Method and apparatus for network traffic screening based on encrypted traffic

Abstract

The embodiment of the application discloses a network traffic screening method and device based on encrypted traffic, the method comprises the following steps: obtaining network traffic to be screened, and extracting communication application categories in the network traffic, then determining communication protocols of each communication application category; and screening each communication protocol based on a pre-created processing strategy, and inputting communication application categories corresponding to communication protocols meeting screening conditions into a screening result database; so that when the method is applied to encrypted traffic, the traffic method of large-flow white application communication can be screened out through behavior, feature and fingerprint comprehensive processing, and the traffic is discarded, thereby reducing the processing burden of network security equipment, improving the traffic screening capability, and solving the problem that the prior art cannot effectively filter encrypted traffic.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and specifically to a method and apparatus for filtering network traffic based on encrypted traffic. Background Technology

[0002] With increasing amounts of data being transmitted over networks, network bandwidth is growing exponentially, leading to a surge in data volume. Faced with this massive data load, network traffic inspection devices will encounter significant performance bottlenecks. This is especially true for network security devices with blocking capabilities, which require high responsiveness and high-volume processing power. Achieving rapid response and threat detection in the face of such high network traffic becomes a challenge. One approach is to filter out high-volume white-label application traffic while processing the main network traffic, thereby reducing the overhead of detection. Currently, traffic identification typically involves extracting plaintext features and using DPI (Distributed Point of View) technology for detection. However, with the increasing prevalence of encrypted traffic, existing feature-based detection methods cannot effectively extract and filter encrypted traffic, resulting in poor filtering performance and failing to significantly reduce the processing burden on network security devices.

[0003] Therefore, providing a network traffic filtering method and apparatus based on encrypted traffic to solve the problem that existing technologies cannot effectively filter encrypted traffic has become an urgent problem for those skilled in the art. Summary of the Invention

[0004] Therefore, embodiments of the present invention provide a network traffic filtering method and apparatus based on encrypted traffic, so as to at least partially solve the problem that the prior art cannot effectively filter encrypted traffic.

[0005] To achieve the above objectives, the embodiments of the present invention provide the following technical solutions:

[0006] This invention provides a network traffic filtering method based on encrypted traffic, the method comprising:

[0007] Obtain the network traffic to be filtered, and extract the traffic data from the network traffic;

[0008] The traffic data is parsed to determine the communication protocol of each traffic data.

[0009] The communication protocols are filtered based on a pre-created processing strategy, and the traffic data corresponding to the communication protocols that meet the filtering conditions are input into the filtering result database.

[0010] In some embodiments, the sources of the network traffic to be screened include at least one of the following:

[0011] Cloud storage, video player, music player, video conferencing, short video, live streaming, remote access, and webcam.

[0012] In some embodiments, the communication protocol for the traffic data includes:

[0013] HTTP protocol, TCP / UDP plaintext protocol, TCP / UDP encrypted protocol, and TLS protocol.

[0014] In some embodiments, the communication protocols are filtered based on a pre-created processing strategy, and the traffic data corresponding to the communication protocols that meet the filtering criteria are input into a filtering result database, specifically including:

[0015] When the communication protocol is HTTP protocol data, the communication protocol is input into a pre-created first deep packet detection feature library;

[0016] If the communication protocol matches the data results stored in the first deep packet inspection feature library, then the traffic data corresponding to the communication protocol is determined to meet the filtering conditions and is input into the filtering result database;

[0017] The first deep packet inspection feature library is created based on the extracted first plaintext feature string, which is extracted from traffic data samples with HTTP protocol as the communication protocol.

[0018] In some embodiments, the communication protocols are filtered based on a pre-created processing strategy, and the traffic data corresponding to the communication protocols that meet the filtering criteria are input into a filtering result database, specifically including:

[0019] When the communication protocol of the traffic data is plaintext data of TCP / UDP protocol, the communication protocol is input into a pre-created second deep packet detection feature library;

[0020] If the communication protocol matches the data results stored in the second deep packet inspection feature library, then the traffic data is determined to meet the filtering conditions and is input into the filtering result database;

[0021] The second deep packet inspection feature library is created based on the extracted second plaintext feature string, which is extracted from traffic data samples of plaintext data with TCP / UDP protocol.

