A network traffic detection method, system and electronic device

Abstract

The embodiment of the application discloses a network flow detection method and system and an electronic device, relates to the technical field of computers, and can accurately identify the lured network flow from all network flows. The specific scheme is as follows: a second electronic device receives first network flow sent by a first electronic device, and determines whether the first network flow is threatened based on a first strategy; in the case that the first network flow is threatened, the second electronic device generates a threat record, and sends the threat record to a third electronic device; the threat record is used for indicating that the first network flow is threatened; the third electronic device receives the threat record, and sends a luring plug-in to the first electronic device; the first electronic device receives the luring plug-in, and generates second network flow based on the luring plug-in; the first electronic device sends the second network flow to the second electronic device; the second electronic device receives the second network flow, and determines the lured network flow in the second network flow based on a second strategy.

Description

Technical Field

[0001] This application relates to the field of computer technology. More specifically, it relates to a method, system, and electronic device for detecting network traffic. Background Technology

[0002] Typically, network traffic is generated when users access web pages through electronic devices. This network traffic may contain attack traffic from attackers, which poses a threat to network security. Therefore, it is necessary to detect attack traffic within network traffic to prevent it from threatening network security.

[0003] In existing technologies, there are generally two ways to detect network attack traffic in network traffic: one is to use decoy detection technology, and the other is to use full traffic analysis technology for analysis and detection.

[0004] Decoy detection utilizes techniques such as creating a seemingly vulnerable system or application on an electronic device to lure attackers and thus detect network traffic threats. Full traffic analysis involves analyzing all network traffic using network monitoring equipment or software to detect network traffic threats.

[0005] However, using decoy detection techniques for network traffic threat detection cannot detect all network traffic, thus affecting the accuracy of threat detection. On the other hand, full traffic analysis techniques perform threat detection on all network traffic, requiring a large processing workload and thus reducing the efficiency of threat detection. Summary of the Invention

[0006] In view of the above problems, embodiments of this application provide a network traffic detection method, electronic device and system to solve the problems that decoy technology cannot achieve threat detection of all network traffic and that the threat detection efficiency of full traffic analysis technology is low.

[0007] In a first aspect, embodiments of this application provide a method for detecting network traffic, applied to a network traffic detection system. The network traffic detection system includes a first electronic device, a second electronic device, and a third electronic device. The method for detecting network traffic includes: the second electronic device receiving first network traffic sent by the first electronic device and determining whether the first network traffic poses a threat based on a first strategy; the first strategy is a full traffic analysis threat detection strategy preset by the second electronic device; if the first network traffic poses a threat, the second electronic device generates a threat record and sends the threat record to the third electronic device; the threat record is used to indicate that the first network traffic poses a threat; the third electronic device receives the threat record and sends a decoy plugin to the first electronic device; the first electronic device receives the decoy plugin and generates second network traffic based on the decoy plugin; the first electronic device sends the second network traffic to the second electronic device; the second electronic device receives the second network traffic and determines the decoy network traffic in the second network traffic based on a second strategy, the second strategy being a decoy strategy preset by the second electronic device.

[0008] In conjunction with the first aspect, in another optional approach, the second electronic device receives the first network traffic and determines whether the first network traffic poses a threat based on the first policy; this may include: the second electronic device parsing the first network traffic to obtain metadata logs after parsing the first network traffic; and the second electronic device performing threat detection on the metadata logs according to the first policy to determine whether the metadata poses a threat.

[0009] In conjunction with the first aspect, in another alternative approach, the second electronic device generating the threat record may include: the second electronic device generating a metadata log indicating that the first network traffic is threatening based on the first network traffic; and the second electronic device aggregating and analyzing the metadata log indicating that the first network traffic is threatening to generate a threat record.

[0010] In conjunction with the first aspect, in another alternative approach, the second electronic device receives the second network traffic and determines the tampered network traffic within the second network traffic based on the second strategy. This may include: the second electronic device parses the second network traffic to obtain a metadata log of the parsed second network traffic; the second electronic device identifies the metadata log of the second network traffic according to the second strategy to obtain a metadata log of the tampered network traffic; and the second electronic device determines the tampered network traffic within the second network traffic based on the metadata log of the tampered network traffic.

[0011] In conjunction with the first aspect, in another alternative approach, the network traffic detection method, after the second electronic device receives the second network traffic and determines the entrapped network traffic in the second network traffic based on the second strategy, may further include: the second electronic device sending the entrapped network traffic to a third electronic device; the third electronic device receiving the entrapped network traffic and storing the entrapped network traffic.

[0012] In conjunction with the first aspect, in another alternative approach, the network traffic detection method may further include, before the third electronic device sends the decoy plugin to the first electronic device: the third electronic device matches a threat record with a second policy; if the threat record matches the second policy, the third electronic device sends the decoy plugin corresponding to the threat record to the first electronic device.

[0013] In conjunction with the first aspect, in another alternative approach, the network traffic detection method may further include: the third electronic device receiving the second policy sent by the second electronic device before the third electronic device matches the threat record with the second policy.

[0014] In conjunction with the first aspect, in another alternative approach, the network traffic detection method may further include, before the second electronic device receives the first network traffic sent by the first electronic device: the first electronic device generates the first network traffic; the first electronic device sends the first network traffic to the second electronic device.

[0015] Secondly, embodiments of this application also provide a network traffic detection method applied to a first electronic device. This network traffic detection method may include: sending first network traffic to a second electronic device; receiving a decoy plugin sent by a third electronic device, wherein the decoy plugin is sent by the third electronic device to the first electronic device when the second electronic device determines that the first network traffic poses a threat based on a first strategy; the first strategy is a preset full-traffic analysis threat detection strategy of the second electronic device; generating second network traffic based on the decoy plugin, and sending the second network traffic to the second electronic device, so that the second electronic device can identify the decoy network in the second network traffic.

[0016] Thirdly, embodiments of this application also provide a network traffic detection method applied to a second electronic device. This network traffic detection method may include: receiving first network traffic sent by a first electronic device; determining whether the first network traffic poses a threat based on a first strategy; the first strategy being a preset full-traffic analysis threat detection strategy for the second electronic device; generating a threat record and sending the threat record to a third electronic device when the first network traffic poses a threat; the threat record being used to indicate that the first network traffic poses a threat; receiving second network traffic sent by the first electronic device; and determining, based on a second strategy, the trapped network traffic in the second network traffic, where the second strategy is a preset trapping strategy for the second electronic device.

[0017] Fourthly, embodiments of this application also provide a method for detecting network traffic, applied to a third electronic device. The method for detecting network traffic may include: receiving a threat record sent by a second electronic device; the threat record is a threat record generated by the second electronic device when it determines that the first network traffic is threatened based on a first strategy; the first strategy is a full traffic analysis threat detection strategy preset by the second electronic device; and sending a decoy plugin to the first electronic device so that the first electronic device generates the second network traffic based on the decoy plugin.

[0018] Fifthly, embodiments of this application also provide a network traffic detection device, which may include: a sending unit, a receiving unit, and a traffic generation unit, etc.

[0019] The system includes a traffic generation unit for generating first network traffic, a sending unit for sending the first network traffic to a second electronic device, and a receiving unit for receiving a decoy plugin sent by a third electronic device. The decoy plugin is sent by the third electronic device to the first electronic device when the second electronic device determines that the first network traffic poses a threat based on a first strategy. The first strategy is a preset full-traffic analysis threat detection strategy of the second electronic device. The traffic generation unit can also generate second network traffic based on the decoy plugin. The sending unit can also send the second network traffic to the second electronic device after generating it, so that the second electronic device can identify the decoy network traffic within the second network traffic.

[0020] Sixthly, embodiments of this application also provide a network traffic detection device, which may include: a receiving unit, a threat detection unit, a record generation unit, a sending unit, and an identification unit, etc.

[0021] The system includes the following components: a receiving unit for receiving first network traffic sent by a first electronic device; a threat detection unit for determining whether the first network traffic poses a threat based on a first strategy, whereby the first strategy is a pre-defined full-traffic analysis threat detection strategy for the second electronic device; a record generation unit for generating a threat record if the first network traffic is found to be a threat; a sending unit for sending the threat record to a third electronic device; a receiving unit for receiving second network traffic sent by the first electronic device; and an identification unit for identifying decoy network traffic within the second network traffic based on a second strategy, whereby the second strategy is a pre-defined decoy strategy for the second electronic device.

[0022] In a seventh aspect, embodiments of this application also provide a network traffic detection device, which may include a receiving unit and a sending unit, etc.

[0023] The receiving unit can be used to receive threat records sent by the second electronic device. These threat records are generated by the second electronic device when it determines that the first network traffic poses a threat based on a first strategy. The first strategy is a preset full-traffic analysis threat detection strategy of the second electronic device. The sending unit can be used to send a decoy plugin to the first electronic device, causing the first electronic device to generate second network traffic based on the decoy plugin.

