A method and apparatus for customizing a cryptographic protocol cluster

Abstract

The embodiment of the application discloses a self-defined encryption protocol clustering method and device, the method comprises the following steps: obtaining a target encryption protocol to be identified, and extracting traffic data and metadata of the target encryption protocol; constructing a label matrix and a value matrix based on the traffic data; and fusing the label matrix and the value matrix by using a multi-mode matching algorithm to obtain a clustering label. In this way, the self-defined encryption protocol clustering method provided by the application combines double-matrix combination with a pattern matching algorithm to realize clustering of self-defined encryption protocols. The method solves the problem that mixed self-defined protocols cannot be quickly and accurately clustered, and provides support for subsequent protocol analysis by quickly and accurately realizing clustering of self-defined protocols.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and specifically to a method and apparatus for clustering custom encryption protocols. Background Technology

[0002] Network information security and countermeasures have become crucial issues of great concern in the information age. In fields such as electronic warfare, the protocols used by both parties in communication are often customized and non-public, and the intercepted communication data is mostly continuous bit stream information. In fields such as network surveillance, protocol parsing tools used in network communication also encounter many custom encryption protocols that they cannot parse. Protocol analysts have no prior knowledge of these protocols, making it extremely difficult to decipher these completely unknown protocols.

[0003] Traditional methods utilize data frame delimitation based on fingerprint features or methods based on association rules to identify custom encryption protocols in specific environments. These methods can achieve good results under their respective conditions and provide useful references for identifying custom encryption protocols. However, they all analyze data under the assumption of a single protocol. In real-world applications, the captured custom encryption data often contains a mixture of multiple protocols. Existing technologies cannot cluster mixed protocols, making the parsing of mixed protocols extremely difficult.

[0004] Therefore, providing a method and apparatus for clustering custom encryption protocols to solve the problem that hybrid custom protocols cannot achieve fast and accurate clustering has become an urgent problem for those skilled in the art. Summary of the Invention

[0005] To address this, embodiments of the present invention provide a method and apparatus for clustering custom encryption protocols, which at least partially solves the problem that hybrid custom protocols cannot be clustered quickly and accurately, thereby providing support for subsequent protocol analysis by quickly and accurately clustering custom protocols.

[0006] To achieve the above objectives, the embodiments of the present invention provide the following technical solutions:

[0007] This invention provides a custom encryption protocol clustering method, the method comprising:

[0008] Obtain the target encryption protocol to be identified, and extract the traffic data and metadata of the target encryption protocol;

[0009] A tag matrix and a value matrix are constructed based on the traffic data;

[0010] The label matrix and the value matrix are fused using a multi-pattern matching algorithm to obtain clustering labels.

[0011] In some embodiments, obtaining the target encryption protocol to be identified specifically includes:

[0012] The raw traffic data packets are acquired and then split into multiple independent data packets.

[0013] A custom encryption protocol is selected from each of the independent data packets and used as the target encryption protocol to be identified.

[0014] In some embodiments, the target encryption protocol to be identified includes a custom TCP encryption protocol or a UDP encryption protocol.

[0015] In some embodiments, the tag matrix constructed based on the traffic data uses a single session as a record, and the data tag corresponding to each session is a valued tag or a valueless tag.

[0016] In some embodiments, the tag value of the valued tag includes at least one of the following:

[0017] Timestamp label, length label, serial number label, and fixed code label.

[0018] In some embodiments, the load labels of the value matrix include at least:

[0019] Timestamp offset position, timestamp detection position, length offset position, length detection position, sequence number offset position, sequence number detection position, fixed code offset position, and fixed code detection position.

[0020] In some embodiments, the multi-pattern matching algorithm is the AC algorithm.

[0021] The present invention also provides a custom encryption protocol clustering device, characterized in that the device comprises:

[0022] The data acquisition unit is used to acquire the target encryption protocol to be identified and extract the traffic data and metadata of the target encryption protocol.

[0023] A matrix construction unit is used to construct a label matrix and a value matrix based on the traffic data;

[0024] The result generation unit is used to fuse the label matrix and the value matrix using a multi-pattern matching algorithm to obtain clustering labels.

[0025] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the method described above.

[0026] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the method described above.

