An HTTPS encrypted traffic analysis method
By using an IO multiplexing server model and man-in-the-middle certificate replacement technology, the problem of difficult analysis of HTTPS encrypted traffic is solved, enabling the decryption and analysis of HTTPS traffic and ensuring the compliance and monitoring of testing activities.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- CHINA INFOMRAITON CONSULTING & DESIGNING INST CO LTD
- Filing Date
- 2023-08-18
- Publication Date
- 2026-06-02
AI Technical Summary
There is currently no effective method for collecting and analyzing HTTPS encrypted traffic, making it difficult to audit testing activities.
By employing an IO multiplexing server model and man-in-the-middle certificate replacement technology, HTTPS traffic is decrypted by creating a traffic forwarding client and a collection server, and then parsed using a rule engine.
It enables the decryption and analysis of HTTPS encrypted traffic, ensuring the compliance and monitoring of testing activities, and solving the problem of the difficulty in analyzing HTTPS traffic.
Smart Images
Figure CN116866079B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to a traffic analysis method, and more particularly to a method for analyzing HTTPS encrypted traffic. Background Technology
[0002] In the process of cybersecurity attack and defense and penetration testing, in order to prevent core systems and assets from being damaged during the testing process, it is often necessary to audit the testing behavior of testers. By collecting and analyzing test traffic, the behavior of testers can be monitored and traced to ensure compliance. However, HTTPS traffic is encrypted during transmission, making it difficult to analyze and posing challenges to auditing the testing behavior of testers.
[0003] There is currently no effective method for collecting and analyzing HTTPS encrypted traffic. Summary of the Invention
[0004] Purpose of the invention: The technical problem to be solved by the present invention is to provide a method for analyzing HTTPS encrypted traffic, which addresses the shortcomings of the existing technology.
[0005] To address the aforementioned technical problems, this invention discloses an HTTPS encrypted traffic analysis method for analyzing user client traffic, comprising the following steps:
[0006] Step 1: Based on the IO multiplexing server model, create a traffic forwarding client and a traffic collection server. The traffic forwarding client is set up in the user client and is used to forward the user client's traffic. The traffic collection server includes traffic collection service, connection service, certificate service, and traffic encryption / decryption service.
[0007] Furthermore, the specific process for creating the traffic forwarding client is as follows:
[0008] The traffic forwarding client creates a SOCKET socket based on the configuration information of the traffic collection server. After the socket is successfully created, it sends a connection request to the traffic collection server. The configuration information includes the IP address and port information of the traffic collection server.
[0009] Furthermore, the creation of the traffic collection server includes creating collection services, connection services, certificate services, and traffic encryption / decryption services.
[0010] Furthermore, the creation of the traffic collection service involves listening for connection requests from traffic forwarding clients and distributing the detected connection requests, as detailed below:
[0011] Upon receiving the first connection request, the connection request is dispatched to the connection service for processing, and a connection is established with the traffic forwarding client through the connection service;
[0012] When the target address in the connection request is accessed for the first time, the connection request is dispatched to the certificate service for processing;
[0013] Apart from the above situations, in other connection requests, the traffic to the target address will be distributed to the traffic encryption / decryption service for processing.
[0014] Furthermore, the aforementioned connection creation service involves processing connection requests from traffic forwarding clients and establishing connections with them.
[0015] Furthermore, the certificate creation service is used to maintain man-in-the-middle certificates and target address certificates, as detailed below:
[0016] When a request to access the target address is received for the first time, the certificate service accesses the target address, obtains the target address's certificate, and simultaneously sends the man-in-the-middle certificate that has been pre-imported into the certificate service back to the traffic forwarding client.
[0017] Furthermore, the aforementioned traffic encryption / decryption service is used to decrypt and encrypt encrypted traffic, as detailed below:
[0018] Upon receiving encrypted traffic from the traffic forwarding client, the system first decrypts the traffic using a man-in-the-middle certificate, then encrypts the decrypted traffic using the target address certificate, and finally sends it to the target address.
[0019] Once traffic is received from the target address, the target address certificate is used to decrypt the traffic, then the decrypted traffic is encrypted using a man-in-the-middle certificate, and finally sent back to the browser client.