[0024] Eighthly, embodiments of this application also provide an electronic device, including: a processor and a memory for storing processor-executable instructions. The processor is configured to, when executing the instructions, cause the electronic device to perform a network traffic detection method as described in the second aspect or a possible implementation of the second aspect; or, the processor is configured to, when executing the instructions, cause the electronic device to perform a network traffic detection method as described in the third aspect or a possible implementation of the third aspect; or, the processor is configured to, when executing the instructions, cause the electronic device to perform a network traffic detection method as described in the fourth aspect or a possible implementation of the fourth aspect.

[0025] Ninthly, embodiments of this application also provide a computer-readable storage medium storing computer program instructions thereon. When the computer program instructions are executed by an electronic device, the electronic device implements the network traffic detection method as described in the second aspect or a possible implementation of the second aspect; or, when the computer program instructions are executed by the electronic device, the electronic device implements the network traffic detection method as described in the third aspect or a possible implementation of the third aspect; or, when the computer program instructions are executed by the electronic device, the electronic device implements the network traffic detection method as described in the fourth aspect or a possible implementation of the fourth aspect.

[0026] In a tenth aspect, embodiments of this application also provide a computer program product, including computer-readable code, which, when executed in an electronic device, causes the electronic device to implement the network traffic detection method as described in the second aspect or a possible implementation of the second aspect; or, when executed in an electronic device, causes the electronic device to implement the network traffic detection method as described in the third aspect or a possible implementation of the third aspect; or, when executed in an electronic device, causes the electronic device to implement the network traffic detection method as described in the fourth aspect or a possible implementation of the fourth aspect.

[0027] Eleventhly, embodiments of this application provide a network traffic detection system, which may include: a first electronic device, a second electronic device, and a third electronic device. The first electronic device may be used to perform the network traffic detection method as described in the second aspect or possible implementations thereof, the second electronic device may be used to perform the network traffic detection method as described in the third aspect or possible implementations thereof, and the third electronic device may be used to perform the network traffic detection method as described in the fourth aspect or possible implementations thereof.

[0028] The solution provided in this application involves a second electronic device receiving first network traffic sent by a first electronic device and determining whether the first network traffic poses a threat based on a first strategy. If a threat is detected, the second electronic device generates a threat record and sends it to a third electronic device. The third electronic device then receives the threat record and sends a decoy plugin to the first electronic device. The first electronic device then generates second network traffic based on the received decoy plugin and sends it to the second electronic device. Finally, the second electronic device determines the decoy network traffic within the received second network traffic based on a second strategy. In other words, the second electronic device first performs full traffic analysis and threat detection on the network traffic sent by the first electronic device. If a threat is detected, the third electronic device sends a decoy plugin to the first electronic device. The first electronic device then sends the decoy-included network traffic generated by the decoy plugin to the second electronic device, which then matches the decoy network traffic from the decoy-included network traffic. Therefore, the solution in this application, by combining the full traffic analysis and threat detection strategy of the second electronic device with the decoy plugin of the third electronic device when the first electronic device generates network traffic, can accurately identify the decoy network traffic (i.e., network traffic generated by decoy attackers accessing web pages, etc.) from all generated network traffic, and can improve the detection efficiency of the decoy traffic, thereby improving the network security of the first electronic device.

[0029] Furthermore, the solution proposed in this application can detect captured network traffic in all traffic scenarios without changing the user's network architecture (i.e. without adding any new devices), which can avoid repeated hardware investment for users, thereby saving costs for users and making the application more widespread and more applicable.

[0030] Furthermore, the solution proposed in this application, by using a second electronic device to analyze and detect threats to all network traffic, can completely free up the traffic analysis and threat detection of the trapping device. The third electronic device only needs to send a trapping plugin corresponding to the threat type to the first electronic device, which can maximize the throughput of the third electronic device and improve the detection efficiency of network traffic containing traps in the full traffic scenario.

[0031] The above description is merely an overview of the technical solutions of the embodiments of this application. In order to better understand the technical means of the embodiments of this application and to implement them in accordance with the contents of the specification, and to make the above and other objects, features and advantages of the embodiments of this application more obvious and understandable, specific implementation methods of this application are described below. Attached Figure Description

[0032] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings: Figure 1 This application provides a schematic diagram of the structure of a network traffic detection system. Figure 2 This application provides a schematic diagram of the hardware structure of an electronic device. Figure 1 ; Figure 3 This application provides a schematic diagram of the hardware structure of an electronic device. Figure 2 ; Figure 4 This application provides a schematic diagram of the hardware structure of an electronic device. Figure 3 ; Figure 5 This application provides a flowchart illustrating a method for detecting network traffic. Figure 1 ; Figure 6 This application provides a flowchart illustrating a method for detecting network traffic. Figure 2 ; Figure 7 A schematic diagram of the display interface of an electronic device provided in this application is shown. Figure 1 ; Figure 8 A schematic diagram of the display interface of an electronic device provided in this application is shown. Figure 2 ; Figure 9 The diagram illustrates the working principle of an electronic device provided in this application. Figure 1 ; Figure 10 The diagram illustrates the working principle of an electronic device provided in this application. Figure 2 ; Figure 11 This application provides a schematic diagram of the structure of a network traffic detection device. Figure 1 ; Figure 12 This application provides a schematic diagram of the structure of a network traffic detection device. Figure 2 ; Figure 13 This application provides a schematic diagram of the structure of a network traffic detection device. Figure 3 . Detailed Implementation

[0033] Exemplary embodiments of the invention will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the invention are shown in the drawings, it should be understood that the invention can be implemented in various forms and should not be limited to the embodiments set forth herein.

[0034] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0035] The terms “comprising” and “having” and any variations thereof in this application are intended to cover but not exclusively include, for example, a product or device that includes a series of components is not necessarily limited to all the components that are clearly listed, but may include other components that are not clearly listed or that are inherent to such product or device.

[0036] Typically, network traffic is generated when users access web pages through electronic devices. This network traffic may contain attack traffic from attackers, which poses a threat to network security. Therefore, it is necessary to detect attack traffic within network traffic to prevent it from threatening network security.

[0037] In existing technologies, there are generally two ways to detect network attack traffic in network traffic: one is to use decoy detection technology, and the other is to use full traffic analysis technology for analysis and detection.

[0038] Decoying is a cybersecurity technique. Decoying detection involves creating a seemingly vulnerable system or application on an electronic device to lure attackers, thereby enabling threat detection of network traffic. Decoying techniques can include high-interaction decoying and low-interaction decoying techniques.

[0039] High-interaction decoy technology runs actual operating systems and applications on virtual machines or physical machines to simulate a real environment, maximizing the likelihood of an attacker being lured into an attack. This technology records all attacker behavior and may restrict attacker access permissions to prevent harm to other systems.

[0040] Low-interaction decoys are a lightweight decoy technique that is relatively simple and easy to deploy and manage. They typically use virtual machines or containers to simulate vulnerable systems or services, but do not contain the actual operating system and applications. Attackers trigger the low-interaction decoy by accessing specific ports or services.

[0041] However, regardless of whether high-interaction or low-interaction decoy techniques are used to detect attackers' network traffic, it is impossible to detect attackers' network traffic in the entire traffic scenario. This may result in the omission of attackers' network traffic, thereby affecting the accuracy of threat detection.

[0042] Full traffic analysis technology is widely used in the field of network security, and can be used to detect and prevent network attacks, monitor abnormal network behavior, identify malware, and improve network performance. Full traffic analysis involves analyzing all network traffic using specialized network monitoring equipment or software to detect threats within the network. For example, specialized network monitoring equipment or software may include intrusion detection systems (IDS) / intrusion prevention systems (IPS), security information and event management (SIEM), and network security management (NSM).

[0043] However, using full traffic analysis technology involves performing threat detection on all traffic on the network, which requires a large amount of work and can lead to a waste of resources to some extent. Furthermore, the need to perform threat detection on all traffic may reduce the efficiency of threat detection.

[0044] To address the aforementioned problems, this application provides a network traffic detection method applied to a network traffic detection system, which may include a first electronic device, a second electronic device, and a third electronic device. The network traffic detection method may include: the second electronic device receiving first network traffic sent by the first electronic device and determining whether the first network traffic poses a threat based on a first strategy; if a threat exists, the second electronic device generates a threat record and sends the threat record to the third electronic device; then the third electronic device receives the threat record and sends a decoy plugin to the first electronic device; the first electronic device generates second network traffic based on the received decoy plugin and sends the second network traffic to the second electronic device; finally, the second electronic device determines the decoy network traffic within the received second network traffic based on a second strategy. In other words, the second electronic device first performs full traffic analysis and threat detection on the network traffic sent by the first electronic device; if a threat is detected, the third electronic device sends a decoy plugin to the first electronic device; then the first electronic device sends the network traffic containing the decoy plugin to the second electronic device; and the second electronic device then matches the decoy network traffic from the network traffic containing the decoy plugin. Therefore, the solution of this application can accurately identify the trapped network traffic from all the generated network traffic by combining the full traffic threat detection strategy of the second electronic device and the trapping plugin of the third electronic device when the first electronic device generates network traffic, and can improve the detection efficiency of the trapped traffic.

