Tls fingerprint information recognition method and system based on finite state machine

Abstract

The application relates to a TLS fingerprint information recognition method and system based on a finite state machine. The system comprises at least a model deduction module (200) for deducing a state machine model of a target TLS implementation based on mapping information sent by a message mapping module (100); a fingerprint extraction module (600) for analyzing the state machine model and extracting a multi-level fingerprint of the target TLS implementation; and a version recognition module (300) for verifying the validity of the multi-level fingerprint and / or recognizing version information of an unknown TLS implementation. Compared with other network protocol recognition systems, the application can recognize and judge specific implementation types and versions of the TLS protocol and other fine-grained information. Meanwhile, the method of the application is highly automated, and has good usability and scalability.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a TLS fingerprint information identification method and system based on a finite state machine. BACKGROUND

[0002] With the deepening of the concept of network security, TLS has become the most widely used security protocol on the Internet and gradually become the key foundation of building a network security system. Existing network protocol identification methods mainly include network protocol identification methods based on transport layer ports, based on payloads and based on statistical characteristics. The identification method based on the transport layer port identifies the protocol according to the port allocation rule (i.e. IANA specification); the identification method based on the payload identifies the protocol by using protocol analysis and pattern matching technology; the identification method based on statistical characteristics identifies the protocol by using machine learning method according to the statistical characteristics of network flow. However, the above methods can only identify the protocol category to which the network data packet belongs, and cannot further obtain fine-grained protocol information.

[0003] For example, the Chinese patent with publication number CN113037746B discloses a client fingerprint extraction, identity recognition and network security detection method and device. The client fingerprint extraction method includes: receiving a web access request of a client; determining a TLS fingerprint of the client according to the web access request; performing feature extraction on the TLS fingerprint to obtain a feature set of the TLS fingerprint; and performing dimension reduction processing on the feature set of the TLS fingerprint based on a simhash algorithm to obtain a target fingerprint for representing the network identity of the client. The embodiment also provides an electronic device, a computer readable storage medium and a computer program product. This patent can only identify the protocol category to which the network data packet belongs, cannot further obtain fine-grained protocol information, and cannot detect TLS vulnerabilities.

[0004] Therefore, the present application hopes to further obtain fine-grained protocol information by improving the extraction step and the identification step, thereby providing a basis for implementing TLS vulnerability detection, code shell detection and other functions.

[0005] In addition, on the one hand, there are differences in the understanding of those skilled in the art; on the other hand, the applicant has studied a large number of literatures and patents when making the present application, but due to the limited space, all the details and contents have not been listed in detail, which does not mean that the present application does not have these characteristics of the prior art. On the contrary, the present application already has all the characteristics of the prior art, and the applicant reserves the right to add relevant prior art in the background art. SUMMARY

[0006] In view of the deficiencies of the prior art, the application provides a TLS fingerprint information recognition system based on a finite state machine, which at least comprises:

[0007] a model deduction module, configured to deduce a state machine model of a target TLS implementation based on mapping information sent by the message mapping module;

[0008] a fingerprint extraction module, configured to analyze the state machine model and extract multi-level fingerprints of the target TLS implementation;

[0009] a version recognition module, configured to verify validity of the multi-level fingerprints and / or recognize version information of an unknown TLS implementation.

[0010] The application deduces a state machine model of a TLS implementation, and introduces a multi-level fingerprint extraction algorithm on the basis, so as to recognize type and version information of the TLS implementation, and solve the problem that the existing network protocol recognition method cannot recognize fine-grained protocol information. Compared with the prior art, the application has finer-grained protocol information, can accurately obtain a specific software name and version number of a measured TLS server, and has less data packets for fingerprint matching and is more covert in terms of the existing TLS fingerprint extraction based on data packet load.

[0011] Preferably, the model deduction module is connected with a state machine model library, the model deduction module verifies whether the deduced state machine model represents complete behavior of the target TLS implementation based on an equivalence query algorithm in the model verification unit, if the verification is successful, the deduced state machine model is stored in the state machine model library, if the verification fails, counterexample information is fed back to the model learning unit to guide re-deduction of the model until the verification is successful.

[0012] Preferably, the model deduction module at least comprises a model learning unit and a model verification unit, the model learning unit is configured to deduce a state machine model of a target TLS implementation according to a state machine learning algorithm, and the model verification unit is configured to judge whether the deduced state machine model represents complete behavior of the target TLS implementation.

[0013] Preferably, the fingerprint extraction module at least comprises: a model analysis unit, configured to extract features of the state machine model and perform clustering processing; a model comparison unit, configured to compare and analyze different categories of state machine models to obtain at least one kind of fingerprint information in a first range; and a fingerprint extraction unit, configured to calculate an intersection of each category of state machine and a comparison result of the stored state machine to obtain fingerprint information in a second range.