[0020] Step 2: Create a man-in-the-middle certificate and import it into the certificate service and traffic encryption / decryption service in the traffic collection server;
[0021] Furthermore, the aforementioned man-in-the-middle certificate is an 11-tuple:
[0022] <version,serialNumber,signatureAlgorithm,issuer,validityPeriod,subjectName,publicKey,issuerID,subjectID,extensions,signature> ;
[0023] Wherein, version is the specific version number of the man-in-the-middle certificate; serialNumber represents the unique identifier of the man-in-the-middle certificate; signatureAlgorithm represents the signature algorithm of the man-in-the-middle certificate; issuer represents the name of the issuer of the man-in-the-middle certificate; validityPeriod represents the validity period of the man-in-the-middle certificate; subjectName represents the entity that owns the certificate key; publicKey represents the public key and the ID of the algorithm using the public key; IssuerID is used to uniquely identify the issuer of the certificate; subjectID is used to uniquely identify the subject of the certificate; extensions are used to represent the extended information of the certificate; and signature represents the signature of the certificate.
[0024] Step 3: Create a traffic queue and a traffic consumption service. The traffic queue serves as the carrier of decrypted traffic, and the traffic consumption service retrieves the decrypted traffic from the traffic queue for processing.
[0025] Furthermore, the aforementioned traffic queue is used to store the decrypted client traffic.
[0026] Furthermore, the traffic consumption service is used to monitor the traffic queue. When there is traffic in the traffic queue, the traffic consumption service retrieves the traffic from the queue and pushes it to the rule engine for processing.
[0027] Step 4: The connection service in the traffic server processes the connection request of the traffic forwarding client, enabling the traffic forwarding client to establish a connection with the traffic collection server. The traffic of the user's browser client is sent to the traffic collection service through the traffic forwarding client.
[0028] When a user client accesses the target address for the first time, the certificate service responds, accesses the target address to obtain the target address's certificate, and returns the man-in-the-middle certificate to the browser client.
[0029] Step 5: After obtaining the man-in-the-middle certificate, the browser client encrypts the traffic that continues to operate on the browser client and sends it to the traffic collection service through the traffic forwarding client. The traffic encryption and decryption service processes the traffic, decrypts the encrypted traffic using the man-in-the-middle certificate, and then encrypts the decrypted traffic using the target address certificate before pushing it to the target address for access. At the same time, it is pushed to the traffic queue for processing.
[0030] Step 6: After the client accesses the target address, the target address sends information back to the client. The traffic encryption and decryption service decrypts the encrypted traffic sent by the target address using the target address's certificate, then encrypts it again using the man-in-the-middle certificate, and then sends it back to the browser client.
[0031] Step 7: Create a rule engine and import traffic analysis rules;
[0032] Step 8: The traffic consumption service retrieves the decrypted traffic from the traffic queue, pushes it to the rule engine for analysis to obtain traffic analysis results, and completes the HTTPS encrypted traffic analysis.
[0033] Beneficial effects:
[0034] This invention decrypts HTTPS traffic by introducing an IO multiplexing server model and man-in-the-middle certificate replacement technology, and on this basis, it constructs a rule engine to parse HTTPS encrypted traffic. Attached Figure Description
[0035] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments, and the advantages of the present invention in the above and / or other aspects will become clearer.
[0036] Figure 1 This is a schematic diagram of the overall process of the present invention. Detailed Implementation
[0037] This invention introduces an IO multiplexing server model in the process of collecting and analyzing HTTPS encrypted traffic, decrypts HTTPS traffic through man-in-the-middle certificate replacement technology, and parses HTTPS encrypted traffic by building a rule engine.
[0038] This invention proposes an HTTPS encrypted traffic analysis method, namely, an HTTPS encrypted traffic analysis method based on an I / O multiplexing server model and man-in-the-middle certificate replacement technology, such as... Figure 1 As shown, it specifically includes:
[0039] Step 1: Create a traffic forwarding client and a traffic collection server based on the IO multiplexing server model. The traffic collection server includes traffic collection service, connection service, certificate service, and traffic encryption / decryption service. The specific creation process is as follows:
[0040] Step 1-1: Create a traffic forwarding client.
[0041] The traffic forwarding client creates a SOCKET socket based on the server configuration information. After the socket is successfully created, it sends a connection request to the traffic collection server. The server configuration information includes the server's IP address and port information.