[0022] In some embodiments, the communication protocols are filtered based on a pre-created processing strategy, and the traffic data corresponding to the communication protocols that meet the filtering criteria are input into a filtering result database, specifically including:

[0023] If the communication protocol is TCP / UDP protocol encrypted data, and the traffic data is determined to be P2P, then the traffic data meets the filtering conditions and is entered into the filtering result database;

[0024] If the communication protocol of the traffic data is not TCP / UDP protocol encrypted data, the traffic data is determined to be non-P2P, and the traffic data is input into the abnormal behavior identification module for further identification.

[0025] In some embodiments, the communication protocols are filtered based on a pre-created processing strategy, and the traffic data corresponding to the communication protocols that meet the filtering criteria are input into a filtering result database, specifically including:

[0026] When the communication protocol of the traffic data is TLS protocol data, the TLS protocol data is associated with DNS to obtain associated data;

[0027] If the associated data matches the pre-stored application DNS domain name database, then the traffic data is determined to meet the filtering conditions and is entered into the filtering result database;

[0028] The DNS certificate domain fingerprint, certificate CN, and SNI are matched with the certificate domain fingerprint in the TLS application signature library. If a match is found, a fuzzy match is performed between the certificate CN or SNI and the SNI and certificate CN in the TLS application signature library. If a match is found, the corresponding destination IP and destination port are added to the high-volume communication IP library. If a match is not found, the IP is sent to the P2P transport layer processing module.

[0029] The present invention also provides a network traffic filtering device based on encrypted traffic, the device comprising:

[0030] A data acquisition unit is used to acquire network traffic to be filtered and extract traffic data from the network traffic;

[0031] A protocol determination unit is used to parse each of the traffic data to determine the communication protocol of each of the traffic data;

[0032] The result filtering unit is used to filter each of the communication protocols based on a pre-created processing strategy, and input the traffic data corresponding to the communication protocols that meet the filtering conditions into the filtering result database.

[0033] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the method described above.

[0034] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the method described above.

[0035] The network traffic filtering method based on encrypted traffic provided by this invention obtains the network traffic to be filtered and extracts the traffic data from the network traffic; parses each traffic data to determine the communication protocol of each traffic data; filters each communication protocol based on a pre-created processing strategy, and inputs the traffic data corresponding to the communication protocols that meet the filtering conditions into a filtering result database; enabling this method, when applied to encrypted traffic, to filter out high-volume, white-label application communication traffic through comprehensive processing of behavior, features, and fingerprints, and discard these traffic, thereby reducing the processing burden of network security devices, improving traffic filtering capabilities, and solving the problem that existing technologies cannot effectively filter encrypted traffic. Attached Figure Description

[0036] To more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are merely exemplary, and those skilled in the art can derive other embodiments based on the provided drawings without creative effort.

[0037] The structures, proportions, sizes, etc. illustrated in this specification are only for the purpose of assisting those skilled in the art in understanding and reading the content disclosed herein, and are not intended to limit the conditions under which the present invention can be implemented. Therefore, they have no substantial technical significance. Any modifications to the structure, changes in the proportions, or adjustments to the size, without affecting the effects and objectives that the present invention can produce, should still fall within the scope of the technical content disclosed in the present invention.

[0038] Figure 1 This is one of the flowcharts illustrating the network traffic filtering method based on encrypted traffic provided by the present invention;

[0039] Figure 2 This is the second flowchart illustrating the network traffic filtering method based on encrypted traffic provided by the present invention.

[0040] Figure 3 This is the third flowchart illustrating the network traffic filtering method based on encrypted traffic provided by the present invention.

[0041] Figure 4 This is a schematic diagram of the network traffic filtering device based on encrypted traffic provided by the present invention.

[0042] Figure 5This is a schematic diagram of the physical structure of the electronic device provided by the present invention. Detailed Implementation

[0043] The following specific embodiments illustrate the implementation of the present invention. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0044] First, the following explanations are provided for the technical terms involved in this invention:

[0045] HTTP: Hypertext Transfer Protocol (HTTP) is a simple request-response protocol that typically runs on top of TCP. It specifies what messages a client might send to a server and what responses it might receive.