[0014] Preferably, in the presence of a part of the state machine model without fingerprint information, the fingerprint extraction unit filters out the state machine model of the discovered fingerprint and feeds back a re-contrast instruction to the model contrast unit, otherwise, the fingerprint extraction unit outputs all fingerprints.

[0015] Preferably, the fingerprint extraction module comprises a fingerprint updating unit, and the step of updating the fingerprint comprises at least: calculating the fingerprint of the target TLS implementation; updating all existing fingerprints at the level according to the level of the fingerprint information; respectively contrasting the state machine model corresponding to the existing fingerprint at the level with the state machine model of the target TLS implementation to obtain the contrast result of each state machine model with the state machine of the target TLS implementation; and taking the intersection of the fingerprint of each state machine model and the contrast result as the updated fingerprint.

[0016] When a new TLS state machine model fingerprint is discovered, the existing multi-level fingerprint only needs to be incrementally updated by the fingerprint updating unit without re-computation, thereby ensuring the scalability of the system.

[0017] Preferably, the version identification module comprises at least a fingerprint matching unit and a fingerprint verification unit. The fingerprint matching unit is configured to identify the version information of the unknown TLS protocol implementation according to the multi-level fingerprint, and the fingerprint verification unit is configured to verify the validity of the multi-level fingerprint.

[0018] Preferably, the system further comprises a multi-level fingerprint pool configured to maintain the multi-level fingerprint data of the known TLS implementation and send the multi-level fingerprint information corresponding to the target TLS implementation to the version identification module in response to the fingerprint request information sent by the version identification module.

[0019] The application also provides a TLS fingerprint information identification method based on a finite state machine, which comprises at least: deducing the state machine model of a target TLS implementation based on the mapping information sent by a message mapping module; analyzing the state machine model and extracting the multi-level fingerprint of the target TLS implementation; verifying the validity of the multi-level fingerprint and / or identifying the version information of an unknown TLS implementation.

[0020] Preferably, the method further comprises: calculating the fingerprint of the target TLS implementation; updating all existing fingerprints at the level according to the level of the fingerprint information; respectively contrasting the state machine model corresponding to the existing fingerprint at the level with the state machine model of the target TLS implementation to obtain the contrast result of each state machine model with the state machine of the target TLS implementation; and taking the intersection of the fingerprint of each state machine model and the contrast result as the updated fingerprint.

[0021] The TLS fingerprint extraction and version identification method based on the finite state machine provided by the application does not need manual data labeling, the model deduction module, the message mapping module, the fingerprint extraction module and the version identification module are highly automated, thereby guaranteeing the ease of use of the system. BRIEF DESCRIPTION OF DRAWINGS

[0022] Figure 1 is a structural schematic diagram of a model deduction module of a preferred embodiment provided by the application;

[0023] Figure 2 is a method flowchart of a fingerprint extraction method in a TLS fingerprint related information identification system of a preferred embodiment provided by the application;

[0024] Figure 3 is a simplified module connection relationship schematic diagram of a TLS fingerprint related information identification system of a preferred embodiment provided by the application.

[0025] LIST OF REFERENCE NUMERALS

[0026] 11: test unit; 12: black box system; 13: real state machine; 14: virtual state machine; 100: message mapping module; 101: message mapping unit; 102: state tracking unit; 200: model deduction module; 201: model learning unit; 202: model verification unit; 300: version identification module; 301: fingerprint matching unit; 302: fingerprint verification unit; 400: state machine model library; 500: multi-level fingerprint pool; 600: fingerprint extraction module; 601: model analysis unit; 602: model comparison unit; 603: fingerprint extraction unit; 604: fingerprint updating unit; 700: known TLS implementation module; 800: unknown TLS implementation module. DETAILED DESCRIPTION

[0027] The application will be described in detail below with reference to the accompanying drawings.

[0028] In view of the deficiencies of the prior art, the application provides a TLS fingerprint information identification method and system based on a finite state machine. The application can also provide a method for deducing a TLS protocol implementation state machine.

[0029] TLS: a secure transmission layer protocol, used to provide confidentiality and data integrity between two communication application programs. TLS handshake refers to a series of data packets and messages exchanged between the client and the server, involving multiple steps. The server can only perform further data exchange after completing the handshake information exchange with the client.

[0030] State machine model library: used to store the state machine model learned by the model inference module (200), and provide the learned TLS state machine model to the fingerprint extraction module (600).

[0031] Test unit: used to learn the state machine, and convert abstract information into specific information and send it to the black box system to be tested.

[0032] Black box system: used to learn the state machine and as the learning object of the test unit.

[0033] Real state machine: belongs to the real state machine inside the black box system 12, used to control the behavior logic of the black box system 12.

[0034] Virtual state machine: refers to the stage state machine output by the model learning unit 201 in the process of executing the state machine learning algorithm. If the stage state machine passes the consistency test of the model verification unit 202, it is the final output of the model inference module 200. Otherwise, the model verification unit 202 will provide a counterexample information to the model learning unit 201 for further optimization of the stage state machine. Repeat the above steps until the stage state machine passes the consistency test of the model verification unit.