[0042] Steps 1-2: Create a traffic collection service. The traffic collection service is responsible for listening for connections and distributing the received connection requests. When the first connection request is received, it will be distributed to the connection service for processing, and a connection will be established with the traffic forwarding client through the connection service. When the first access to the target address is received, the connection request will be distributed to the certificate service for processing. Except for the first connection request and the first access to the target address, subsequent access traffic to the target address will be distributed to the traffic encryption and decryption service for processing.
[0043] Steps 1-3: Create a connection service. The connection service is responsible for processing connection requests from traffic forwarding clients and establishing connections with them.
[0044] Steps 1-4 involve creating a certificate service, which is responsible for maintaining the man-in-the-middle certificate and the target address certificate. When a request to access the target address for the first time is received, the certificate service accesses the target address, obtains the target address's certificate, and simultaneously sends the man-in-the-middle certificate, which has been pre-imported into the certificate service, back to the traffic forwarding client.
[0045] Steps 1-5: Create a traffic encryption / decryption service. This service is responsible for decrypting encrypted traffic. When traffic is received from a traffic forwarding client, it is decrypted using a man-in-the-middle certificate, and then encrypted using the target address certificate before being sent to the target address. When traffic is received from the target address, it is decrypted using the target address certificate, and then encrypted using a man-in-the-middle certificate before being sent back to the browser client.
[0046] Step 2: Create a man-in-the-middle certificate and import it into the certificate service and traffic encryption / decryption service;
[0047] A man-in-the-middle certificate is an 11-tuple. <version,serialNumber,signatureAlgorithm,issuer,validityPeriod,subjectName,publicKey,issuerID,subjectID,extensions,signature> Where version is the specific version number of the man-in-the-middle certificate; serialNumber represents the unique identifier of the man-in-the-middle certificate; signatureAlgorithm represents the signature algorithm of the man-in-the-middle certificate; issuer represents the name of the issuer of the man-in-the-middle certificate; validityPeriod represents the validity period of the man-in-the-middle certificate; subjectName represents the entity that owns the certificate key; publicKey represents the public key and the ID of the algorithm using the public key; IssuerID is used to uniquely identify the issuer of the certificate; subjectID is used to uniquely identify the subject of the certificate; extensions are used to represent the extended information of the certificate; and signature represents the signature of the certificate.
[0048] Step 3: Create a traffic queue and a traffic consumption service. The traffic queue serves as the carrier of decrypted traffic, and the traffic consumption service retrieves the decrypted traffic from the traffic queue for processing.
[0049] The traffic queue is used to store decrypted client traffic; the traffic consumption service to which it belongs is denoted as , which listens to the traffic queue information. When there is traffic in the traffic queue, the traffic consumption service retrieves the traffic from the queue and pushes it to the rule engine for processing.
[0050] Step 4: The connection service in the traffic server processes the connection request of the traffic forwarding client, enabling the traffic forwarding client to establish a connection with the traffic collection server. The user's traffic in the browser client is sent to the traffic collection service through the traffic forwarding client. On the first access, the certificate service responds to the target address, accesses the target address to obtain the target address's certificate, and returns the man-in-the-middle certificate to the browser client.
[0051] Step 5: After obtaining the man-in-the-middle certificate, the browser client continues to operate on the browser client. The traffic is then sent to the traffic collection service through the traffic forwarding client. The traffic encryption and decryption service processes the traffic, using the man-in-the-middle certificate to decrypt the encrypted traffic. The decrypted traffic is then encrypted using the target address certificate and pushed to the target address for access. At the same time, it is pushed to the traffic queue for parsing.
[0052] Step 6: When the target address sends back information, the traffic encryption / decryption service decrypts the encrypted traffic sent from the target address using the target address's certificate, then encrypts it again using the man-in-the-middle certificate before sending it back to the browser client.
[0053] Step 7: Create a rule engine and import traffic analysis rules based on the characteristics of the attack traffic;
[0054] Step 8: The traffic consumption service retrieves the decrypted traffic from the traffic queue and pushes it to the rule engine for analysis to obtain traffic analysis results.