[0045] Furthermore, the solution proposed in this application can detect captured network traffic in all traffic scenarios without changing the user's network architecture (i.e. without adding any new devices), which can avoid repeated hardware investment for users, thereby saving costs for users and making the application more widespread and more applicable.

[0046] Furthermore, the solution proposed in this application, by using a second electronic device to analyze and detect threats to all network traffic, can completely free up the traffic analysis and threat detection of the trapping device. The third electronic device only needs to send a trapping plugin corresponding to the threat type to the first electronic device, which can maximize the throughput of the third electronic device and improve the detection efficiency of network traffic containing traps in the full traffic scenario.

[0047] The network traffic detection method provided in the embodiments of this application is described below.

[0048] The network traffic detection method provided in this application can be applied to a network traffic detection system. This network traffic detection system may include a first electronic device, a second electronic device, and a third electronic device.

[0049] The first electronic device can be a mobile phone, tablet computer, laptop computer, or an IoT device and a portable wearable device. IoT devices can include smart TVs, smart air conditioners, smart speakers, smart in-vehicle systems, etc., while portable wearable devices can include smartwatches, smart head-mounted devices, smart bracelets, etc. This application does not limit the specific form of the first electronic device. This application uses a mobile phone as an example for illustrative purposes.

[0050] In some embodiments, there may be multiple first electronic devices. The multiple first electronic devices may communicate with the full traffic analysis device and the trapping device respectively.

[0051] The second electronic device can be a device with full flow analysis technology, such as a full flow analysis device, or other electronic devices. This application does not limit the specific form of the second electronic device in its embodiments. This application uses a full flow analysis device as the second electronic device for illustrative purposes.

[0052] The third electronic device can be a device with a trapping plug, such as a trapping device, or it can be other electronic devices. This application does not limit the specific form of the third electronic device in its embodiments. This application uses the third electronic device as a trapping device for illustrative purposes.

[0053] In some embodiments, the first electronic device, the second electronic device, and the third electronic device may also be the same electronic device. When the first electronic device, the second electronic device, and the third electronic device are the same electronic device, the electronic device can generate network traffic, the electronic device can perform full traffic analysis on the generated network traffic, and the electronic device can also generate decoy plugins.

[0054] The network traffic detection system provided in the embodiments of this application will be illustrated below.

[0055] For example, consider a mobile phone as the first electronic device, a full-traffic analysis device as the second electronic device, and a trapping device as the third electronic device. Figure 1 As shown, the network traffic detection system may include a mobile phone 01 (i.e., the first electronic device), a full traffic analysis device 02 (i.e., the second electronic device), and a trapping device 03 (i.e., the third electronic device). The mobile phone 01 can establish a wired and / or wireless communication connection with the full traffic analysis device 02, and the full traffic analysis device 02 can establish wired and / or wireless communication connections with both the mobile phone 01 and the trapping device 03.

[0056] In some embodiments, the multiple first electronic devices can be multiple mobile phones. That is, multiple mobile phones can establish communication connections with the full traffic analysis device (i.e., the second electronic device) in wired and / or wireless ways, and the trapping device (i.e., the third electronic device) can establish communication connections with the multiple mobile phones in wired and / or wireless ways.

[0057] For example, taking a mobile phone as the first electronic device, Figure 2 A schematic diagram of the structure of a first electronic device provided in this embodiment is shown.

[0058] like Figure 2 As shown, in some embodiments, the first electronic device is a mobile phone as an example. Figure 2 A schematic diagram of the structure of a first electronic device provided in an embodiment of this application is shown.

[0059] like Figure 2 As shown, the first electronic device may include a processor 210, an external memory interface 220, an internal memory 221, a USB interface 230, a charging management unit 240, a power management unit 241, a battery 242, an antenna 1, an antenna 2, a mobile communication unit 250, a wireless communication unit 260, an audio unit 270, a speaker 270A, a receiver 270B, a microphone 270C, a headphone jack 270D, a sensor unit 280, buttons 290, a motor 291, an indicator 292, a camera 293, a display screen 294, and a SIM card interface 295, etc. The sensor unit 280 may include a pressure sensor unit 280A, a gyroscope sensor 280B, a barometric pressure sensor 280C, a magnetic sensor 280D, an accelerometer sensor 280E, a proximity sensor 280F, a proximity light sensor 280G, a fingerprint sensor 280H, a temperature sensor 280J, a touch sensor 280K, an ambient light sensor 280L, a bone conduction sensor 280M, etc.

[0060] It is understood that the structure illustrated in this embodiment does not constitute a specific limitation on the electronic device. In other embodiments, the electronic device may include more or fewer components than illustrated, or combine some components, or split some components, or have different component arrangements. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0061] Processor 210 may include one or more processing units, such as: application processor (AP), modem processor, graphics processing unit (GPU), image signal processor (ISP), controller, memory, video codec, digital signal processor (DSP), baseband processor, and / or neural network processor (NPU). These different processing units may be independent devices or integrated into one or more processors.

[0062] A controller can be the nerve center and command center of an electronic device. Based on the instruction opcode and timing signals, the controller generates operation control signals to control the fetching and execution of instructions.

[0063] The processor 210 may also include a memory for storing instructions and data. In some embodiments, the memory in the processor 210 is a cache memory. This memory can store instructions or data that the processor 210 has just used or that are used repeatedly. If the processor 210 needs to use the instruction or data again, it can retrieve it directly from the memory.

[0064] In some embodiments, the processor 210 may include one or more interfaces. Interfaces may include an integrated circuit I2C interface, an integrated circuit built-in audio I2S interface, a pulse code modulation (PCM) interface, a universal asynchronous receiver / transmitter (UART) interface, a mobile industry processor interface (MIPI), a general purpose input / output (GPIO) interface, a subscriber identity module (SIM) interface, and / or a universal serial bus (USB) interface, etc.

[0065] Electronic devices implement display functions through a GPU, a display screen 294, and an application processor. The GPU is a microprocessor for image processing, connecting the display screen 294 and the application processor. The GPU is used to perform mathematical and geometric calculations and for graphics rendering. The processor 210 may include one or more GPUs, which execute program instructions to generate or modify display information.

[0066] In some embodiments, the display screen 294 may be used to display the interface of the first electronic device. For example, the display screen 294 may be used to display a webpage accessed by the user. The display screen 294 may also be used to display a webpage containing plugins. The user accesses a webpage containing plugins through the first electronic device, and then the first electronic device generates network traffic.

[0067] In some embodiments, the second electronic device may be a full traffic analysis device or other electronic devices. This application does not limit the specific form of the electronic device. This application uses a full traffic analysis device as an example for illustrative purposes.

[0068] In some embodiments, when the second electronic device is a full flow analysis device, such as Figure 3 As shown, the second electronic device may include: Figure 3As shown, the full flow analysis device may include a processor 310, a fan 311, an external memory interface 320, an internal memory 321, a USB interface 330, a charging management module 340, a power management module 341, a battery 342, a display screen 350, an antenna, a wireless communication module 360, an audio module 370, a speaker 370A, a microphone 370C, a headphone jack 370B, a touchpad 380, a keyboard 390, and a camera 391, etc.

[0069] All components other than the display screen 350 (such as processor 310, fan 311, external memory interface 320, internal memory 321, USB interface 330, charging management module 340, power management module 341, battery 342, antenna, wireless communication module 360, audio module 370, touchpad 380, speaker 370A, microphone 370C, headphone jack 370B, keyboard 390, and camera 391) can be mounted on the base of the full flow analysis device. The camera 391 can also be mounted on the bezel of the display screen 350 of the full flow analysis device.

[0070] It is understood that the structure illustrated in this embodiment does not constitute a specific limitation on the full flow analysis device. In other embodiments, the full flow analysis device may include more or fewer components than illustrated, or combine some components, or split some components, or have different component arrangements. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0071] The full-flow analysis device can achieve display functionality through a GPU, display screen 350, and application processor. The GPU is a microprocessor for image processing, connected to the display screen 350 and the application processor. The GPU performs mathematical and geometric calculations for graphics rendering. The processor 310 may include one or more GPUs, which execute program instructions to generate or modify display information.

[0072] In some embodiments, display screen 350 may display a configuration interface for full traffic analysis and threat detection. After parsing is complete, display screen 350 may also display a display interface for multiple metadata of the first network traffic.

[0073] The external storage interface 320 can be used to connect an external storage card, such as a Micro SD card, to expand the storage capacity of the laptop. The internal memory 321 can be used to store executable program code, including instructions. The processor 310 executes various functional applications and data processing of the laptop by running the instructions stored in the internal memory 321. For example, in this embodiment, the processor 310 can execute instructions stored in the internal memory 321, which may include a program storage area and a data storage area.

[0074] Of course, this is understandable. Figure 3 The illustration shown is merely an example of an electronic device in the form of a full flow analysis device. If the electronic device is in other device forms, its structure may include more advanced technologies. Figure 3 The fewer structures shown can also include more than Figure 3 The structures shown are not limited here.

[0075] In some embodiments, the third electronic device may be a trapping device or other electronic devices. This application does not limit the specific form of the electronic device. This application uses the trapping device as an example for illustrative purposes.