[0035] Finite state machine: the finite state machine model is suitable for describing the state transition characteristics of network protocols, and is the most commonly used formal description method. The finite state machine model is generally represented by a directed graph, where the vertices represent states and the directed edges represent state transitions. The input and output marked on the directed edge are the conditions for state transition.

[0036] Equivalence query: the purpose is to verify whether the virtual state machine 14 and the real state machine 13 are the same.

[0037] Member query: the purpose is to build a virtual state machine 14 by providing an abstract request sequence and observing an abstract response sequence. Abstract request sequence: the abstract request sequence is essentially a symbolization of protocol messages, for example, using ClientHello to represent the TLS packet with type field as ClientHello in network traffic. The test tool is used for mutual conversion between abstract characters and specific protocol messages.

[0038] The existing TLS fingerprint information identification method generally adopts a method based on protocol packet payload analysis, which has the defects of coarse and fine granularity in fingerprint matching. The existing technology uses deep learning-based traffic fingerprint feature extraction, which needs to collect a large amount of real-world packets and needs a lot of data labeling and data training work. Moreover, the existing technology uses a single feature library-based fingerprint extraction method, which extracts redundant and long fingerprint information.

[0039] As Figure 3As shown, the TLS fingerprint information identification system based on finite state machines of the present invention includes at least: a model deduction module 200, a fingerprint extraction module 600, and a version identification module 300. The model deduction module 200 is provided with a first information transmission port capable of being connected to the message mapping module 100 via wired or wireless means. The model deduction module 200 is also provided with a second information transmission port capable of being connected to the state machine model library 400 via wired or wireless means.

[0040] The version identification module 300 is provided with a third information transmission port that can be connected to the message mapping module 100 via wired or wireless means. The version identification module 300 is provided with a fourth information transmission port that can be connected to the multi-level fingerprint pool 500 via wired or wireless means.

[0041] The fingerprint extraction module 600 is provided with at least one fifth information transmission port that can be connected to the state machine model library 400 and the multi-level fingerprint pool 500.

[0042] The state machine model library 400 and the multi-level fingerprint pool 500 are pre-built offline. This means that as many TLS implementation state machine models as possible should be pre-learned before fingerprint recognition to build the multi-level fingerprint pool. The quality of the state machine model library 400 and the multi-level fingerprint pool 500 directly affects the effectiveness of fingerprint recognition.

[0043] like Figure 3 As shown, the message mapping module 100 establishes connections with the model inference module 200 and the version identification module 300 via wired or wireless means, respectively. The model inference module 200 establishes connections with the state machine model library 400 via wired or wireless means. The version identification module 300 establishes connections with the multi-level fingerprint pool 500 via wired or wireless means. The state machine model library 400 and the multi-level fingerprint pool 500 are both connected to the fingerprint extraction module 600.

[0044] Preferably, the message mapping module 100 can also establish connections with the known TLS implementation module 700 and the unknown TLS implementation module 800 respectively via wired or wireless means.

[0045] The known TLS implementation module 700 is a module that pre-builds a virtual TLS environment. It interacts with the model derivation module 200 to pre-build or later extend and update the state machine model library 400 and the multi-level fingerprint pool 500. For example, the TLS implementation module 700 may be a server, processor, and / or dedicated integrated chip storing all versions of common TLS software libraries such as OpenSSL, GnuTLS, JSSE, miTLS, mbedTLS, and nss.

[0046] The unknown TLS implementation module 800 is usually a TLS software library module deployed on a network server in a real environment. The unknown TLS implementation module 800 identifies its TLS specific type and version by interacting with the version identification module 300. Since manufacturers usually use common TLS software libraries or develop custom TLS implementations based on open source software libraries, the protocol state machine therein does not change, so the method of the present application can be used for fingerprint information identification.

[0047] The model deduction module 200, the fingerprint extraction module 600 and the version identification module 300 can be respectively a dedicated integrated chip or a processor capable of running corresponding programs. The model deduction module 200 is a dedicated integrated chip or a processor capable of executing the model deduction method of the present application. The version identification module 300 is a dedicated integrated chip or a processor capable of executing the version identification method of the present application. The fingerprint extraction module 600 is a dedicated integrated chip or a processor capable of executing the fingerprint extraction method of the present application.

[0048] Preferably, the model deduction module 200, the fingerprint extraction module 600 and the version identification module 300 can also be integrated into a dedicated integrated chip or a processor capable of executing the model deduction method, the version identification method and the fingerprint extraction method of the present application.

[0049] The present application also includes at least one storage unit. The storage unit can be a storage hard disk, a magnetic medium, a chip, a processor and the like with storage function. The storage unit can be configured to include the state machine model storage library 400 storing the state machine model and the multi-level fingerprint pool 500 storing the multi-level fingerprint.