[0055] Example:
[0056] In one embodiment of an HTTPS encrypted traffic analysis method, the following steps are employed:
[0057] Step 1: Create a traffic forwarding client and a traffic collection server based on the IO multiplexing server model. The traffic collection server includes traffic collection service, connection service, certificate service, and traffic encryption / decryption service. The specific creation process is as follows:
[0058] Step 1-1: Create a traffic forwarding client.
[0059] The traffic forwarding client creates a SOCKET socket based on the server configuration information. After the socket is successfully created, it sends a connection request to the traffic collection server. The server configuration information includes the server's IP address and port information.
[0060] Steps 1-2 involve creating a traffic collection service. This service listens for connections and distributes incoming connection requests. Upon receiving the first connection request, it is forwarded to the connection service for processing, which then establishes a connection with the traffic forwarding client. Upon receiving the first access to a target address, the connection request is forwarded to the certificate service for processing. Subsequent accesses to the target address, except for the initial connection request and the first access, are forwarded to the traffic encryption / decryption service. The traffic collection service primarily consists of two functional modules: connection listening (as shown in Table 1) and request distribution (as shown in Table 2).
[0061] Table 1 Connection Listening Module Table
[0062] Module function Connection listening Module features Abstract classes / interfaces ClassName(objectName) selectConnection
[0063] Table 2 Request Distribution Module Table
[0064] Module function Request dispatch Module Features Abstract classes / interfaces ClassName(objectName) dispatchRequest
[0065] Steps 1-3: Create a connection service, as shown in Table 3. The connection service is responsible for processing connection requests from traffic forwarding clients and establishing connections with them.
[0066] Table 3 Connection Service Table
[0067] Module function Connection service Module Features Abstract classes / interfaces ClassName(objectName) acceptConnection
[0068] Steps 1-4 involve creating a certificate service, as shown in Table 4. The certificate service is responsible for maintaining the man-in-the-middle certificate and the target address certificate. When a request to access the target address for the first time is received, the certificate service accesses the target address, obtains the target address's certificate, and simultaneously sends the man-in-the-middle certificate, which has been pre-imported into the certificate service, back to the traffic forwarding client.
[0069] Table 4 Certificate Service Table
[0070] Module function Certificate Services Module Features Abstract classes / interfaces ClassName(objectName) certificateService
[0071] Steps 1-5 involve creating a traffic encryption / decryption service. This service is responsible for decrypting encrypted traffic. When traffic is received from a traffic forwarding client, it is decrypted using a man-in-the-middle certificate, and then encrypted again using the target address certificate before being sent to the target address. Conversely, when traffic is received from the target address, it is decrypted using the target address certificate, and then encrypted again using a man-in-the-middle certificate before being sent back to the browser client. The traffic encryption / decryption service includes a traffic encryption service (as shown in Table 1) and a traffic decryption service (as shown in Table 2).
[0072] Table 1 Traffic Encryption Service
[0073] Module function Traffic encryption service Module Features Abstract classes / interfaces ClassName(objectName) encryptionService
[0074] Table 2 Traffic Decryption Service
[0075] Module function Traffic decryption service Module Features Abstract classes / interfaces ClassName(objectName) decryptionService
[0076] Step 2: Create a man-in-the-middle certificate and import it into the certificate service and traffic encryption / decryption service;
[0077] A man-in-the-middle certificate is an 11-tuple. <version,serialNumber,signatureAlgorithm,issuer,validityPeriod,subjectName,publicKey,issuerID,subjectID,extensions,signature> Where version is the specific version number of the man-in-the-middle certificate; serialNumber represents the unique identifier of the man-in-the-middle certificate; signatureAlgorithm represents the signature algorithm of the man-in-the-middle certificate; issuer represents the name of the issuer of the man-in-the-middle certificate; validityPeriod represents the validity period of the man-in-the-middle certificate; subjectName represents the entity that owns the certificate key; publicKey represents the public key and the ID of the algorithm using the public key; IssuerID is used to uniquely identify the issuer of the certificate; subjectID is used to uniquely identify the subject of the certificate; extensions are used to represent the extended information of the certificate; and signature represents the signature of the certificate.
