log are extracted in step 3, the method further includes:

[0033] The client IP attributes of the detection results of the respective levels of pages are associated.

[0034] The time attributes of the detection results of the respective levels of pages are associated.

[0035] Further, the association of the client IP attributes of the detection results of the respective levels of pages specifically includes: comparing the client IP attributes of the respective levels of webpage detection logs, and screening out log information with the same client IP.

[0036] Further, the association of the time attributes of the detection results of the respective levels of pages specifically includes:

[0037] For the multi-level jump page detection logs with the same client IP, it is judged whether the time sequence order composed of the time attributes of the logs is consistent with the order of the webpage access behaviors.

[0038] Compared with the prior art, the present application has the following advantages:

[0039] 1) By introducing a new session level traffic feature, i.e., the multi-level page jump behavior feature from the user behavior perspective, the feature set of the malicious webpage traffic detection can be enriched, and the detection accuracy can be improved.

[0040] 2) By deeply mining the spatiotemporal features of the malicious webpage encrypted traffic from the page resource perspective, more descriptive detection features of the malicious webpage encrypted traffic are obtained, and the malicious webpage traffic detection capability is improved.

[0041] Overall, the present application can well cope with the current situation of multi-application sharing of server resources, multiple network services carried by the same IP, and different services sharing domain names under the cloud platform by deeply mining existing features and introducing associated features in multiple dimensions, and has good detection effect on malicious webpage traffic under the cloud platform.

[0042] The present application will be described in further detail below with reference to the accompanying drawings. BRIEF DESCRIPTION OF DRAWINGS

[0043] Figure 1 The figure shows the steps of the detection method for multi-level jump webpage of the present application.

[0044] Figure 2 The figure shows the detailed flow of the detection method for multi-level jump webpage of the present application. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical scheme and advantages of the present application more clear, the present application is further described in detail below in combination with the drawings and examples. It should be understood that the specific examples described herein are only used to explain the present application and do not limit the present application.

[0046] The present application provides a detection method for multi-level jump webpage, comprising:

[0047] According to the source address, destination address, source port, destination port, protocol five tuple, the TCP data stream is parsed out.

[0048] According to the sequence number, the TCP data stream is sorted.

[0049] The TLS protocol is identified.

[0050] The load information of the encrypted traffic data packet of each level page TLS is extracted, including:

[0051] The version field of the TLS layer and handshake layer in the TLS handshake Clienthello packet is extracted;

[0052] The Session ID field in the TLS handshake Clienthello packet is extracted;

[0053] The SNI field and ALPN field in the extension field of the TLS handshake Clienthello packet are extracted;

[0054] The Supported Version field in the TLS handshake Serverhello packet is extracted.

[0055] The obtained TLS fingerprint information is compared with the TLS fingerprint information of the traffic of each level page summarized in advance to identify whether they match.

[0056] Based on the page structure characteristics of each level page, the load length sequence of the encrypted traffic data packet of the page TLS is extracted.

[0057] The load length of the first 100 data packets with load in the length sequence of the TLS traffic TCP data stream is extracted.

[0058] According to the direction mark of the data packet, mark the client to server as uplink, uplink as positive, server to client as downlink, and downlink as negative.

[0059] According to the pre-summarized page structure characteristics of each level of page, in the extracted 100 data packet load length sequences, the length sequence fragments corresponding to specific page structures are found in a window sliding manner, including:

[0060] Extracting the length sequence corresponding to the web framework;

[0061] Extracting the length sequence corresponding to specific static resources (js, css, background pictures);

[0062] Extracting the length sequence corresponding to the website logo.

[0063] According to the above two-level fingerprints, i.e., the TLS protocol fingerprint characteristics of web traffic and the length sequence characteristics based on page structure, single-level pages in the multi-level jump web page chain are detected.

[0064] The client IP attributes of the detection results of each level of page are associated, and the client IP attributes of the detection logs of each level of page are compared, and the log information with the same client IP is filtered out.

[0065] The time attributes of the detection results of each level of page are associated, and for the multi-level jump page detection logs with the same client IP, it is judged whether the time sequence order composed of the time attributes of the logs is consistent with the order of the access web behavior.