[0076] In some embodiments, when the third electronic device is a trapping device, such as Figure 4 As shown, the third electronic device may include: at least one processor 401, a communication line 402, a memory 403, and a communication interface 404.

[0077] The processor 401 can perform various functions of the electronic device 400 by running or executing software programs stored in the memory 403 and calling data stored in the memory 403.

[0078] In a specific implementation, as one embodiment, electronic device 400 may include one processor or multiple processors. Each of these processors may be a single-core processor (single-CPU) or a multi-core processor (multi-CPU). Here, a processor may refer to one or more devices, circuits, and / or processing cores used to process data (e.g., computer program instructions).

[0079] The memory 403 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto. The memory 403 may exist independently and be connected to the processor 401 via communication line 402. The memory 403 may also be integrated with the processor 401.

[0080] The memory 403 is used to store the software program that executes the solution of this application, and the processor 101 controls its execution.

[0081] Communication interface 404 can be any transceiver or similar device used for communicating with other devices or communication networks.

[0082] Communication line 402 can be an industry standard architecture (ISA) bus, a peripheral component (PCI) bus, or an extended industry standard architecture (EISA) bus. This bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 4 The symbol is represented by only one line, but this does not mean that there is only one bus or one type of bus.

[0083] The network traffic detection method provided in the embodiments of this application is described below.

[0084] The methods in the following embodiments are applied to a network traffic detection system, which includes a first electronic device, a second electronic device, and a third electronic device. The first electronic device can be a first electronic device with the aforementioned hardware structure, the second electronic device can be a second electronic device with the aforementioned hardware structure, and the third electronic device can be a third electronic device with the aforementioned hardware structure. In this embodiment, a mobile phone is used as the first electronic device, a full traffic analysis device is used as the second electronic device, and a trapping device is used as an example for illustrative purposes.

[0085] The following is in conjunction with the appendix Figure 5 The network traffic detection method provided in the embodiments of this application will be described in detail. For example... Figure 5 As shown in the illustration, the first electronic device is a mobile phone, the second electronic device is a full traffic analysis device, and the third electronic device is a trapping device. The network traffic detection method provided in this application embodiment may include: S501-S513.

[0086] S501, the phone generates the first network traffic.

[0087] When a user accesses a webpage via their mobile phone, the phone generates the first network traffic.

[0088] S502, The mobile phone sends the first network traffic to the full traffic analysis device.

[0089] After the mobile phone generates the first network traffic, it sends the first network traffic to the full traffic analysis device.

[0090] In some embodiments, sending the first network traffic to the full traffic analysis device may include: the mobile phone sending the first network traffic to a switch or router, the switch or router copying the network traffic, and then mirroring the copied first network traffic to the full traffic analysis device. This protects the integrity of the first network traffic, making the first network more realistic and deceptive.

[0091] S503, the full traffic analysis device receives the first network traffic sent by the mobile phone.

[0092] In some embodiments, the full traffic analysis device can receive the first network traffic sent by the mobile phone via a switch or router. For example, after receiving the first network traffic sent by the mobile phone, the switch or router can send the mirrored first network traffic to the full traffic analysis device.

[0093] S504. The full traffic analysis device determines whether the first network traffic poses a threat based on the first strategy, whereby the first strategy is a preset full traffic analysis threat detection strategy for the full traffic analysis device.

[0094] Upon receiving the first network traffic sent by the mobile phone, the full traffic analysis device can determine whether the first network traffic poses a threat based on the full traffic analysis threat detection strategy (i.e., the first strategy) preset by the full traffic analysis device.

[0095] If the first network traffic is determined to pose a threat, the full traffic analysis device can generate a threat log, which means it can execute S505 as described below. If the first network traffic is determined not to pose a threat, the network traffic detection process ends, and the mobile phone can continue to access web pages.

[0096] In some embodiments, the full traffic analysis threat detection strategy (i.e., the first strategy) included in the full traffic analysis device can be preset. The full traffic analysis threat detection strategy may include: a feature engine, an intelligence engine, a file sandbox engine, an artificial intelligence engine, a behavior engine, etc. The feature engine is used to analyze the threat characteristics of the first network traffic. The intelligence engine is used to analyze the threat intelligence information of the first network traffic. The artificial intelligence engine is used to identify threats in the first network traffic. The behavior engine is used to generate conditions for determining a threat based on set conditions and feedback from the first network traffic, and determine an executable action.

[0097] For example, after receiving the first network traffic sent by a mobile phone, the full traffic analysis device can analyze the first network traffic based on multiple engines, including the feature engine, intelligence engine, file sandbox engine, artificial intelligence engine, and behavior engine, which are included in the full traffic analysis threat detection strategy, thereby determining whether the first network traffic poses a threat.

[0098] S505. In the event that the first network traffic is threatened, the full traffic analysis device generates a threat record, which is used to indicate that the first network traffic is threatened.

[0099] When a full traffic analysis device determines that a first network traffic flow poses a threat, it can generate a threat log indicating that the first network traffic flow poses a threat.

[0100] Threat logs can include the threat type of the first network traffic, and the threat type can be used to determine the corresponding decoy plugin.

[0101] S506, The full flow analysis device sends threat records to the trapping device.

[0102] After the full traffic analysis device generates a threat record, it can send the generated threat record to the trapping device, which can then send the corresponding trapping plugin to the mobile phone based on the threat record.

[0103] S507, Threat Records Received by Trapping Equipment.

[0104] After the full traffic analysis device sends threat records to the trapping device, the trapping device can receive the threat records, and then the trapping device can send the corresponding trapping plugin to the mobile phone according to the threat records.

[0105] S508, The trapping device sends a trapping plugin to the mobile phone.

[0106] After receiving a threat record, the trapping device sends the trapping plugin to the mobile phone, so that the mobile phone can generate secondary network traffic based on the trapping plugin.

[0107] In some embodiments, the trapping plugin can be an application or program that can attract attackers to attack; that is, the mobile phone can generate network traffic that can attract attackers to attack through the application or program.

[0108] In some embodiments, the process of the trapping device sending a trapping plugin to a mobile phone may include: the trapping device determining the threat type based on threat logs. After determining the threat type, the corresponding trapping plugin can be determined according to the threat type.

[0109] In some embodiments, the trapping device may pre-store the correspondence between threat types and trapping plugins (i.e., a second strategy), so that after the trapping device determines the threat type, it can determine the corresponding trapping plugin based on the threat type and the pre-stored correspondence between threat types and trapping plugins.

[0110] S509, Mobile phone receiving trap plugin.

[0111] The mobile phone can receive the trapping plugin sent by the trapping device, and the mobile phone can generate a second network traffic based on the trapping plugin.

[0112] The S510 mobile phone generates a second network traffic based on a trapping plugin.

[0113] After the mobile phone receives the trapping plugin, the mobile phone can generate a second network traffic based on the trapping plugin.

[0114] The second network traffic can be network traffic containing traps, that is, network traffic carrying trapping plugins.

[0115] In some embodiments, the mobile phone generating second network traffic based on the decoy plugin may include: after receiving the decoy plugin, the mobile phone may render and display a webpage that the user needs to access. When the user needs to access the webpage, they access the webpage through the decoy plugin on the mobile phone. After attracting an attacker, the mobile phone may generate network traffic containing the decoy (i.e., second network traffic).

[0116] S511, The mobile phone sends a second network traffic to the full traffic analysis device.

[0117] After the mobile phone generates network traffic containing the trap (i.e., the second network traffic), the mobile phone sends the generated network traffic carrying the trap plugin to the full traffic analysis device, so that the full traffic analysis device can determine the trap network traffic in the second network traffic.

[0118] S512, the full traffic analysis device receives the second network traffic.

[0119] A full traffic analysis device can receive network traffic containing traps (i.e., second network traffic), and thus the full traffic analysis device can identify the trapped network traffic within the second network traffic.

[0120] In some embodiments, sending second network traffic from a mobile phone to a full traffic analysis device may include mirroring the second network traffic to the full traffic analysis device via a switch or router. This protects the integrity of the second network traffic, making the second network more authentic.

[0121] S513. The full traffic analysis device determines the captured network traffic in the second network traffic based on the second strategy, whereby the second strategy is a preset capture strategy of the full traffic analysis device.

[0122] After the full traffic analysis device receives the second network traffic, it can determine the trapped network traffic from the network traffic containing the trapped traffic (i.e., the second network traffic) based on a preset trapping strategy (i.e., the second strategy). The full traffic analysis device can then send the determined trapped network traffic to the trapping device.

[0123] In some embodiments, the second strategy can be used to identify network traffic metadata logs containing entrapped network traffic, thereby identifying entrapped network traffic in the second network traffic.

[0124] In other embodiments, the second strategy may also be used to indicate the correspondence between the threat type of the first network traffic and the decoy plugin.