[0078] In one embodiment, it is defined as follows:
[0079] public class Intermediarycertificate
[0080] {
[0081] Int serialNumber;
[0082] String version;
[0083] String signatureAlgorithm;
[0084] String issuer;
[0085] String validityPeriod;
[0086] String subjectName;
[0087] int publicKey;
[0088] Int IssuerID;
[0089] String subjectID;
[0090] String subjectID;
[0091] String extensions;
[0092] String signature;
[0093] }
[0094] Step 3: Create a traffic queue and a traffic consumption service. The traffic queue serves as the carrier of decrypted traffic, and the traffic consumption service retrieves the decrypted traffic from the traffic queue for processing.
[0095] The traffic queue is used to store decrypted client traffic; the traffic consumption service listens to the traffic queue information, and when there is traffic in the traffic queue, the traffic consumption service retrieves the traffic from the queue and pushes it to the rule engine for processing.
[0096] Step 4: The connection service in the traffic server processes the connection request of the traffic forwarding client, enabling the traffic forwarding client to establish a connection with the traffic collection server. The user's traffic in the browser client is sent to the traffic collection service through the traffic forwarding client. On the first access, the certificate service responds to the target address, accesses the target address to obtain the target address's certificate, and returns the man-in-the-middle certificate to the browser client.
[0097] Step 5: After obtaining the man-in-the-middle certificate, the browser client continues to operate on the browser client. The traffic is then sent to the traffic collection service through the traffic forwarding client. The traffic encryption and decryption service processes the traffic, using the man-in-the-middle certificate to decrypt the encrypted traffic. The decrypted traffic is then encrypted using the target address certificate and pushed to the target address for access. At the same time, it is pushed to the traffic queue for parsing.
[0098] Step 6: When the target address sends back information, the traffic encryption / decryption service decrypts the encrypted traffic sent from the target address using the target address's certificate, then encrypts it again using the man-in-the-middle certificate before sending it back to the browser client.
[0099] Step 7: Create a rule engine and import traffic analysis rules based on the characteristics of the attack traffic. Each traffic analysis rule contains twelve tuples: <title, id, status, description, reference, author, date, modified, tags, category, selection, level>. The analysis rules are defined as follows: title (name of the analysis rule); id (unique identifier of the analysis rule); status (current status of the analysis rule, whether it is disabled); description (description of the analysis rule); reference (reference information); author (creator of the analysis rule); date (creation time of the analysis rule); modified (modification time of the analysis rule); tags (tags of the analysis rule); category (type of attack or vulnerability corresponding to the analysis rule, such as path_traversal for directory traversal attacks); selection (key fields included in the analysis rule, such as '*.. / *', '.. / .. / .. / .. / .. / etc / passwd', '.. / .. / .. / .. / windows / ', '.. / .. / .. / .. / .. / lib / password', etc.); and level (level of the attack behavior corresponding to the analysis rule, divided into low, medium, and high levels).
[0100] Step 8: The traffic consumption service retrieves the decrypted traffic from the traffic queue and pushes it to the rule engine for analysis to obtain traffic analysis results.
[0101] Step 8-1: The traffic consumption service retrieves the decrypted traffic from the traffic queue. Below is an example of decrypted traffic that made an access request to the target address's path: / go / add-on / business-continuity / api / plugin?folderName=&pluginName=.. / .. / .. / .. / .. / .. / .. / .. / etc / passwd. In one embodiment, the following method is used:
[0102] GET / go / add-on / business-continuity / api / plugin?folderName=&pluginName=.. / .. / .. / .. / .. / .. / .. / .. / etc / passwd
[0103] cookie: device_id=539ea923076a1b6c; FO_RFLP=%7CaHR0cDovL2NvZGUuNTEuY29tL0VpT2VTTnBoQ1Joa251T1hydlNB%7C%7C%7C; device_id=539ea923076a1b6c
[0104] host: xxx.com
[0105] accept-encoding: gzip
[0106] accept: * / *
[0107] user-agent: Mozilla / 5.0 (Windows NT 10.0; rv:78.0) Gecko / 20100101Firefox / 78.0
[0108] Step 8-2: After the traffic consumption service obtains the decrypted traffic, it pushes the decrypted traffic to the rule engine for analysis to obtain traffic analysis results. The man-in-the-middle certificate is an 8-tuple <timeStamp, ip, domain, requestType, url, threatenType, stateCode>, where timeStamp indicates the time of the traffic request; ip indicates the IP address of the requested target; domain indicates the domain name of the requested target; url indicates the path of the requested target; threatType indicates the type of traffic threat; and stateCode indicates the status code of the request.