[0046] TCP / UDP Plaintext: In the TCP / IP network architecture, TCP (Transmission Control Protocol) and UDP (User Datagram Protocol) are the two most important protocols at the transport layer, providing communication reliability for upper-layer users. TCP / UDP plaintext means that the payload portion of the protocol transmission is not encrypted.

[0047] TCP / UDP ciphertext: In the TCP / IP network architecture, TCP (Transmission Control Protocol) and UDP (User Datagram Protocol) are the two most important protocols at the transport layer, providing communication reliability for upper-layer users. TCP / UDP plaintext refers to the encryption of the payload portion of the protocol transmission.

[0048] SNI: SNI (Server Name Indication) is an extension of TLS that allows the client to tell the hostname of the server it is connecting to at the start of the handshake process.

[0049] TLS (Transport Layer Security), and its predecessor Secure Sockets Layer (SSL), is a security protocol designed to provide security and data integrity for internet communications.

[0050] CN: Common Name (CN). The common name is used to specify the host or server identifier. When a client attempts to connect to a remote server (such as an HTTP server), it first obtains the server's SSL certificate, then compares the hostname or domain name to be connected with the common name provided in the SSL certificate. If they match, the SSL certificate is used to encrypt the connection.

[0051] Certificate Qualified Domain Fingerprint: The hash value is calculated by concatenating the issuer's CN (Common Name), C (Country), S (State / Provice), and L (Locality) and the user's CN (Common Name), C (Country), S (State / Provice), and L (Locality) in the x509 certificate into a string and then using the SHA1 algorithm.

[0052] DNS (Domain Name System) is a service on the Internet. As a distributed database that maps domain names to IP addresses, it makes it easier for people to access the Internet.

[0053] P2P: Peer-to-peer (P2P) is a technology that enables direct communication between different hosts on a network.

[0054] x509 is a format standard for public key certificates in cryptography.

[0055] SHA-1: SHA-1 (Secure Hash Algorithm 1) is a cryptographic hash function designed by the U.S. National Security Agency and published as a Federal Data Processing Standard (FIPS) by the National Institute of Standards and Technology (NIST). SHA-1 generates a 160-bit (20-byte) hash value called a message digest, which is typically represented as 40 hexadecimal digits.

[0056] To address the difficulty of filtering large amounts of encrypted traffic in existing technologies, this invention provides a network traffic filtering method based on encrypted traffic to improve the effectiveness of network traffic filtering.

[0057] Please refer to Figure 1 , Figure 1 This is one of the flowcharts illustrating the network traffic filtering method based on encrypted traffic provided by the present invention.

[0058] In one specific embodiment, the network traffic filtering method based on encrypted traffic provided by the present invention includes the following steps:

[0059] S110: Obtain the network traffic to be filtered and extract the traffic data from the network traffic; wherein, the sources of the network traffic to be filtered include cloud storage, video players, music players, video conferencing, short videos, live streaming, remote access and webcams, etc.

[0060] S120: Parse each of the traffic data to determine the communication protocol of each of the traffic data; for example, the communication protocol of the traffic data includes HTTP protocol, TCP / UDP plaintext protocol, TCP / UDP encrypted protocol and TLS protocol.

[0061] S130: Based on a pre-created processing strategy, the communication protocols are filtered, and the traffic data corresponding to the communication protocols that meet the filtering criteria are input into the filtering result database. Different processing strategies can be selected for different types of communication protocols to improve the accuracy of the filtering results.

[0062] In some embodiments, such as Figure 2 As shown, the communication protocols are filtered based on a pre-created processing strategy, and the communication application categories corresponding to the communication protocols that meet the filtering criteria are input into the filtering result database. Specifically, this includes:

[0063] S210: If the communication protocol of the traffic data is HTTP protocol data, input the communication protocol into the pre-created first deep packet inspection feature library;

[0064] S220: If the communication protocol matches the data results stored in the first deep packet detection feature library, then the throughput data is determined to meet the filtering conditions and is input into the filtering result database;

[0065] The first deep packet inspection feature library is created based on the extracted first plaintext feature string, which is extracted from traffic data samples with HTTP protocol as the communication protocol.