[0125] The solution in this application involves a full-traffic analysis device receiving first network traffic sent by a mobile phone and determining whether the first network traffic poses a threat based on a first strategy. If a threat is detected, the full-traffic analysis device generates a threat record and sends the threat record to a decoy device. The decoy device then receives the threat record and sends a decoy plugin to the mobile phone. The mobile phone then generates second network traffic based on the received decoy plugin and sends the second network traffic to the full-traffic analysis device. Finally, the full-traffic analysis device determines the decoy network traffic within the received second network traffic based on the second strategy. In other words, the full-traffic analysis device first performs full-traffic analysis and threat detection on the network traffic sent by the mobile phone. If a threat is detected, the decoy device sends a decoy plugin to the mobile phone. The mobile phone then sends the network traffic containing the decoy plugin to the full-traffic analysis device, which then matches the decoy network traffic from the network traffic containing the decoy plugin. Therefore, the solution of this application can accurately identify the lured network traffic (i.e., the network traffic generated by luring attackers to access web pages, etc.) from all the generated network traffic when users access web pages via mobile phones, by combining the full traffic analysis threat detection strategy of the full traffic analysis device and the luring plugin of the luring device, and can improve the detection efficiency of the lured traffic.

[0126] For ease of understanding, the following is in conjunction with the appendix. Figure 6 This application provides a detailed description of the specific implementation of a network traffic detection method. For example... Figure 6 As shown, taking a mobile phone as the first electronic device, a full traffic analysis device as the second electronic device, and a trapping device as the third electronic device as an example, another network traffic detection method provided in this application embodiment includes: S601-S621.

[0127] S601, the phone generates the first network traffic.

[0128] S602, The mobile phone sends the first network traffic to the full traffic analysis device.

[0129] It should be noted that S601 and S602 are similar to S501 and S502 in the above embodiments, and will not be described again here.

[0130] S603, the full traffic analysis device receives the first network traffic.

[0131] After receiving the first network traffic, the full traffic analysis device uses the DataPlane Development Kit (DPDK), high-efficiency packet capture technology (PF-Ring), AF-Packet sockets, and other technologies to collect the first network traffic sent by the mobile phone at high speed from the physical network card.

[0132] It should be noted that S603 corresponds to S503 in the above embodiment.

[0133] In some embodiments, the full traffic analysis device may be turned on before receiving the first network traffic.

[0134] Then configure the first policy (i.e., the full traffic analysis threat detection policy), the second policy (i.e., the decoy policy), and the aggregation analysis engine. The aggregation analysis engine can include a threat log aggregation analysis engine. Simultaneously, the full traffic analysis device can send the configured second policy (i.e., the decoy policy) to the decoy device.

[0135] The full-traffic analysis threat detection strategy (i.e., the first strategy) can include multiple threat detection engines such as a feature engine, an intelligence engine, a file sandbox engine, an artificial intelligence engine, and a behavior engine. The feature engine analyzes the threat characteristics of the first network traffic; the intelligence engine analyzes the threat intelligence information of the first network traffic; the artificial intelligence engine identifies threats in the first network traffic; and the behavior engine generates conditions for determining a threat based on set conditions and feedback from the first network traffic, determining an executable action.

[0136] The trapping strategy (second strategy) can be used to identify network traffic metadata logs containing trapping, thereby identifying the trapped network traffic in the second network traffic.

[0137] In other embodiments, the decoy strategy (second strategy) may also be used to indicate the correspondence between the threat type of the first network traffic and the decoy plugin. The decoy strategy may include multiple decoy engines. The decoy strategy may include decoy engines corresponding to multiple threat detection engines.

[0138] In some embodiments, the configuration of the full traffic analysis device may include: site data (i.e., network traffic data generated by accessing web pages via mobile phone), site name (i.e., the name of the mobile phone when accessing web pages via mobile phone), threat detection type name, site address (i.e., the mobile phone address when accessing web pages via mobile phone), IP port (i.e., the IP port of the mobile phone when accessing web pages via mobile phone), trapping strategy, threat detection strategy, etc.

[0139] For example, after receiving network traffic that requires full traffic analysis, the full traffic analysis device can be configured as follows: { # Site Data "site": { # Site Name "site_name": "Test" # Site address "address": "abttest.com", # Port "port": 8080 }, # Trapping Strategy "honeypot_policy": { # Enable or disable "enabled": true, # Trapping Plugin "plug-in": [ { "name": "Login", path: " / dev / login }, { "name": "Customer Service Entry", "path": " / dev / custom } ] }, # Threat Detection Strategy "security_policy": { # Strategy Name "name": "Default Policy", # Strategy Description "description": "", # Strategy Query Object "query_object": { # Attack result, selected: Success "attack_result": [ 2 ], # Threat Level, Selected: Critical, High Risk "threat_level": [ 4, 3 ], # Confidence Level, Selected: High Confidence "reliability": [ 3 ] } } } In some embodiments, such as Figure 7As shown, the full traffic analysis device can display a configuration interface for full traffic analysis threat detection. This interface is used to show users the full traffic analysis policy, allowing them to understand the specific configuration details of the full traffic analysis threat detection policy. A full traffic analysis threat detection policy may include: policy name, description, monitored IP, attack results, threat level, confidence level, attack stage, threat type, save button, and close button.

[0140] For example, when users can configure full traffic analysis threat detection policies through full traffic analysis devices, such as Figure 7 As shown, users can enter the name of the full traffic analysis threat detection policy in the "Policy Name" field, a detailed description of the policy in the "Description" field, and the IP address of the mobile phone to be monitored in the "Monitoring IP" field. Then, they can configure the "Attack Result," "Threat Level," "Confidence Level," "Attack Stage," and "Threat Type." After configuration, users can save the settings by triggering the save button, allowing the full traffic device to receive the user's configuration. After entering the configured full traffic analysis threat detection policy, users can also trigger the close button to cancel the current configuration.

[0141] S604. The full traffic analysis device parses the first network traffic and obtains the metadata log of the first network traffic.

[0142] After receiving the first network traffic, the full traffic analysis device can parse the first network traffic to obtain the metadata log of the first network traffic, thereby enabling threat detection on the metadata log of the first network traffic.

[0143] In some embodiments, the full traffic analysis device may employ a traffic analysis engine to perform multi-level deep parsing on the collected first network traffic to obtain metadata logs of the first network traffic. The multi-level deep parsing may include L2-L7 level deep parsing. The metadata logs of the first network traffic may consist of multiple metadata logs.

[0144] For example, such as Figure 8 As shown, after parsing, the full traffic analysis device can display the metadata display interface of the first network traffic. This first network traffic metadata display interface is used to display metadata log information. The metadata log of the first network traffic may include: log time, source IP, destination IP, source port, destination port, application, request method, accessed domain name, requested resource, website type, user agent, and proxy address.

[0145] S605. The full traffic analysis device performs threat detection on the metadata logs of the first network traffic according to the first strategy to determine whether there is a threat in the metadata of the first network traffic.

[0146] After obtaining the metadata logs of the first network traffic, the full traffic analysis device can perform threat detection on the metadata logs of the first network traffic according to the pre-configured full traffic analysis threat detection policy (i.e., the first policy) to determine whether there is a threat in the metadata logs of the first network traffic.

[0147] If the metadata log of the first network traffic is determined to pose a threat, the full traffic analysis device can generate a metadata log indicating that the first network traffic poses a threat, based on the metadata log of the first network traffic, i.e., it can execute S605 as described below. If the first network traffic is determined not to pose a threat, the network traffic detection process ends, and the mobile phone can continue to access web pages.

[0148] In some embodiments, the full traffic analysis device matches multiple metadata logs with a multi-threat detection engine, and if multiple metadata logs match multiple threat detection engines, it determines that multiple metadata entries pose a threat.

[0149] S606. When the full traffic analysis device determines that the metadata of the first network traffic is threatening, it generates a metadata log indicating that the first network traffic is threatening based on the metadata log of the first network traffic.

[0150] When a full traffic analysis device determines that the metadata of the first network traffic is threatening, it can generate a threat metadata log based on the metadata log of the first network traffic. Thus, the full traffic analysis device can generate a threat record based on the generated threat metadata log.

[0151] In some embodiments, such as Figure 9 As shown, after the mobile phone sends the first network traffic to the full traffic analysis device, the full traffic analysis device collects the first network traffic. Then, it performs deep analysis on the collected first network traffic according to L2-L7 levels, obtaining multiple metadata logs of the first network traffic. Afterwards, it analyzes the data according to the configured full traffic analysis threat detection strategy (such as...). Figure 9 The system utilizes various engines, including feature detection, intelligence detection, file sandbox detection, AI detection, and behavior detection, to perform threat detection on multiple metadata logs of the first network traffic. If a threat is detected in multiple metadata logs of the first network traffic, multiple metadata logs of different threat types are generated (e.g., ...). Figure 9 Threat log instance 1, threat log instance 2, and threat log instance N, etc.

[0152] In some embodiments, the metadata logs of a threat may include: first discovery time, most recent discovery time, source IP, destination IP, application layer protocol, application, threat type (such as information disclosure type), threat name, threat level, attack result, attack stage, confidence level, payload, associated logs, detection engine, session direction, rule ID / identifier, interface, attacker, victim, HTTP URI, HTTP host, and DNS domain name, etc.