[0050] The state machine model library 400 and the multi-level fingerprint pool 500 can be arranged in respective independent storage units, or in a common storage unit.

[0051] The model deduction module 200 is used to deduce the state machine model of the target TLS implementation based on the mapping information sent by the message mapping module 100. The model deduction module 200 verifies whether the deduced state machine model represents the complete behavior of the target TLS implementation based on the equivalent query algorithm in the model verification unit 202; if the verification is successful, the deduced state machine model is stored in the state machine model library 400, and if the verification fails, the counterexample information is fed back to the model learning unit 201 to guide the re-deduction of the model until the verification is successful. Preferably, the model deduction module 200 includes at least the model learning unit 201 and the model verification unit 202. The model learning unit 201 is used to deduce the state machine model of the target TLS implementation according to the state machine learning algorithm. The model verification unit 202 is used to determine whether the deduced state machine model represents the complete behavior of the target TLS implementation.

[0052] The model learning unit 201 learns the state machine model of the target TLS implementation by observing the I / O behavior of the target TLS.

[0053] As shown in Figure 3 The message mapping module 100 includes at least a message mapping unit 101 and a state tracking unit 102.

[0054] The message mapping unit 101 is configured to map an abstract character message or a specific data packet to a specific data packet or an abstract character message according to current state information. The state tracking unit 102 is configured to maintain state information during interaction with the target TLS implementation.

[0055] Specifically, the message mapping unit 101 receives an abstract character message provided by the model learning unit 201, and constructs a corresponding type of TLS data packet based on the TLS protocol specification document and the state information stored in the state tracking unit 102. Alternatively, the message mapping unit 101 converts the message data packet fed back from the state tracking unit 102 into an abstract character message. That is, the message mapping unit 101 implements the mutual mapping of specific data packets and abstract character messages. The message mapping unit 101 is also configured to handle abnormal situations that may occur during state inference. Abnormal situations include, for example, no response caused by a crash of the system under test or a network connection that has been closed. The message mapping unit 101 maps such situations to corresponding TLS protocol specification messages.

[0056] Further, the state tracking unit 102 is responsible for maintaining state information related to the TLS connection, including session random numbers, key materials, encryption states, and the like, and handling abnormal situations, including timeout non-response, connection disconnection non-response, and the like.

[0057] Specifically, the state tracking unit 102 has two main functions: one is to provide the message mapping unit 101 with current protocol flow state information based on the TLS protocol specification, to assist in constructing TLS data packets and ensure that the values of specific fields of the data packets can reflect the state information of the target system. The second is to analyze the TLS data packets from the target system and extract key information from specific fields. Key information includes, for example, cipher suites, encryption algorithms, alert codes, and the like.

[0058] Based on the defects of the prior art, the TLS fingerprint information recognition method and system based on a finite state machine provided by the present application are provided with a model inference module 200. The model inference module 200 has different interaction logic based on a protocol software library, extracts protocol fingerprints by analyzing protocol state machines, and thus can identify fine-grained information of the protocol software library, with the effect of more accurately identifying the version of the server protocol implementation.

[0059] As shown in Figure 1 The model inference module 200 infers the state machine of the TLS protocol implementation in at least the following ways:

[0060] S11: The model learning unit 201 interacts with the target protocol implementation through the test unit 11 based on a state machine learning algorithm. The model learning unit 201 automatically sends a test request sequence based on a predefined input-output alphabet according to the active learning algorithm. The request sequence is composed of a series of related abstract character messages.

[0061] Active learning algorithm: Existing state machine learning algorithms are mainly divided into active learning and passive learning. Active learning obtains the information needed to construct a state machine by actively sending requests to the program under test, while passive learning uses existing data sets to construct a state machine. Compared with passive learning, active learning can provide a more complete behavior model of the program under test. Common active learning algorithms include Algorithm, TTT algorithm, etc.

[0062] Among them, the state machine learning technology adopted by the model learning unit 201 is based on the active learning algorithm of the open source model learning framework. The active learning algorithm defines two types of queries to collect information about the target protocol implementation: membership queries and equivalence queries. The state machine learning algorithm requires that deep state information of the target TLS implementation can be captured. Deep state information can be identified by observing the I / O of the target protocol implementation, combined with white-box or gray-box analysis methods.

[0063] Preferably, the model learning unit 201 generates a test request sequence according to the protocol state machine learning algorithm, or collects network traffic traces of the target TLS implementation. If the active learning algorithm is selected, the model learning unit 201 automatically sends a test request sequence according to a predefined input-output alphabet to perform state machine deduction.

[0064] If the passive learning algorithm is selected, the model learning unit 201 uses pre-collected network packet traces to perform state machine deduction. Determine whether the deduced state machine model represents the complete behavior of the target TLS implementation. If so, output the state machine model, extract the features of each state machine model, and perform clustering processing; otherwise, generate a new test request sequence and continue the next iteration to correct the state machine model.