[0109] The request path conforms to the path traversal rules in the rule engine. In one embodiment, the parsing result obtained after parsing by the rule engine is as follows:
[0110] <?xml version="1.0"?>
[0111] <timestamp> 1790060780< / timestamp>
[0112] <ip> 10.8.4.22< / ip>
[0113] <domain> 10.8.4.22< / domain>
[0114] <requesttype> GET< / requesttype>
[0115] <url> / go / add-on / business-continuity / api / plugin?folderName=&pluginName=.. / .. / .. / .. / .. / .. / .. / .. / etc / passwd< / url>
[0116] <threatentype>path_traversal< / threatenType >
[0117] <statecode> 400< / statecode>
[0118] In its specific implementation, this application provides a computer storage medium and a corresponding data processing unit. The computer storage medium is capable of storing a computer program, which, when executed by the data processing unit, can run the invention's content regarding an HTTPS encrypted traffic analysis method and some or all of the steps in various embodiments. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.
[0119] Those skilled in the art will clearly understand that the technical solutions in the embodiments of the present invention can be implemented using computer programs and their corresponding general-purpose hardware platforms. Based on this understanding, the technical solutions in the embodiments of the present invention, or the parts that contribute to the prior art, can be embodied in the form of computer programs, i.e., software products. These computer program software products can be stored in a storage medium and include several instructions to cause a device containing a data processing unit (which may be a personal computer, server, microcontroller, MUU, or network device, etc.) to execute the methods described in various embodiments or certain parts of the embodiments of the present invention.
[0120] This invention provides an idea and method for HTTPS encrypted traffic analysis. Many methods and approaches exist for implementing this technical solution; the above description is merely a preferred embodiment of the invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of this invention, and these improvements and modifications should also be considered within the scope of protection of this invention. All components not explicitly stated in this embodiment can be implemented using existing technologies.< / threatentype>
Claims
1. A method for analyzing HTTPS encrypted traffic, used to analyze the traffic of user clients, characterized in that, Includes the following steps: Step 1: Based on the IO multiplexing server model, create a traffic forwarding client and a traffic collection server. The traffic forwarding client is set up in the user client and is used to forward the user client's traffic. The traffic collection server includes traffic collection service, connection service, certificate service, and traffic encryption / decryption service. Step 2: Create a man-in-the-middle certificate and import it into the certificate service and traffic encryption / decryption service in the traffic collection server; Step 3: Create a traffic queue and a traffic consumption service. The traffic queue serves as the carrier of decrypted traffic, and the traffic consumption service retrieves the decrypted traffic from the traffic queue for processing. Step 4: The connection service in the traffic collection server processes the connection request of the traffic forwarding client, enabling the traffic forwarding client to establish a connection with the traffic collection server. The traffic of the user's browser client is sent to the traffic collection service through the traffic forwarding client. When a user client accesses the target address for the first time, the certificate service responds, accesses the target address to obtain the target address's certificate, and returns the man-in-the-middle certificate to the browser client; Step 5: After obtaining the man-in-the-middle certificate, the browser client encrypts the traffic that continues to operate on the browser client and sends it to the traffic collection service through the traffic forwarding client. The traffic encryption and decryption service processes the traffic, decrypts the encrypted traffic using the man-in-the-middle certificate, and then encrypts the decrypted traffic using the target address certificate before pushing it to the target address for access. At the same time, it is pushed to the traffic queue for processing. Step 6: After the browser client accesses the target address, the target address sends information back to the browser client. The traffic encryption and decryption service decrypts the encrypted traffic sent by the target address using the target address's certificate, then encrypts it again using the man-in-the-middle certificate, and then sends it back to the browser client. Step 7: Create a rule engine and import traffic analysis rules based on the characteristics of the attack traffic. Each traffic analysis rule contains twelve tuples: <title, id, status, description, reference, author, date, modified, tags, category, selection, level>. Here, `title` represents the name of the analysis rule; `id` is the unique identifier of the analysis rule; `status` indicates whether the analysis rule is currently disabled; `description` represents the description of the analysis rule; `reference` identifies the reference information of the analysis rule; `author` indicates the creator of the analysis rule; `date` indicates the creation time of the analysis rule; `modified` indicates the modification time of the analysis rule; `tags` identifies the tags of the analysis rule; `category` indicates the type of attack or vulnerability corresponding to this analysis rule; `selection` represents the key fields contained in the analysis rule; and `level` indicates the level of the attack behavior corresponding to the analysis rule. Step 8: The traffic consumption service retrieves the decrypted traffic from the traffic queue, pushes it to the rule engine for analysis to obtain traffic analysis results, and completes the HTTPS encrypted traffic analysis.