[0153] For example, if it is determined that the network traffic generated by a mobile phone accessing a webpage poses a threat, based on the metadata log parsed from that network traffic, a threat-posing metadata log is generated as shown below: "'First Discovery Time', "'Most Recent Discovery Time', "'Source IP', "'Destination IP', "'Application Layer Protocol', "'Application', "'Threat Type', "'Threat Name', "'Threat Level', "'Attack Result', "'Attack Stage', "'Confidence Level', "'Payload', "'Correlation Logs', "'Detection Engine', "'Session Direction', "'Rule ID / Identifier', "'Interface', "'Attacker', "'Victim', "'HTTP URI', "'HTTP Host', "'DNS Domain Name' "'2023-03-27 10:46:01","'2023-03-27 10:46:01","'192.168.195.156","'223.109.60.91","'HTTP","'Web browsing (HTTP)","'Information leakage","'Information leakage temporary file detection","'Low risk","'Success","'Intrusion","'Trusted","'URI: / wmsdn / 11.8.88.28 / K6DyWfTmOtE1.tmp Request method: GET Status code: 200 User-Agent: Mozilla / 5.0 (Windows NT 10.0; WOW64) AppleWebKit / 537.36(KHTML, like Gecko) Chrome / 74.0.3729.108 Safari / 537.36 ","'1","'Feature Engine","'Inner->Outer","'802429","'enp62s0f3","'192.168.195.156","'223.109.60.91","' / wmsdn / 11.8.88.28 / K6DyWfTmOtE1.tmp","'abttest.com","'" "'2023-03-27 10:40:20","'2023-03-27 10:40:20","'192.168.3.67","'192.168.215.191","'HTTP","'Web browsing (HTTP)","'Other Web attacks","'CirCarLife Scada<4.3 - System log exposure","'Critical","'Success","'Intrusion","'High trust","'URI: / views / activation / html / login_queryCustomer.action?_dc=1679884690611 Request method: GET Status code: 200 User-Agent: Mozilla / 5.0 (Windows NT 10.0; WOW64) AppleWebKit / 537.36(KHTML, like Gecko) Chrome / 81.0.4044.122 Safari / 537.36 ","'1","'Feature Engine","'Inner->Inner","'700929","'enp62s0f3","'192.168.3.67","'192.168.215.191","' / views / activation / html / login_queryCustomer.action?_dc=1679884690611","'192.168.21 5.191","'""'2023-03-27 10:11:05","'2023-03-27 10:11:12","'192.168.9.124","'192.168.215.117","'HTTP","'Web browsing (HTTP)","'Information leakage","'Information leakage temporary file detection","'Low risk","'Success","'Intrusion","'Trusted","'URI: / totems-bj / topology / cs0348 / - / refs / R3.1.0_0930 / logs_tree / totems-module-component / totems-topology-push / totems-topology-push-app / src / main / java / com / abtnetworks / totems / recommend?format=json&offset=0 Request method: GET Status code: 200 User-Agent: Mozilla / 5.0 (Windows NT 10.0; Win64; x64) AppleWebKit / 537.36 (KHTML, like Gecko) Chrome / 101.0.0.0 Safari / 537.36 ","'2","'Feature Engine","'Inner->Inner","'802736","'enp62s0f3","'192.168.9.124","'192.168.215.117","' / totems-bj / src / main / java / com / abtnetworks / totems / recommend?format=json&offset=0","'192.168.215.117","'","'","'","'","'","'" "'2023-03-27 09:31:32","'2023-03-27 09:31:32","'192.168.195.92","'10.210.11.9","'HTTP","'Web browsing (HTTP)","'File upload","'File upload vulnerability","'High risk","'Success","'Intrusion","'Trusted","'URI: / webui / ?g=net_plugin_push_config Request method: POST Status code: 200 User-Agent: Mozilla / 5.0 (Windows NT 10.0; Win64; x64) AppleWebKit / 537.36 (KHTML, like Gecko) Chrome / 111.0.0.0 Safari / 537.36 ","'1","'Intelligence Engine","'Internal->Internal","'802261","'enp62s0f3","'192.168.195.92","'10.210.11.9","' / webui / ?g=net_plugin_push_config","'abttest2.com","'","'","'" "'2023-03-27 03:16:59","'2023-03-27 03:59:21","'10.210.20.10","'192.168.1.148","'FTP","'FTP File Transfer Protocol","'Brute-force attack","'FTP brute-force password cracking","'High risk","'Success","'Intrusion","'High trust","'Attack result: Success Detailed information: FTP brute-force password cracking ","'43","'Behavior Engine","'Inner->Inner","'","'enp62s0f3","'10.210.20.10","'192.168.1.148","'","'","'".

[0154] The S607 full traffic analysis device aggregates and analyzes multiple metadata logs of the first network traffic that pose a threat, generating a threat record.

[0155] After the full traffic analysis device generates metadata logs indicating that the first network traffic poses a threat, it can aggregate and analyze multiple metadata logs indicating that the first network traffic poses a threat to generate a threat record.

[0156] It should be noted that S604 to S607 correspond to S504 to S505 in the above embodiments. That is, through S604 to S607 in the embodiments of this application, it is possible to determine whether there is a threat in the first network traffic based on the full traffic analysis device's preset full traffic analysis threat detection strategy, and generate a threat record if the first network traffic is found to be a threat.

[0157] In some embodiments, the full traffic analysis device can aggregate multiple metadata logs containing threats through a configured threat log aggregation analysis engine to form different types of threat records. These different types of threat records can be used to indicate the threat type of the first network traffic.

[0158] For example, such as Figure 10 As shown, when generating multiple threat metadata logs (such as...) Figure 10 After including threat metadata log instance 1, threat metadata log instance 2, and threat metadata log instance N, the threat log aggregation and analysis engine, in conjunction with the trapping engine corresponding to the threat detection engine, will aggregate multiple metadata logs containing threats (such as threat metadata log instance 1, threat metadata log instance 2, and threat metadata log instance N, etc.). Figure 10 Threat metadata log instance 1, threat metadata log instance 2, and threat metadata log instance N, etc., are aggregated together to form multiple threat records (such as...). Figure 10Threat records include Threat Record 1, Threat Record 2, and Threat Record N. Threat records can include: site address (i.e., the mobile address of the user accessing the webpage), attacker information, key-value pairs, recording time, and remaining time. Attacker information can include: IP address, country, city, whether it is an asset, whether it is located overseas, and intelligence tags.

[0159] Specifically, for example, the threat log is as follows: { # Site address "site_address": "abttest.com", # Attacker Information "attacker": { # IP address IP address: 10.210.20.10 # nation "country": "", # City "city": "", # Is it an asset? "is_asset": 1, # Asset Name "asset_name": "", # Is it overseas? "is_outside": 0, # Intelligence Tags "ti_labels": [] }, # Cookie key-value pairs "cookies": { "__dGVzdDE=__": "9feb3268-67a8-4726-ba69-45325be9038b", "__dGVzdDI=__": "69b6374f-e58b-4e95-a4c0-740367ce9dd6" }, # Record creation time "create_time": 1654758440, # time left "expire_time": "13:32:02" }

[0160] By using a full-traffic analysis device to perform threat detection on all primary network traffic and generate threat records when threats exist in the primary network traffic, it is possible to analyze all primary network traffic and thus identify all threat records.

[0161] S608, the full flow analysis device sends the generated threat records to the trapping device.

[0162] After the full traffic analysis device generates a threat record, it can send the threat record to the trapping device, which can then send the corresponding trapping plugin to the mobile phone based on the threat record.

[0163] In some embodiments, the full traffic analysis device can send multiple different types of threat records generated to the trapping device.

[0164] It should be noted that S608 in this embodiment corresponds to S506 in the above embodiment.

[0165] S609. The trapping device receives threat records sent by the full traffic analysis device.

[0166] The trapping device can receive threat records sent by the full traffic analysis device through the application programming interface (API), and then send the corresponding trapping plugin to the mobile phone based on the threat records.

[0167] In some embodiments, the trapping device receives different types of threat records sent by the full traffic analysis device via an API.

[0168] It should be noted that S609 in this embodiment corresponds to S507 in the above embodiment.

[0169] S610, the trapping device matches the threat log with the second strategy.

[0170] After receiving a threat record, the trapping device matches the received threat record with the second strategy, thereby sending the corresponding trapping plugin to the mobile phone. The second strategy is a trapping strategy configured by the full traffic analysis device, which includes multiple trapping engines.

[0171] In some embodiments, the trapping device matches multiple different types of threat records received with multiple trapping engines, thereby sending the trapping plugin corresponding to the threat record to the mobile phone if the threat record matches the second strategy.

[0172] S611. When the threat record matches the second strategy, the trapping device sends the trapping plugin corresponding to the threat record to the mobile phone.

[0173] When a threat record matches a corresponding trapping engine, the trapping device sends a trapping plugin corresponding to the threat record to the mobile phone.

[0174] It should be noted that S610 to S611 in this embodiment correspond to S508 in the above embodiment.

[0175] In some embodiments, when multiple different types of threat records are matched with corresponding trapping engines, the trapping device sends the corresponding trapping plugin to the mobile phone.