[0065] The model learning unit 201 uses symbolic records based on the predefined input alphabet of the black box system 12 to construct such input sequences and execute them on the system under test. At the same time, capture the output of the black box system 12 to update the observation table of the active learning algorithm, and implement membership queries. After each membership query, it is necessary to check whether the observation table satisfies consistency and closure. If not, construct a new input sequence and continue the membership query; if so, generate a virtual state machine 14 and perform equivalence queries.

[0066] The implementation of the equivalence query relies on a consistency test algorithm in the model verification unit 202, such as the W-Method. If the virtual state machine 14 passes the consistency test of the model verification unit 202, it is the final output of the model inference module 200. Otherwise, the model verification unit 202 provides a counterexample information to the model learning unit 201 for further optimization of the virtual state machine 14. Repeat the above steps until the virtual state machine 14 passes the consistency test of the model verification unit 202.

[0067] The membership query is the core of the state machine learning algorithm. Common state machine learning algorithms include Angluin algorithm and TTT algorithm.

[0068] Compared with the prior art, the specific advantages of the inference step of the model inference module of the present application include: based on the protocol software library, different interaction logics are often used, and by analyzing the protocol state machine to extract the protocol fingerprint, the fine-grained information of the protocol software library can be identified, and the effect of identifying the implementation version of the server protocol is more accurate.

[0069] S12: In response to the test request sequence information issued by the model learning unit 201, the test unit 11 sends specific request sequence information to the black box system 12. The specific request sequence information is automatically mapped to an abstract request sequence by the test unit 11. The abstract request sequence represents the test request sequence generated by the active learning algorithm. The specific request sequence requires that the data packet structure and the field value are in compliance.

[0070] S21: The black box system 12 sends the specific request sequence information to the real state machine 14. The real state machine 14 performs state transition based on the sequence information and feeds back an output information sequence. Among them, the output information sequence received by the black box system 12 and the specific response sequence are constructed and returned to the test unit 11. The output information sequence is essentially the response of the target protocol implementation to a specific message sequence.

[0071] S22: The test unit 11 sends the automatically mapped specific response sequence to the model learning unit 201 for abstract response, so that the model learning unit 201 infers the behavior model of the target TLS implementation. The automatically mapped abstract message sequence and the specific data packet sequence require stateful interaction with the target TLS implementation. The automatically mapped abstract message sequence includes tracking cryptographic material and random numbers, generating keys, performing encryption and exception handling operations, etc.

[0072] The automatic mapping between abstract messages and concrete messages is implemented by a test tool. The test tool is designed and implemented based on an open-source key agreement software library, and is responsible for mapping concrete network packets to an abstract alphabet that can be processed by the system, thereby separating the model learning algorithm from the encryption and decryption algorithm, and effectively solving the problem of limited system performance and low test coverage caused by the complexity of the cryptographic algorithm and the statefulness of the cryptographic protocol.

[0073] The mapping requirement is a bijection, that is, each possible concrete message has and only has one abstract message corresponding to it.

[0074] It should be noted that abstracting the commonly used TLS protocol messages can effectively solve the problem of low efficiency caused by sending a large number of invalid messages in the state machine deduction process. The abstract input and output alphabet of the commonly used TLS protocol messages is shown in Table 1.

[0075] Table 1: Abstract input and output alphabet of commonly used TLS protocol messages

[0076]

[0077] S31: The model verification unit 202 terminates the member query, updates the observation table of the active learning algorithm in combination with multiple member queries, and generates a virtual state machine 14.

[0078] The model verification unit 202 judges and terminates the member query, and two conditions need to be met for generating the virtual state machine 14, which are: the current updated observation table satisfies the integrity, that is, each inferred state in the observation table is uniquely determined; and the current updated observation table satisfies the closure, that is, there will be no new unknown state in the current observation table.

[0079] S32: The model verification unit 202 uses an equivalence query algorithm to judge whether the deduced virtual state machine 14 can represent the complete behavior of the target black box system 12.

[0080] The equivalence query uses an approximate equivalence query algorithm for consistency detection. The principle is to compare the deduced virtual state machine 14 with the real state machine 13 implementation through a limited number of test queries. If a difference is found, an counterexample is output to describe the difference between the two, which is used to update the observation table and further optimize the virtual state machine 14, otherwise it is considered that the deduced virtual state machine 14 is sufficient to represent the behavior characteristics of the black box system 12.

[0081] The fingerprint extraction module 600 is used to parse the state machine model and extract the multi-level fingerprint of the target TLS implementation. Preferably, the fingerprint extraction module 600 at least includes: a model parsing unit 601 for extracting features of the state machine model and performing clustering processing; a model comparison unit 602 for comparing different categories of state machine models to obtain at least one fingerprint information in the first range, i.e., the first range fingerprint. A fingerprint extraction unit 603 is used to calculate the intersection of the comparison results of each category of state machine with the stored state machine, to obtain the fingerprint information in the second range, i.e., the second range fingerprint. Preferably, the model comparison unit 602 is used to compare different categories of state machine models.