[0066] In practical use cases, there may be situations where the communication traffic fails to match the data results stored in the first deep packet inspection feature library. When the match fails, the corresponding traffic data can be input into the P2P identification module. If the communication application category corresponding to the traffic data is determined to be P2P, then the traffic data is determined to meet the filtering conditions and input into the filtering result database.

[0067] In some embodiments, the traffic data is filtered based on a pre-created processing strategy, and the traffic data corresponding to the communication protocols that meet the filtering criteria are input into the filtering result database, specifically including:

[0068] When the communication protocol of the traffic data is plaintext data of TCP / UDP protocol, the communication protocol of the traffic data is input into a pre-created second deep packet detection feature library;

[0069] If the communication protocol of the traffic data matches the data results stored in the second deep packet inspection feature library, then the traffic data is determined to meet the filtering conditions and is input into the filtering result database;

[0070] The second deep packet inspection feature library is created based on the extracted second plaintext feature string, which is extracted from traffic data samples of plaintext data with TCP / UDP protocol.

[0071] In practical applications, there may be situations where the traffic data fails to match the data results stored in the second deep packet inspection feature library. When the match fails, the corresponding traffic data can be input into the P2P identification module. If the traffic data is determined to be P2P, then the traffic data is determined to meet the filtering conditions and input into the filtering result database.

[0072] When creating the first / second deep packet inspection feature library, it is first necessary to collect high-volume network traffic. High-volume network traffic typically includes video and cloud storage downloads. By selecting high-volume network traffic from these applications, the processing scope can be reduced and the problem can be addressed more specifically. After acquiring the network traffic, the communication protocols of various network traffic types can be extracted, yielding application layer protocols such as HTTP and HTTPS, and transport layer protocols such as TCP and UDP. At the transport layer, the encryption of the payload can be categorized into TCP / UDP plaintext transmission and TCP / UDP encrypted transmission. This protocol classification allows for the construction of different feature libraries for different protocols, serving as the basis for matching different categories of applications to be identified.

[0073] Furthermore, the process of filtering the communication protocols based on a pre-created processing strategy, and inputting the traffic data corresponding to the communication protocols that meet the filtering criteria into the filtering result database, also includes:

[0074] If the communication protocol is TCP / UDP encrypted data, and the traffic data is determined to be P2P, then the traffic data meets the filtering conditions and is input into the filtering result database. If the communication protocol of the traffic data is not TCP / UDP encrypted data, then the traffic data is determined to be non-P2P, and the traffic data is input into the abnormal behavior identification module for further identification.

[0075] The abnormal behavior identification module is used to further identify traffic that was not identified in the above process. Specifically, for the same IP, the uplink and downlink traffic transmission ratio within 3 minutes is statistically analyzed. If the uplink and downlink ratio is between 40% and 60%, it enters the flow duration behavior identification; if the flow duration is more than 10 minutes, it enters the next step of traffic size statistical behavior identification; if it meets the first two steps of detection and the total uplink and downlink traffic size exceeds 10MB within 3 minutes, the source IP, source port, destination IP, and destination port are added to the high-traffic communication IP database.

[0076] When the communication protocol of the communication application category is TLS protocol data, the TLS protocol data is associated with DNS to obtain associated data; if the associated data matches the pre-stored application DNS domain name database, the communication application category is determined to meet the filtering conditions and is input into the filtering result database.

[0077] In this way, different methods are used to solve problems for different protocols. Communication application categories are mainly divided into plaintext and ciphertext. Plaintext protocols can be directly analyzed to obtain communication characteristics and then detected through feature matching.

[0078] To facilitate understanding, the implementation process of the method provided by this invention will be briefly described below using a specific application scenario as an example. For example... Figure 3 As shown, after the network traffic to be identified enters the traffic device, it undergoes traffic protocol parsing. Based on the protocol format, the required traffic can be categorized into HTTP, TCP, UDP, and TLS protocols for separate processing. For TCP and UDP protocols, further verification is needed to determine whether they are encrypted protocols. This determination of whether TCP and UDP are encrypted protocols uses the information entropy method. After this protocol analysis, the traffic can be divided into TCP / UDP plaintext traffic and TCP / UDP encrypted traffic.