[0176] In some embodiments, the decoy plugin can be a program or application capable of enticing an attacker to carry out an attack. For example, a program that scans login and / or customer service portals.

[0177] In this way, the trapping device only needs to retrieve the corresponding trapping plugin from the threat record after receiving it, and then send the trapping plugin corresponding to the threat record to the mobile phone. In other words, the trapping device does not need to detect and analyze the threat, which can improve the throughput of the device.

[0178] S612, The trapping plugin corresponding to the threat record sent by the trapping device to the mobile phone.

[0179] The mobile phone can receive the trapping plugin corresponding to the threat record sent by the trapping device, and the mobile phone can generate a second network traffic based on the trapping plugin corresponding to the threat record.

[0180] It should be noted that S612 in this embodiment corresponds to S509 in the above embodiment.

[0181] S613: The mobile phone generates a second network traffic based on the trapping plugin corresponding to the threat record.

[0182] When a user accesses a webpage through a sniffing plugin on their mobile phone, the phone generates network traffic containing the sniffing (i.e., secondary network traffic).

[0183] For example, when a user (i.e. an attacker) performs login operations, fills in information, or visits web pages through a rendered decoy plugin, the mobile phone will generate network traffic containing the decoy, that is, network traffic carrying the decoy plugin (path).

[0184] It should be noted that S613 in this embodiment corresponds to S510 in the above embodiment.

[0185] S614, The mobile phone sends a second network traffic to the full traffic analysis device.

[0186] S615, a full traffic analysis device, receives second network traffic sent by mobile phones.

[0187] It should be noted that S614 to S615 in this embodiment are similar to S511 to S512 in the above embodiment, and will not be described again in this application embodiment.

[0188] S616 The full traffic analysis device parses the second network traffic and obtains the metadata log of the parsed second network traffic.

[0189] Full traffic analysis devices can use a traffic analysis engine to perform multi-level deep analysis on the collected network traffic, including the captured traffic, to obtain multiple metadata logs of the captured network traffic. The multi-level deep analysis can include L2-L7 level deep analysis.

[0190] S617. The full traffic analysis device identifies the metadata log of the second network traffic according to the second strategy, and obtains the metadata log of the captured network traffic.

[0191] The full traffic analysis device can identify the network traffic metadata logs containing the traps according to the configured trapping strategy, thereby identifying the trapped network traffic metadata logs and determining the trapped network traffic in the second network traffic.

[0192] S618, the full traffic analysis device determines the captured network traffic in the second network traffic based on the captured network traffic metadata log.

[0193] After the full traffic analysis device identifies the captured network traffic metadata logs, it can determine the captured network traffic in the second network based on the captured network traffic metadata logs.

[0194] It should be noted that S616 to S618 in this embodiment correspond to S513 in the above embodiment. That is to say, S513 in the above embodiment can be implemented by S616 to S618 in this embodiment.

[0195] In this way, the full traffic analysis device detects and identifies all network traffic, which can improve the comprehensiveness of threat detection and thus improve the accuracy of threat detection; and by detecting and identifying threats twice through the full traffic analysis device, the accuracy of threat detection can be further improved.

[0196] S619, The full traffic analysis device sends the network traffic for trapping to the trapping device.

[0197] After determining the captured network traffic in the second network, the full traffic analysis device can send the captured network traffic to the capturing device, so that the capturing device can store the captured network traffic and perform a capturing response.

[0198] S620, the trapping device receives the network traffic for trapping.

[0199] The trapping device can receive the trapped network traffic sent by the full traffic analysis device, and thus the trapping device can store the trapped network traffic.

[0200] S621, The trapping device stores the network traffic it traps.

[0201] After receiving the captured network traffic from the full traffic analysis device, the capture device can store the captured network traffic in the database and perform a capture response.

[0202] In some embodiments, the trapping device can send the stored trapped network traffic to the full traffic analysis device, so that the full traffic analysis device can update its full traffic analysis threat detection strategy and trapping strategy, thereby making the threat detection of the full traffic analysis device more accurate and convenient.

[0203] In some embodiments, the trapping device may display the trapped network traffic after receiving it.

[0204] In some embodiments, the trapping device may also generate alarm behavior logs corresponding to the mobile phone based on the trapped network traffic; and send the alarm behavior logs corresponding to the mobile phone to the mobile phone so that the mobile phone denies the user access.

[0205] The solution proposed in this application can detect captured network traffic in all traffic scenarios without changing the user's network architecture (i.e. without adding any new devices). This avoids redundant hardware investment for users, thereby saving costs and making the application more widespread and applicable.

[0206] Furthermore, the solution proposed in this application, by analyzing and detecting threats in all network traffic through a full traffic analysis device, can completely free up the traffic analysis and threat detection of the trapping device. The trapping device only needs to send a trapping plugin corresponding to the threat type to the mobile phone, which can maximize the throughput of the trapping device and improve the detection efficiency of network traffic containing traps in full traffic scenarios.

[0207] This application also provides a network traffic detection device, which can be applied to a first electronic device to implement the network traffic detection method described above. The function of this network traffic detection device can be implemented in hardware or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the functions described above.

[0208] For example, Figure 11 A schematic diagram of a network traffic detection device is shown, such as... Figure 11As shown, the network traffic detection device 1100 may include: a sending unit 1101, a receiving unit 1102, and a traffic generation unit 1103, etc.

[0209] The traffic generation unit 1103 can be used to generate the first network traffic.

[0210] The transmitting unit 1101 can be used to transmit the first network traffic to the second electronic device.

[0211] The receiving unit 1102 can be used to receive a decoy plugin sent by a third electronic device. The decoy plugin is sent by the third electronic device to the first electronic device when the second electronic device determines that the first network traffic is threatening based on the first strategy. The first strategy is a full traffic analysis threat detection strategy preset by the second electronic device.

[0212] The traffic generation unit 1103 can also be used to generate a second network traffic based on the trapping plugin.

[0213] The sending unit 1101 can also be used to send the second network traffic to the second electronic device after generating the second network traffic based on the trapping plugin, so that the second electronic device can determine the trapping network traffic in the second network traffic.

[0214] In another possible implementation, the first electronic device is a mobile phone, the second electronic device is a full traffic analysis device, and the third electronic device is a trapping device.

[0215] This application also provides a network traffic detection device. This network traffic detection device can be applied to a second electronic device to implement the network traffic detection method described above. The function of this network traffic detection device can be implemented in hardware or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the functions described above.

[0216] For example, Figure 12 A schematic diagram of a network traffic detection device is shown, such as... Figure 12 As shown, the network traffic detection device 1200 may include: a receiving unit 1201, a threat detection unit 1202, a record generation unit 1203, a sending unit 1204, and an identification unit 1205, etc.

[0217] The receiving unit 1201 can be used to receive the first network traffic sent by the first electronic device.

[0218] The threat detection unit 1202 can be used to determine whether there is a threat in the first network traffic based on a first strategy, wherein the first strategy is a full traffic analysis threat detection strategy preset by the second electronic device.

[0219] The record generation unit 1203 can be used to generate a threat record when the first network traffic is threatened.

[0220] The sending unit 1204 can be used to send threat records to a third electronic device.

[0221] The receiving unit 1201 can also be used to receive second network traffic sent by the first electronic device.

[0222] The identification unit 1205 can be used to determine the trapped network traffic in the second network traffic based on a second strategy, wherein the second strategy is a trapping strategy preset by the second electronic device.

[0223] In another possible implementation, the first electronic device is a mobile phone, the second electronic device is a full traffic analysis device, and the third electronic device is a trapping device.

[0224] This application also provides a network traffic detection device. This network traffic detection device can be applied to a third electronic device to implement the network traffic detection method described above. The functions of this network traffic detection device can be implemented in hardware or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the functions described above.

[0225] For example, Figure 13 A schematic diagram of a network traffic detection device is shown, such as... Figure 13 As shown, the network traffic detection device 1300 may include a receiving unit 1301 and a sending unit 1302, etc.

[0226] The receiving unit 1301 can be used to receive threat records sent by the second electronic device. The threat record is generated by the second electronic device when it determines that the first network traffic poses a threat based on a first strategy; the first strategy is a preset full-traffic analysis threat detection strategy of the second electronic device.

[0227] The sending unit 1302 can be used to send a trapping plugin to a first electronic device so that the first electronic device generates second network traffic based on the trapping plugin.

[0228] In another possible implementation, the network traffic detection device may also include a storage unit 1303.

[0229] The receiving unit 1301 can also be used to receive the network traffic being captured by the second electronic device.

[0230] Storage unit 1303 can be used to store captured network traffic.

[0231] In another possible implementation, the first electronic device is a mobile phone, the second electronic device is a full traffic analysis device, and the third electronic device is a trapping device.

[0232] It should be understood that the division of units or modules (hereinafter referred to as units) in the above device is only a logical functional division. In actual implementation, they can be fully or partially integrated into a single physical entity, or they can be physically separated. Furthermore, all units in the device can be implemented in software through processing element calls; all units can be implemented in hardware; or some units can be implemented in software through processing element calls, and some units can be implemented in hardware.