[0082] The first range fingerprint: the unique path of the first state machine A compared with the second state machine B, i.e., the path set contained in the first state machine A but not contained in the second state machine B.

[0083] The second range fingerprint: the unique path of the first state machine A compared with all other known state machines, i.e., the path set contained in the first state machine A but not contained in other state machines in the state machine model library 400.

[0084] The model comparison unit 602 is used to compare different state machine models to obtain the first range fingerprint. Such comparison includes two objects, which are the first state machine A and the second state machine B. By comparing the first state machine A and the second state machine B, a number of path information that is only contained in the first state machine A but not contained in the second state machine B is obtained. The set of these path information is called the first range fingerprint of the first state machine A relative to the second state machine B. The set of first range fingerprints of the first state machine A relative to all other tested state machines obtained by this method is called the first range fingerprint set of the first state machine A.

[0085] The fingerprint extraction unit 603 is used to calculate the same part of the first range fingerprint set of the state machine to obtain the second range fingerprint. Taking the first range fingerprint set of the first state machine A as an example, the same part of each individual set in the set is the path information set that is only contained in the first state machine A and not contained in all other state machines. This same part is called the second range fingerprint of the first state machine A.

[0086] The state machine models are compared in pairs, and the comparison includes path information, node attributes, and edge attributes.

[0087] The steps of extracting features of the state machine model include:

[0088] The state machine is parsed into a special graph structure, and the number of nodes and edges, as well as the node attributes and edge attributes, are obtained. The starting node and the ending node are identified according to the graph structure information of the state machine, or the starting node and the ending node are manually specified. According to the starting node and the ending node, the path information of the state machine is calculated in combination with the graph traversal algorithm. The clustering processing is to assign the same state machine model to the same category.

[0089] Preferably, in the case where there is at least one category state machine model without fingerprint information, the fingerprint extraction unit 603 filters out the state machine model with the discovered fingerprint and feeds back a re-comparison instruction to the model comparison unit 602, otherwise, the fingerprint extraction unit 603 outputs all the fingerprints.

[0090] Some category state machines may need multiple filtering iterations to obtain fingerprints. The fingerprints extracted after multiple iterations are referred to as multi-level fingerprints. The fingerprints that can be extracted without filtering iterations are referred to as first-level fingerprints, and the level of the fingerprints is increased by one for each iteration.

[0091] Preferably, the fingerprint extraction module 600 comprises a fingerprint updating unit 604. The fingerprint updating unit 604 is configured to incrementally update the multi-level fingerprints.

[0092] The step of updating the fingerprints by the fingerprint updating unit 604 comprises at least: calculating the fingerprints of the target TLS implementation; updating all the existing fingerprints at the level according to the level of the fingerprint information; comparing the state machine models corresponding to the existing fingerprints at the level with the state machine model of the target TLS implementation respectively to obtain pairwise comparison results of each state machine model and the state machine of the target TLS implementation; and taking the intersection of the fingerprints of each state machine model and the pairwise comparison results as the updated fingerprints.

[0093] When a new TLS state machine model fingerprint is discovered, the existing multi-level fingerprints only need to be incrementally updated by the fingerprint updating unit, without the need for re-computation, thereby ensuring the scalability of the system.

[0094] Preferably, as shown in Figure 2 The application further provides a multi-level fingerprint extraction method, comprising the following steps:

[0095] S101: parsing the state machine model for feature clustering, at this time, the level is 0.

[0096] S102: extracting first-range fingerprint information based on the features.

[0097] S103: taking the intersection of the first-range fingerprints to calculate second-range fingerprint information,

[0098] S104: determining whether there is a fingerprint model, if there is a fingerprint model, a multi-level fingerprint is obtained. If there is no fingerprint model, the fingerprint level is increased by one, and the step S102 is returned.

[0099] The version identification module 300 is used for verifying the validity of the multi-level fingerprints and / or identifying the version information of the unknown TLS implementation.

[0100] Preferably, the version identification module 300 at least comprises a fingerprint matching unit 301 and a fingerprint verification unit 302. The fingerprint matching unit 301 is used for identifying the version information of the unknown TLS protocol implementation according to the multi-level fingerprints; and the fingerprint verification unit 302 is used for verifying the validity of the multi-level fingerprints.

[0101] Compared with the prior art method of extracting fingerprints based on a single feature library, the version identification module 300 and the fingerprint extraction module 600 of the present application adopt an extraction mechanism based on multi-level fingerprints, and perform clustering processing and comparative analysis on the fingerprint information, so that less packet sequences can be used when identifying the unknown TLS software library, the influence on the network environment is reduced as much as possible, and the concealment is better.