2. The HTTPS encrypted traffic analysis method according to claim 1, characterized in that, The specific process for creating the traffic forwarding client described in step 1 is as follows: The traffic forwarding client creates a SOCKET socket based on the configuration information of the traffic collection server. After the socket is successfully created, it sends a connection request to the traffic collection server. The configuration information includes the IP address and port information of the traffic collection server.
3. The HTTPS encrypted traffic analysis method according to claim 2, characterized in that, The creation of the traffic collection server mentioned in step 1 refers to the creation of collection service, connection service, certificate service, and traffic encryption / decryption service.
4. The HTTPS encrypted traffic analysis method according to claim 3, characterized in that, The creation of the traffic collection service mentioned in step 1 involves listening for connection requests from traffic forwarding clients and distributing the detected connection requests, as detailed below: Upon receiving the first connection request, the connection request is dispatched to the connection service for processing, and a connection is established with the traffic forwarding client through the connection service; When the target address in the connection request is accessed for the first time, the connection request is dispatched to the certificate service for processing; Apart from the above situations, in other connection requests, the traffic to the target address will be distributed to the traffic encryption / decryption service for processing.
5. The HTTPS encrypted traffic analysis method according to claim 4, characterized in that, The connection creation service mentioned in step 1 refers to processing the connection requests from the traffic forwarding client and establishing a connection with the traffic forwarding client.
6. The HTTPS encrypted traffic analysis method according to claim 5, characterized in that, The certificate service creation mentioned in step 1 is used to maintain man-in-the-middle certificates and target address certificates, as detailed below: When a request to access the target address is received for the first time, the certificate service accesses the target address, obtains the target address's certificate, and simultaneously sends the man-in-the-middle certificate that has been pre-imported into the certificate service back to the traffic forwarding client.
7. The HTTPS encrypted traffic analysis method according to claim 6, characterized in that, The traffic encryption / decryption service described in step 1 is used to decrypt and encrypt encrypted traffic, as detailed below: Upon receiving encrypted traffic from the traffic forwarding client, the system first decrypts the traffic using a man-in-the-middle certificate, then encrypts the decrypted traffic using the target address certificate, and finally sends it to the target address. Once traffic is received from the target address, the target address certificate is used to decrypt the traffic, then the decrypted traffic is encrypted using a man-in-the-middle certificate, and finally sent back to the browser client.
8. The HTTPS encrypted traffic analysis method according to claim 7, characterized in that, The man-in-the-middle certificate mentioned in step 2 is an 11-tuple: <version,serialNumber,signatureAlgorithm,issuer,validityPeriod,subjectName,publicKey,issuerID,subjectID,extensions,signature> ; Wherein, version is the specific version number of the man-in-the-middle certificate; serialNumber represents the unique identifier of the man-in-the-middle certificate; signatureAlgorithm represents the signature algorithm of the man-in-the-middle certificate; issuer represents the name of the issuer of the man-in-the-middle certificate; validityPeriod represents the validity period of the man-in-the-middle certificate; subjectName represents the entity that owns the certificate key; publicKey represents the public key and the ID of the algorithm using the public key; IssuerID is used to uniquely identify the issuer of the certificate; subjectID is used to uniquely identify the subject of the certificate; extensions are used to represent the extended information of the certificate; and signature represents the signature of the certificate.
9. The HTTPS encrypted traffic analysis method according to claim 8, characterized in that, The traffic queue mentioned in step 3 is used to store the decrypted client traffic.
10. The HTTPS encrypted traffic analysis method according to claim 9, characterized in that, The traffic consumption service described in step 3 is used to monitor the traffic queue. When there is traffic in the traffic queue, the traffic consumption service retrieves the traffic from the queue and pushes it to the rule engine for processing.