[0233] For example, each unit can be a separate processing element, or it can be integrated into a chip within the device. Alternatively, it can be stored as a program in memory, invoked and executed by a processing element within the device. Furthermore, these units can be integrated in whole or in part, or implemented independently. The processing element described here can also be called a processor, which can be an integrated circuit with signal processing capabilities. In implementation, each step of the above method or each of the above units can be implemented through integrated logic circuits in the processor element or through software invoked by the processing element.

[0234] In one example, the unit in the above device may be one or more integrated circuits configured to implement the above methods, such as one or more ASICs, or one or more DSPs, or one or more FPGAs, or a combination of at least two of these integrated circuit forms.

[0235] For example, when the units in the device can be implemented through a processing element scheduler, the processing element can be a general-purpose processor, such as a CPU or other processor capable of calling programs. Alternatively, these units can be integrated together to form a system-on-a-chip (SOC).

[0236] In one implementation, the units that implement the corresponding steps in the above method can be implemented in the form of a processing element scheduler. For example, the device may include a processing element and a storage element, wherein the processing element calls a program stored in the storage element to execute the network traffic detection method described in the above method embodiments. The storage element may be a storage element located on the same chip as the processing element, i.e., an on-chip storage element.

[0237] In another implementation, the program used to execute the above method can be located on a storage element on a different chip than the processing element, i.e., an off-chip storage element. In this case, the processing element calls or loads the program from the off-chip storage element onto the on-chip storage element to call and execute the network traffic detection method described in the above method embodiments.

[0238] For example, embodiments of this application may also provide an apparatus, such as an electronic device, which may include a processor and a memory for storing processor-executable instructions. When the processor is configured to execute the aforementioned instructions, the electronic device implements the network traffic detection method as described in the foregoing embodiments. The memory may be located within or outside the electronic device. Furthermore, the processor may include one or more processors.

[0239] In another implementation, the unit implementing each step of the above method can be configured as one or more processing elements, which can be disposed on the corresponding electronic device described above. These processing elements can be integrated circuits, such as one or more ASICs, one or more DSPs, one or more FPGAs, or combinations of these types of integrated circuits. These integrated circuits can be integrated together to form a chip.

[0240] For example, this application also provides a chip that can be applied to the aforementioned electronic device. The chip includes one or more interface circuits and one or more processors; the interface circuits and processors are interconnected via lines; the processor receives and executes computer instructions from the electronic device's memory through the interface circuits to implement the network traffic detection method described in the above method embodiments.

[0241] This application also provides a computer program product, including computer instructions for operation of the electronic device described above.

[0242] Through the above description of the embodiments, those skilled in the art can clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0243] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another device, or some features may be ignored or not executed. Furthermore, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0244] The units described as separate components may or may not be physically separate. A component shown as a unit can be one or more physical units; that is, it can be located in one place or distributed in multiple different locations. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0245] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0246] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, in essence, or the parts that contribute to the prior art, or all or part of the technical solutions, can be embodied in the form of a software product, such as a program. This software product is stored in a program product, such as a computer-readable storage medium, and includes several instructions to cause a device (which may be a microcontroller, chip, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, RAM, magnetic disks, or optical disks.

[0247] For example, embodiments of this application may also provide a computer-readable storage medium storing computer program instructions thereon. When the computer program instructions are executed by an electronic device, the electronic device causes the electronic device to implement the network traffic detection method as described in the foregoing method embodiments.

[0248] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for detecting network traffic, characterized in that, An application in a network traffic detection system, the network traffic detection system comprising a first electronic device, a second electronic device, and a third electronic device, the method comprising: The second electronic device receives the first network traffic sent by the first electronic device and determines whether the first network traffic poses a threat based on a first strategy; the first strategy is a full traffic analysis threat detection strategy preset by the second electronic device. If the first network traffic is found to be threatening, the second electronic device generates a threat record and sends the threat record to the third electronic device; the threat record is used to indicate that the first network traffic is threatening. The third electronic device receives the threat record and sends a trapping plugin to the first electronic device; The first electronic device receives the trapping plugin and generates second network traffic based on the trapping plugin; The first electronic device sends the second network traffic to the second electronic device; The second electronic device receives the second network traffic and determines the trapped network traffic in the second network traffic based on the second strategy, wherein the second strategy is a trapping strategy preset by the second electronic device; The second electronic device receives the first network traffic and determines whether the first network traffic poses a threat based on a first policy; including: The second electronic device parses the first network traffic to obtain the metadata log of the parsed first network traffic; The second electronic device performs threat detection on the metadata logs of the first network traffic according to the first policy to determine whether there is a threat in the metadata of the first network traffic; The second strategy determines the trapped network traffic within the second network traffic, including: The second electronic device parses the second network traffic to obtain the metadata log of the parsed second network traffic; The second electronic device identifies the metadata log of the second network traffic according to the second strategy to obtain the captured network traffic metadata log; The second electronic device determines the captured network traffic in the second network traffic based on the captured network traffic metadata log.

2. The network traffic detection method according to claim 1, characterized in that, The second electronic device generates threat logs, including: The second electronic device generates a metadata log indicating that the first network traffic poses a threat based on the first network traffic. The second electronic device aggregates and analyzes the metadata logs of the first network traffic that pose a threat, and generates a threat record.

3. The network traffic detection method according to claim 1, characterized in that, After the second electronic device receives the second network traffic and determines the stowed network traffic in the second network traffic based on the second strategy, the method further includes: The second electronic device sends the captured network traffic to the third electronic device; The third electronic device receives the captured network traffic and stores the captured network traffic.

4. The network traffic detection method according to claim 1, characterized in that, Before the third electronic device sends the trapping plug-in to the first electronic device, the method further includes: The third electronic device matches the threat record with the second policy; If the threat record matches the second strategy, the third electronic device sends the trapping plugin corresponding to the threat record to the first electronic device.

5. The network traffic detection method according to claim 1, characterized in that, Before the third electronic device matches the threat record with the second policy, the method further includes: The third electronic device receives the second strategy sent by the second electronic device.

6. The network traffic detection method according to claim 1, characterized in that, Before the second electronic device receives the first network traffic sent by the first electronic device, the following steps are also included: The first electronic device generates the first network traffic; The first electronic device sends the first network traffic to the second electronic device.

7. A method for detecting network traffic, characterized in that, The method, applied to a first electronic device in the network traffic detection system of claim 1, comprises: Send the first network traffic to the second electronic device; The device receives a decoy plugin sent by a third electronic device. The decoy plugin is sent by the third electronic device to the first electronic device when the second electronic device determines that the first network traffic is a threat based on a first strategy. The first strategy is a full traffic analysis threat detection strategy preset by the second electronic device. The second network traffic is generated based on the trapping plugin and sent to the second electronic device so that the second electronic device can determine the trapping network traffic in the second network traffic.

8. A method for detecting network traffic, characterized in that, The method, applied to the second electronic device in the network traffic detection system of claim 1, comprises: Receive the first network traffic sent by the first electronic device; The first strategy determines whether the first network traffic poses a threat; the first strategy is a preset full-traffic analysis threat detection strategy for the second electronic device. If the first network traffic is found to be threatening, a threat record is generated and sent to a third electronic device; the threat record is used to indicate that the first network traffic is threatening. Receive the second network traffic sent by the first electronic device; The second strategy is used to determine the trapped network traffic in the second network traffic, where the second strategy is a preset trapping strategy of the second electronic device.

9. A method for detecting network traffic, characterized in that, The method, applied to a third electronic device in the network traffic detection system of claim 1, comprises: The system receives threat records sent by a second electronic device; the threat records are generated by the second electronic device when it determines that the first network traffic is threatened based on a first strategy; the first strategy is a preset full-traffic analysis threat detection strategy of the second electronic device. Send a trapping plugin to the first electronic device so that the first electronic device generates second network traffic based on the trapping plugin.

10. A network traffic detection system, characterized in that, The network traffic detection system includes: a first electronic device, a second electronic device, and a third electronic device, wherein the first electronic device is used to execute the network traffic detection method as described in claim 7, the second electronic device is used to execute the network traffic detection method as described in claim 8, and the third electronic device is used to execute the network traffic detection method as described in claim 9.

11. An electronic device, characterized in that, The electronic device includes a processor and a memory for storing processor-executable instructions; the processor is configured to, when executing the instructions, cause the electronic device to perform the network traffic detection method as described in claim 7; or, the processor is configured to, when executing the instructions, cause the electronic device to implement the network traffic detection method as described in claim 8; or, the processor is configured to, when executing the instructions, cause the electronic device to implement the network traffic detection method as described in claim 9.

12. A computer-readable storage medium having computer program instructions stored thereon; characterized in that, When the computer program instructions are executed by the electronic device, the electronic device implements the network traffic detection method as described in claim 7; or, when the computer program instructions are executed by the electronic device, the electronic device implements the network traffic detection method as described in claim 8; or, when the computer program instructions are executed by the electronic device, the electronic device implements the network traffic detection method as described in claim 9.

Images