[0102] Preferably, the fingerprint verification unit verifies whether the multi-level fingerprints can effectively identify the version information by simulating a TLS implementation in a real world through random selection. The fingerprint verification unit randomly selects a TLS implementation of a certain version, automatically configures and deploys it as a Docker service, then performs fingerprint matching according to the multi-level fingerprint pool, and finally compares the version of the matched fingerprint with the version information of the Docker service. If they are the same, it is considered that the fingerprint is valid.

[0103] The multi-level fingerprint pool 500 is used for maintaining the multi-level fingerprint data of the known TLS implementation, and for sending the multi-level fingerprint information corresponding to the target TLS implementation to the version identification module 300 in response to the fingerprint request information sent by the version identification module 300.

[0104] The present application solves the problem that the existing network protocol identification method cannot identify fine-grained protocol information by deducing the state machine model of the TLS implementation and introducing a multi-level fingerprint extraction algorithm on this basis to identify the type and version information of the TLS implementation.

[0105] The present application also provides a TLS fingerprint information identification method based on a finite state machine, which at least comprises: deducing the state machine model of a target TLS implementation based on the mapping information sent by the message mapping module 100; analyzing the state machine model and extracting the multi-level fingerprints of the target TLS implementation; verifying the validity of the multi-level fingerprints and / or identifying the version information of the unknown TLS implementation.

[0106] The step of identifying the version information of the unknown TLS protocol implementation comprises:

[0107] From the first level fingerprint, a fingerprint request sequence is sent, and whether the response sequence of the to-be-tested protocol implementation is the same as the fingerprint response sequence is observed, if yes, the type version of the to-be-tested protocol implementation is the same as the type version of the state machine category to which the fingerprint belongs, otherwise the next fingerprint is verified, if no matching item is found in all first level fingerprints, whether there is a matching item in the second level fingerprint is verified, and the like, until the version information of the to-be-tested protocol implementation is identified.

[0108] Preferably, the method further comprises: calculating the fingerprint of the target TLS implementation; updating all existing fingerprints under the level according to the level of the fingerprint information; comparing the state machine model corresponding to each existing fingerprint under the level with the state machine model of the target TLS implementation respectively to obtain pairwise comparison results of each state machine model and the state machine of the target TLS implementation; and taking the intersection of the fingerprint of each state machine model and the pairwise comparison results as the updated fingerprint.

[0109] The TLS fingerprint extraction and version identification method based on finite state machine provided by the application does not need manual data labeling, the model deduction module, the message mapping module, the fingerprint extraction module and the version identification module are highly automated, thereby guaranteeing the ease of use of the system, and the fingerprint extraction efficiency is higher.

[0110] As known from the above description, the multi-level fingerprint method in the application extracts and clusters state machines, analyzes and compares them pairwise to find state machine fingerprints, filters the state machine models of the found fingerprints, iteratively performs the above steps, finally determines the fingerprints of all category state machine models, and realizes fine-grained version identification.

[0111] The application to application scenarios is as follows.

[0112] It is assumed that an attacker A wants to attack a network server S of a company. If the attacker A uses the traditional protocol fingerprint method, the attacker A needs to traverse the fingerprint library and send a large number of probe data packets to match and identify the protocol category of the network server S one by one, which is very easy to be found and intercepted by the network administrator of the company.

[0113] The TLS fingerprint identification system based on finite automata of the application enables the A to know the TLS protocol software library and the specific version of the network server S by sending only a few probe data packets through the multi-level fingerprint pool 500, and the efficiency is higher and the concealment is stronger. Further, the attacker A can perform targeted attacks on the network server S in combination with the TLS vulnerability library and the version information of the network server S.

[0114] As a defense party, the network server S can extract the fingerprint information of the deployed TLS software library by using the system of the application, and improve the system security by eliminating the fingerprint of the deployed TLS software library or combining the network firewall to perform targeted processing on the data packet sequence conforming to the fingerprint.

[0115] It should be noted that the above-mentioned embodiments illustrate rather than limit the application, and that those skilled in the art will be able to devise modifications which, though perhaps not explicitly described or shown herein, nonetheless fall within the scope of the application. Accordingly, the patent application includes all modifications encompassed within the scope of the claims and their equivalents. The patent application contains several inventive concepts, and the claims are intended to cover all such inventive concepts. The patent application contains several inventive concepts, and the claims are intended to cover all such inventive concepts. The patent application contains several inventive concepts, and the claims are intended to cover all such inventive concepts. The patent application contains several inventive concepts, and the claims are intended to cover all such inventive concepts. The patent application contains several inventive concepts, and the claims are intended to cover all such inventive concepts. The patent application contains several inventive concepts, and the claims are intended to cover all such inventive concepts. The patent application contains several inventive concepts, and the claims are intended to cover all such inventive concepts. The patent application contains several inventive concepts, and the claims are intended to cover all such inventive concepts. The patent application contains several inventive concepts, and the claims are intended to cover all such inventive concepts. The patent application contains several inventive concepts, and the claims are intended to cover all such inventive concepts. The patent application contains several inventive concepts, and the claims are intended to cover all such inventive concepts. The patent application contains several inventive concepts, and the claims are intended to cover all such inventive concepts. The patent application contains several inventive concepts, and the claims are intended to cover all such inventive concepts. The patent application contains several inventive concepts, and the claims are intended