[0027] The custom encryption protocol clustering method provided by this invention acquires the target encryption protocol to be identified, extracts its traffic data and metadata, constructs a label matrix and a value matrix based on the traffic data, and fuses the label matrix and the value matrix using a multi-pattern matching algorithm to obtain clustering labels. Thus, the custom encryption protocol clustering method provided by this invention combines a dual-matrix combination with a pattern matching algorithm to achieve the clustering of custom encryption protocols. This method, by splitting the custom encryption protocol before clustering, can quickly and accurately achieve the clustering of the current custom encryption protocol, improving the accuracy of custom encryption protocol clustering. At the same time, this scheme completely departs from traditional methods based on data frame delimitation using fingerprint features and methods based on association rules to identify custom encryption protocols in specific environments. It can quickly and accurately cluster custom encryption protocol data captured in real-world application environments. It solves the problem that hybrid custom protocols cannot be clustered quickly and accurately, providing support for subsequent protocol analysis by achieving fast and accurate custom protocol clustering. Attached Figure Description

[0028] To more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are merely exemplary, and those skilled in the art can derive other embodiments based on the provided drawings without creative effort.

[0029] The structures, proportions, sizes, etc. illustrated in this specification are only for the purpose of assisting those skilled in the art in understanding and reading the content disclosed herein, and are not intended to limit the conditions under which the present invention can be implemented. Therefore, they have no substantial technical significance. Any modifications to the structure, changes in the proportions, or adjustments to the size, without affecting the effects and objectives that the present invention can produce, should still fall within the scope of the technical content disclosed in the present invention.

[0030] Figure 1 This is a flowchart illustrating the custom encryption protocol clustering method provided by the present invention;

[0031] Figure 2 This is a schematic diagram of the structure of the custom encryption protocol clustering device provided by the present invention;

[0032] Figure 3 This is a schematic diagram of the physical structure of the electronic device provided by the present invention. Detailed Implementation

[0033] The following specific embodiments illustrate the implementation of the present invention. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0034] To address the issues of poor accuracy and low efficiency in clustering custom encryption protocols in existing technologies, the custom encryption protocol clustering method provided in this invention uses payload data and leverages the concept of a dual matrix to obtain clustering labels by matching the payload data with the matrix, thereby improving matching accuracy and efficiency.

[0035] Please refer to Figure 1 , Figure 1 This is a flowchart illustrating the custom encryption protocol clustering method provided by the present invention.

[0036] In one specific embodiment, the present invention provides a custom encryption protocol clustering method comprising the following steps:

[0037] S110: Obtain the target encryption protocol to be identified, and extract the traffic data and metadata of the target encryption protocol. The extracted metadata may include quintuple information, payload information, etc., and the extracted traffic data and metadata may be stored in a database.

[0038] S120: Construct a label matrix and a value matrix based on the traffic data;

[0039] S130: The label matrix and the value matrix are fused using a multi-pattern matching algorithm to obtain clustering labels. The obtained clustering label sample is 0-1030-1012130-1010, which consists of four parts. The first part is obtained from the label matrix, and the second to fourth parts are obtained from the value matrix, which are timestamp, length, sequence number, and fixed code, respectively.

[0040] The multi-pattern matching algorithm used is the AC algorithm. The AC algorithm is a classic multi-pattern matching algorithm, primarily solving the problem of matching multiple strings (loads). It guarantees that for a given content of length n and a pattern set (value matrix) P{p1,p2,…pm}, all target patterns in the content can be found within O(n) time complexity. The core of the AC algorithm is still finding the internal patterns of the pattern strings to achieve efficient transitions at each mismatch. The algorithm consists of three parts: the goto table, the fail table, and the output table. The goto table is an automatic state transition machine composed of all patterns in the pattern set P. The fail table records the next state to transition to when the current state no longer accepts input strings. The output table records the set of patterns to be output when transitioning to an outputtable state, i.e., the label values ​​of the current session. In this scheme, the goto table stores the rules of the label matrix and value matrix, and the fail table stores the basis for state transitions after a mismatch in the goto table. Output represents the output (stores the output data).

[0041] In some embodiments, obtaining the target encryption protocol to be identified in step S110 specifically includes:

[0042] The raw traffic data packets are acquired and then split into multiple independent data packets.

[0043] A custom encryption protocol is selected from each of the independent data packets as the target encryption protocol to be identified, wherein the target encryption protocol to be identified includes a custom TCP encryption protocol or a UDP encryption protocol.