[0066] Figure 1 The steps of the multi-level jump web page detection method of the application are shown in the schematic diagram. Figure 1 As shown in the schematic diagram, the detection method includes the following steps:

[0067] Step S101, detecting single-level pages respectively according to the protocol fingerprints of the TLS encrypted traffic of each level of page and the page structure fingerprints;

[0068] The detection process is specifically shown in the single-level page detection module of Figure 2

[0069] First, the data packet load information of the TLS traffic to be detected is extracted, the protocol fingerprint information of the TLS traffic is extracted therefrom, and the TLS traffic matching the page TLS fingerprint characteristics is filtered out;

[0070] Then, the load length sequence is extracted, and the TLS traffic matching the length sequence characteristics corresponding to the page structure is filtered out;

[0071] Step S102, extracting the time attributes and client IP attributes of the detection results of each level of page and associating the multi-level pages;

[0072] The association process is specifically shown in the multi-level page association module of Figure 2 ​​

[0073] Firstly, the detection logs of the multi-level pages are acquired;

[0074] The client IP attributes of the detection logs of each level page are extracted respectively, and the log information with the same client IP attribute in the detection logs of different pages is screened out;

[0075] The time attribute information of the screened detection logs is extracted, and the log information with the page access sequence, i.e. with the specific time sequence, in the detection logs of different pages is screened out.

[0076] The basic principle, main features and advantages of the present application are shown and described above. It should be understood by the person skilled in the art that the present application is not limited by the above-mentioned embodiments, and the above-mentioned embodiments and descriptions in the specification are only to illustrate the principle of the present application. Without departing from the spirit and scope of the present application, various changes and improvements can be made to the present application, and these changes and improvements all fall within the scope of the present application. The scope of protection of the present application is defined by the appended claims and their equivalents.

Claims

1. A detection method for multi-hop jump webpages, characterized in that, The method comprises the following steps: Step 1, extracting the load information of the encrypted traffic data packet of the page-level page secure transmission layer protocol (TLS) and comparing with the protocol fingerprint feature; Step 2, based on the page structure features of the page-level page, extracting the load length sequence of the page TLS encrypted traffic data packet; Step 3, extracting the client IP attribute and time attribute of the multi-level page detection log, and then according to the association information between the client IP attribute and the time attribute of the different page detection logs, accurately screening the detection logs to obtain the associated logs; Before the step 1, the method further comprises the following steps: Resolving the TCP data stream according to the source address, destination address, source port, destination port and protocol five-tuple; Sorting the TCP data stream according to the sequence number and acknowledgement number; Extracting the TLS protocol traffic from the TCP data stream through protocol screening means; After the step 1, the method further comprises the following step:

2. The method for detecting multi-level jump webpages according to claim 1, characterized in that, Obtaining the fingerprint feature information of the TLS protocol handshake part.

3. The method of claim 1, wherein, The comparison with the protocol fingerprint feature is specifically: comparing the obtained TLS fingerprint feature information with the pre-summarized TLS fingerprint feature information of the page-level web traffic. The fingerprint feature information of the TLS protocol handshake part comprises: Clienthello packet information in the TLS handshake stage; Serverhello packet information in the TLS handshake stage; The Clienthello packet information specifically comprises: Version field of the TLS layer and the handshake layer in the Clienthello packet; Session ID field in the Clienthello packet; SNI field and ALPN field in the extension field of the Clienthello packet; The Serverhello packet information specifically comprises:

4. The method of claim 2, wherein, SupportedVersion field in the Serverhello packet. After the step 2, the method further comprises the following steps: Extracting the load length of the first 100 data packets with load in the length sequence of the TLS traffic TCP data stream; Marking the direction of the data packet as positive and negative: marking the client to server as uplink, the uplink as positive, the server to client as downlink, and the downlink as negative; According to the pre-summarized page structure features of the page-level page, in the extracted 100 data packet load length sequence, the length sequence segment corresponding to the specific page structure feature is found through the window sliding method; 5. The method for detecting multi-level jump web pages of claim 4, wherein, According to the above two levels of fingerprint, i.e., the TLS protocol fingerprint feature of the web traffic and the length sequence feature based on the page structure, the single-level page in the multi-level jump web page chain is detected, and finally the detection log is output.

6. The method of claim 4, wherein, The page structure features of the page-level page comprise: web framework, website logo and specific static resources; the specific static resources comprise javascript, cascading style sheet (CSS) and background picture. After the step 3, the method further comprises the following steps: Correlate the client IP attributes of the detection results of the pages at different levels; Correlate the time attributes of the detection results of the pages at different levels.

7. The method of claim 6, wherein, The correlating the client IP attributes of the detection results of the pages at different levels specifically includes: comparing the client IP attributes of the detection logs of the pages at different levels, and screening out the log information with the same client IP.

8. The method for detecting multi-level jump webpages of claim 6, wherein, The correlating the time attributes of the detection results of the pages at different levels specifically includes: For the multi-level jump page detection logs with the same client IP, it is judged whether the time sequence order formed by the time attributes of the logs is consistent with the order of the access page behaviors.

Images