Claims

1. A finite state machine based TLS fingerprint information identification system, characterized in that, It at least includes: The model deduction module (200) is used for deducing the state machine model of the target TLS implementation based on the mapping information sent by the message mapping module (100); The fingerprint extraction module (600) is used for analyzing the state machine model and extracting the multi-level fingerprint of the target TLS implementation; The version identification module (300) is used for verifying the validity of the multi-level fingerprint and / or identifying the version information of the unknown TLS implementation; Wherein, the fingerprint extraction module (600) includes a fingerprint updating unit (604), and the step of updating the fingerprint at least includes: calculating the fingerprint of the target TLS implementation; according to the level of the fingerprint information, updating all existing fingerprints in the level.

2. The finite state machine based TLS fingerprinting system of claim 1, wherein, The model deduction module (200) is connected with the state machine model library (400), The model deduction module (200) verifies whether the deduced state machine model represents the complete behavior of the target TLS implementation based on the equivalence query algorithm in the model verification unit (202); If the verification is successful, the deduced state machine model is stored in the state machine model library (400), and if the verification fails, the counterexample information is fed back to the model learning unit (201) to guide the re-deduction model until the verification is successful.

3. The finite state machine based TLS fingerprinting system of claim 2, wherein, The model deduction module (200) at least includes a model learning unit (201) and a model verification unit (202), The model learning unit (201) is used for deducing the state machine model of the target TLS implementation according to the state machine learning algorithm; The model verification unit (202) is used for judging whether the deduced state machine model represents the complete behavior of the target TLS implementation.

4. The finite state machine based TLS fingerprinting system of claim 3, wherein, The fingerprint extraction module (600) at least includes: The model analysis unit (601) is used for extracting the features of the state machine model and performing clustering processing; The model comparison unit (602) is used for comparing and analyzing different categories of state machine models to obtain at least one fingerprint information in the first range; The fingerprint extraction unit (603) is used for calculating the intersection of each category of state machine and the comparison result of the stored state machine to obtain the fingerprint information in the second range.

5. The finite state machine based TLS fingerprinting system of claim 4, wherein, In the case that a part of the state machine model has no fingerprint information, the fingerprint extraction unit (603) filters out the state machine model with the found fingerprint and feeds back the re-comparison instruction to the model comparison unit (602), Otherwise, the fingerprint extraction unit (603) outputs all the fingerprints.

6. The TLS fingerprint information identification system based on finite state machine according to claim 5, wherein The step of updating the fingerprint by the fingerprint updating unit (604) further includes: Comparing the state machine model corresponding to the existing fingerprint under the level with the state machine model of the target TLS implementation respectively to obtain the comparison result of each state machine model and the state machine of the target TLS implementation; Taking the intersection of the fingerprint of each state machine model and the comparison result as the updated fingerprint.

7. The finite state machine based TLS fingerprinting system of claim 6, wherein, The version identification module (300) at least includes a fingerprint matching unit (301) and a fingerprint verification unit (302), The fingerprint matching unit (301) is configured to identify version information of an unknown TLS protocol implementation according to the multi-level fingerprints; The fingerprint verification unit (302) is configured to verify validity of the multi-level fingerprints.

8. The finite state machine based TLS fingerprinting system of claim 7, wherein, The system further comprises a multi-level fingerprint pool (500), The multi-level fingerprint pool (500) is configured to maintain multi-level fingerprint data of known TLS implementations, and send multi-level fingerprint information corresponding to a target TLS implementation to the version identification module (300) in response to fingerprint request information sent by the version identification module (300).

9. A method for TLS fingerprint information recognition based on finite state machine, characterized in that, The method at least comprises: deriving a state machine model of a target TLS implementation based on mapping information sent by the message mapping module (100); parsing the state machine model and extracting multi-level fingerprints of the target TLS implementation; verifying validity of the multi-level fingerprints and / or identifying version information of an unknown TLS implementation; calculating a fingerprint of the target TLS implementation; updating all existing fingerprints at the level according to the level of the fingerprint information.

10. The finite state machine based TLS fingerprinting method of claim 9, wherein, The method further comprises: comparing state machine models corresponding to the existing fingerprints at the level respectively with a state machine model of the target TLS implementation to obtain pairwise comparison results of each state machine model and the state machine of the target TLS implementation; taking an intersection of the fingerprints of each state machine model and the pairwise comparison results as updated fingerprints.

Images