[0044] In a specific use case, the acquired data packets are split into individual data packets. Data with recognizable protocols, such as SSH, TCP, HTTP, and TLS, is removed, and only unrecognized custom encryption protocols, namely TCP and UDP encryption protocols customized by different application developers (vendors), are retained.

[0045] In step S120, the tag matrix constructed based on the traffic data uses a single session as a record, and the data tag corresponding to each session is either a valued tag or a valueless tag. The tag values ​​of the valued tags may include, for example, a timestamp tag, a length tag, a sequence number tag, and a fixed code tag.

[0046] In a specific use case, a tag matrix is ​​defined based on traffic data from a custom encryption protocol, as shown in Table 1:

[0047] Table 1 Example of a Tag Matrix

[0048]

[0049] For example, the label matrix data is recorded with each session as a single record, consisting of 0 and 1. 1 indicates that the payload of the current session has a label value (the current label value includes timestamp label, length label, sequence number label, and fixed code label), and 0 indicates that the current session has no label value. The sum of the values ​​of each session record is the first part of the feature cluster label.

[0050] In some embodiments, the payload labels of the value matrix include at least timestamp offset position, timestamp detection position, length offset position, length detection position, sequence number offset position, sequence number detection position, fixed code offset position, and fixed code detection position.

[0051] For example, a value matrix based on traffic data from a custom encryption protocol is shown in Table 2:

[0052] Table 2 Example of Value Matrix

[0053]

[0054] Specifically, the value matrix data is recorded as a single session. "-" indicates no current label payload. The detection position is represented by only 0 and 1, where 0 represents the beginning and 1 represents the end. The offset position indicates the offset position of the detection position for detection.

[0055] In the above specific embodiments, the custom encryption protocol clustering method provided by the present invention obtains the target encryption protocol to be identified, extracts the traffic data and metadata of the target encryption protocol, constructs a label matrix and a value matrix based on the traffic data, and uses a multi-pattern matching algorithm to fuse the label matrix and the value matrix to obtain clustering labels. Thus, the custom encryption protocol clustering method provided by the present invention combines a dual-matrix combination with a pattern matching algorithm to achieve the clustering of custom encryption protocols. This method, after splitting the custom encryption protocol, performs clustering, which can quickly and accurately achieve the clustering of the current custom encryption protocol, improving the accuracy of custom encryption protocol clustering. At the same time, this scheme completely departs from the traditional data frame delimitation method based on fingerprint features and the method of identifying custom encryption protocols in specific environments based on association rules. It can quickly and accurately cluster custom encryption protocol data captured in actual application environments. It solves the problem that hybrid custom protocols cannot be clustered quickly and accurately, and provides support for subsequent protocol analysis by quickly and accurately achieving custom protocol clustering.

[0056] In addition to the methods described above, this invention also provides a custom encryption protocol clustering device, such as... Figure 2 As shown, the device includes:

[0057] The data acquisition unit 201 is used to acquire the target encryption protocol to be identified and extract the traffic data and metadata of the target encryption protocol;

[0058] Matrix construction unit 202 is used to construct a label matrix and a value matrix based on the traffic data;

[0059] The result generation unit 203 is used to fuse the label matrix and the value matrix using a multi-pattern matching algorithm to obtain clustering labels.

[0060] In some embodiments, obtaining the target encryption protocol to be identified specifically includes:

[0061] The raw traffic data packets are acquired and then split into multiple independent data packets.

[0062] A custom encryption protocol is selected from each of the independent data packets and used as the target encryption protocol to be identified.

[0063] In some embodiments, the target encryption protocol to be identified includes a custom TCP encryption protocol or a UDP encryption protocol.

[0064] In some embodiments, the tag matrix constructed based on the traffic data uses a single session as a record, and the data tag corresponding to each session is a valued tag or a valueless tag.

[0065] In some embodiments, the tag value of the valued tag includes at least one of the following:

[0066] Timestamp label, length label, serial number label, and fixed code label.

[0067] In some embodiments, the load labels of the value matrix include at least:

[0068] Timestamp offset position, timestamp detection position, length offset position, length detection position, sequence number offset position, sequence number detection position, fixed code offset position, and fixed code detection position.