[0079] HTTP protocol data and TCP / UDP protocol plaintext data are matched against the deep packet inspection feature library and then enter the detection stage. Successfully matched data has its corresponding protocol, destination IP, and destination port stored in the high-volume communication IP library and applied to the device for real-time discarding. Data that does not match proceeds to the next stage, the P2P transport layer processing module.

[0080] Encrypted protocols can be processed during the handshake phase, primarily the TLS protocol, using filtering and screening from the perspectives of certificates and SNIs. When no characteristics are found, traffic can be processed based on behaviors such as flow duration, flow uplink / downlink ratio, and flow payload size. Specifically, TLS protocol data is associated with DNS and matched against the application DNS domain name database. Successful matches add the corresponding destination IP and port to the high-volume communication IP database. The DNS certificate's domain fingerprint, certificate CN, and SNI are matched against the certificate domain fingerprint in the TLS application signature database. Successful matches then use either the certificate CN or SNI to perform a fuzzy match against the SNI and certificate CN in the TLS application signature database. Successful matches add the corresponding destination IP and port to the high-volume communication IP database. Unsuccessful matches proceed to the next stage, the P2P transport layer processing module.

[0081] In the P2P transport layer identification module, within 3 minutes, it is determined whether the IP pair is simultaneously transmitting using both TCP and UDP protocols. If both are present, the destination IP and destination port are added to the high-volume communication IP database, which serves as the filtering result database.

[0082] In the above specific embodiments, the network traffic filtering method based on encrypted traffic provided by the present invention obtains the network traffic to be filtered and extracts the traffic data from the network traffic; parses each of the traffic data to determine the communication protocol of each of the traffic data; filters each of the communication protocols based on a pre-created processing strategy, and inputs the traffic data corresponding to the communication protocols that meet the filtering conditions into the filtering result database; so that when the method is applied to encrypted traffic, it can filter out the traffic of large-volume white application communication through comprehensive processing of behavior, features, and fingerprints, and discard these traffic, thereby reducing the processing burden of network security devices, improving traffic filtering capabilities, and solving the problem that the prior art cannot effectively filter encrypted traffic.

[0083] In addition to the methods described above, the present invention also provides a network traffic filtering device based on encrypted traffic, such as... Figure 4 As shown, the device includes:

[0084] The data acquisition unit 401 is used to acquire the network traffic to be filtered and extract the traffic data from the network traffic;

[0085] Protocol determination unit 402 is used to parse each of the traffic data to determine the communication protocol of each of the traffic data;

[0086] The result filtering unit 403 is used to filter each of the communication protocols based on a pre-created processing strategy, and input the traffic data corresponding to the communication protocols that meet the filtering conditions into the filtering result database.

[0087] In some embodiments, the network traffic filtering device further includes an abnormal behavior identification module, which is used to continue identifying communication protocols that are not identified as P2P when the communication protocol of the communication application category is TCP / UDP protocol encrypted data.

[0088] In some embodiments, the sources of the network traffic to be screened include at least one of the following:

[0089] Cloud storage, video player, music player, video conferencing, short video, live streaming, remote access, and webcam.

[0090] In some embodiments, the communication protocol for the traffic data includes:

[0091] HTTP protocol, TCP / UDP plaintext protocol, TCP / UDP encrypted protocol, and TLS protocol.

[0092] In some embodiments, the communication protocols are filtered based on a pre-created processing strategy, and the traffic data corresponding to the communication protocols that meet the filtering criteria are input into a filtering result database, specifically including:

[0093] When the communication protocol is HTTP protocol data, the communication protocol is input into a pre-created first deep packet detection feature library;

[0094] If the communication protocol matches the data results stored in the first deep packet inspection feature library, then the traffic data corresponding to the communication protocol is determined to meet the filtering conditions and is input into the filtering result database;

[0095] The first deep packet inspection feature library is created based on the extracted first plaintext feature string, which is extracted from traffic data samples with HTTP protocol as the communication protocol.