[0069] In some embodiments, the multi-pattern matching algorithm is the AC algorithm.

[0070] In the above specific embodiments, the custom encryption protocol clustering device provided by the present invention acquires the target encryption protocol to be identified, extracts the traffic data and metadata of the target encryption protocol, constructs a label matrix and a value matrix based on the traffic data, and fuses the label matrix and the value matrix using a multi-pattern matching algorithm to obtain clustering labels. Thus, the custom encryption protocol clustering device provided by the present invention combines a dual-matrix combination with a pattern matching algorithm to achieve the clustering of custom encryption protocols. This method, after splitting the custom encryption protocol, performs clustering, which can quickly and accurately achieve the clustering of the current custom encryption protocol, improving the accuracy of custom encryption protocol clustering. At the same time, this scheme completely departs from the traditional data frame delimitation method based on fingerprint features and the method of identifying custom encryption protocols in specific environments based on association rules. It can quickly and accurately cluster custom encryption protocol data captured in actual application environments. It solves the problem that hybrid custom protocols cannot be clustered quickly and accurately, and provides support for subsequent protocol analysis by quickly and accurately achieving custom protocol clustering.

[0071] Figure 3 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 3 As shown, the electronic device may include a processor 310, a communication interface 320, a memory 330, and a communication bus 340, wherein the processor 310, the communication interface 320, and the memory 330 communicate with each other through the communication bus 340. The processor 310 can call logical instructions in the memory 330 to execute the above-described method.

[0072] Furthermore, the logical instructions in the aforementioned memory 330 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0073] On the other hand, the present invention also provides a computer program product, the computer program product including a computer program stored on a non-transitory computer-readable storage medium, the computer program including program instructions, and when the program instructions are executed by a computer, the computer is able to perform the methods described above.

[0074] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the methods described above.

[0075] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0076] Those skilled in the art will recognize that, in one or more of the examples above, the functions described in this invention can be implemented using a combination of hardware and software. When applied as software, the corresponding functions can be stored in a computer-readable medium or transmitted as one or more instructions or code on a computer-readable medium. Computer-readable media include computer storage media and communication media, wherein communication media include any medium that facilitates the transmission of computer programs from one place to another. Storage media can be any available medium that can be accessed by a general-purpose or special-purpose computer.

[0077] The above specific embodiments further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made on the basis of the technical solution of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method of customizing a cryptographic protocol cluster, the method comprising: The method comprises: acquiring a target encryption protocol to be identified, and extracting traffic data and metadata of the target encryption protocol; constructing a label matrix and a value matrix based on the traffic data; fusing the label matrix and the value matrix by using a multi-mode matching algorithm to obtain a clustering label; wherein acquiring the target encryption protocol to be identified specifically comprises: acquiring data packets of original traffic, and splitting the data packets to obtain a plurality of independent data packets; screening a custom encryption protocol from each of the independent data packets as the target encryption protocol to be identified; the target encryption protocol to be identified comprises a custom tcp encryption protocol or a udp encryption protocol; the label matrix constructed based on the traffic data takes a single session as a record, and a data label corresponding to each session is a value label or a non-value label; the label value of the value label comprises at least one of the following: a timestamp label, a length label, a serial number label, and a fixed code label; the payload label of the value matrix at least comprises: a timestamp offset position, a timestamp detection position, a length offset position, a length detection position, a serial number offset position, a serial number detection position, a fixed code offset position, and a fixed code detection position; the acquired data packets are split into single data packets, wherein data capable of being identified to a protocol is removed, and only custom encryption protocols that are not identified are reserved.

2. The method of claim 1, wherein, The multi-mode matching algorithm is an AC algorithm.

3. A self-defining cryptographic protocol clustering apparatus based on the method according to claim 1 or 2, characterized in that, The device comprises: a data acquisition unit configured to acquire a target encryption protocol to be identified, and extract traffic data and metadata of the target encryption protocol; a matrix construction unit configured to construct a label matrix and a value matrix based on the traffic data; a result generation unit configured to fuse the label matrix and the value matrix by using a multi-mode matching algorithm to obtain a clustering label.

4. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor implements the steps of the method according to any one of claims 1 to 2 when executing the program.

5. A non-transitory computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program implements the steps of the method according to any one of claims 1 to 2 when executed by the processor.

Images