[0096] In some embodiments, the communication protocols are filtered based on a pre-created processing strategy, and the traffic data corresponding to the communication protocols that meet the filtering criteria are input into a filtering result database, specifically including:

[0097] When the communication protocol of the traffic data is plaintext data of TCP / UDP protocol, the communication protocol is input into a pre-created second deep packet detection feature library;

[0098] If the communication protocol matches the data results stored in the second deep packet inspection feature library, then the traffic data is determined to meet the filtering conditions and is input into the filtering result database;

[0099] The second deep packet inspection feature library is created based on the extracted second plaintext feature string, which is extracted from traffic data samples of plaintext data with TCP / UDP protocol.

[0100] In some embodiments, the communication protocols are filtered based on a pre-created processing strategy, and the traffic data corresponding to the communication protocols that meet the filtering criteria are input into a filtering result database, specifically including:

[0101] If the communication protocol is TCP / UDP protocol encrypted data, and the traffic data is determined to be P2P, then the traffic data meets the filtering conditions and is entered into the filtering result database;

[0102] If the communication protocol of the traffic data is not TCP / UDP protocol encrypted data, the traffic data is determined to be non-P2P, and the traffic data is input into the abnormal behavior identification module for further identification.

[0103] In some embodiments, the communication protocols are filtered based on a pre-created processing strategy, and the traffic data corresponding to the communication protocols that meet the filtering criteria are input into a filtering result database, specifically including:

[0104] When the communication protocol of the traffic data is TLS protocol data, the TLS protocol data is associated with DNS to obtain associated data;

[0105] If the associated data matches the pre-stored application DNS domain name database, then the traffic data is determined to meet the filtering conditions and is entered into the filtering result database;

[0106] The DNS certificate domain fingerprint, certificate CN, and SNI are matched with the certificate domain fingerprint in the TLS application signature library. If a match is found, a fuzzy match is performed between the certificate CN or SNI and the SNI and certificate CN in the TLS application signature library. If a match is found, the corresponding destination IP and destination port are added to the high-volume communication IP library. If a match is not found, the IP is sent to the P2P transport layer processing module.

[0107] In the above specific embodiments, the network traffic filtering device based on encrypted traffic provided by the present invention acquires the network traffic to be filtered and extracts the traffic data from the network traffic; parses each of the traffic data to determine the communication protocol of each of the traffic data; filters each of the communication protocols based on a pre-created processing strategy, and inputs the traffic data corresponding to the communication protocols that meet the filtering conditions into the filtering result database; enabling the device to filter out the traffic of large-volume white application communication methods through comprehensive processing of behavior, features, and fingerprints when applied to encrypted traffic, and discard these traffic, thereby reducing the processing burden of network security equipment, improving traffic filtering capability, and solving the problem that the prior art cannot effectively filter encrypted traffic.

[0108] Figure 5 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 5 As shown, the electronic device may include a processor 510, a communications interface 520, a memory 530, and a communication bus 540, wherein the processor 510, the communications interface 520, and the memory 530 communicate with each other through the communication bus 540. The processor 510 can call logical instructions in the memory 530 to execute the above-described method.

[0109] Furthermore, the logical instructions in the aforementioned memory 530 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0110] On the other hand, the present invention also provides a computer program product, the computer program product including a computer program stored on a non-transitory computer-readable storage medium, the computer program including program instructions, and when the program instructions are executed by a computer, the computer is able to perform the methods described above.

[0111] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the methods described above.

[0112] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0113] Those skilled in the art will recognize that, in one or more of the examples above, the functions described in this invention can be implemented using a combination of hardware and software. When applied as software, the corresponding functions can be stored in a computer-readable medium or transmitted as one or more instructions or code on a computer-readable medium. Computer-readable media include computer storage media and communication media, wherein communication media include any medium that facilitates the transmission of computer programs from one place to another. Storage media can be any available medium that can be accessed by a general-purpose or special-purpose computer.

[0114] The above specific embodiments further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made on the basis of the technical solution of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method of network traffic screening based on encrypted traffic, the method comprising: The method comprises: acquiring network traffic to be screened and extracting traffic data in the network traffic; parsing each of the traffic data to determine a communication protocol of each of the traffic data; screening each of the communication protocols based on a pre-created processing strategy, and inputting traffic data corresponding to a communication protocol meeting a screening condition into a large-traffic communication IP library; in a case where the communication protocol of the traffic data is ciphertext data, determining that the traffic data is P2P, and then determining that the traffic data meets the screening condition and is input into the large-traffic communication IP library; or determining that the traffic data is non-P2P, and then inputting the traffic data into an abnormal behavior recognition module for further recognition.

2. The method of claim 1, wherein, The source of the network traffic to be screened comprises at least one of the following: a network disk, a video player, a music player, a video conference, a short video, a live broadcast, remote access, and a network camera.

3. The method of claim 1, wherein, The communication protocol of the traffic data comprises: an HTTP protocol, a TCP / UDP plaintext protocol, a TCP / UDP ciphertext protocol, and a TLS protocol.

4. The method of claim 3, wherein, The screening of each of the communication protocols based on the pre-created processing strategy and the input of traffic data corresponding to a communication protocol meeting a screening condition into the large-traffic communication IP library specifically comprise: in a case where the communication protocol is HTTP protocol data, inputting the communication protocol into a pre-created first deep packet inspection feature library; if the communication protocol and data stored in the first deep packet inspection feature library match successfully, determining that traffic data corresponding to the communication protocol meets the screening condition and inputting the traffic data into the large-traffic communication IP library; wherein the first deep packet inspection feature library is created according to a first plaintext feature string extracted from traffic data samples in which the communication protocol is HTTP protocol data.

5. The method of claim 3, wherein, The screening of each of the communication protocols based on the pre-created processing strategy and the input of traffic data corresponding to a communication protocol meeting a screening condition into the large-traffic communication IP library specifically comprise: in a case where the communication protocol of the traffic data is TCP / UDP protocol plaintext data, inputting the communication protocol into a pre-created second deep packet inspection feature library; if the communication protocol of the traffic data and data stored in the second deep packet inspection feature library match successfully, determining that the traffic data meets the screening condition and inputting the traffic data into the large-traffic communication IP library; wherein the second deep packet inspection feature library is created according to a second plaintext feature string extracted from traffic data samples in which the communication protocol is TCP / UDP protocol plaintext data.

6. The method of claim 3, wherein, The screening of each of the communication protocols based on the pre-created processing strategy and the input of traffic data corresponding to a communication protocol meeting a screening condition into the large-traffic communication IP library specifically comprise: in a case where the communication protocol of the traffic data is TCP / UDP protocol ciphertext data, determining that the traffic data is P2P, and then determining that the traffic data meets the screening condition and is input into the large-traffic communication IP library; In a case where the communication protocol of the traffic data is not TCP / UDP protocol cipher data, it is determined that the traffic data is non-P2P, and the traffic data is input into an abnormal behavior recognition module for further recognition.

7. The method of claim 3, wherein the encrypted traffic based network traffic screening is performed by a network device. Each of the communication protocols is screened based on a pre-created processing strategy, and traffic data corresponding to a communication protocol meeting a screening condition is input into a large-traffic communication IP library, specifically including: In a case where the communication protocol of the traffic data is TLS protocol data, DNS certificate domain fingerprint, certificate CN, and SNI are matched with certificate domain fingerprint in a TLS application feature library, and in a case where the matching is unsuccessful, the traffic data is input into a P2P transmission layer for recognition.

8. A network traffic screening device based on encrypted traffic, characterized in that, The apparatus includes: a data acquisition unit configured to acquire network traffic to be screened, and extract traffic data in the network traffic; a protocol determination unit configured to analyze each of the traffic data to determine a communication protocol of each of the traffic data; a result screening unit configured to screen each of the communication protocols based on a pre-created processing strategy, and input traffic data corresponding to a communication protocol meeting a screening condition into a large-traffic communication IP library; In a case where the communication protocol of the traffic data is cipher data, it is determined that the traffic data is P2P, and it is determined that the traffic data meets the screening condition and is input into the large-traffic communication IP library; and in a case where the traffic data is non-P2P, the traffic data is input into an abnormal behavior recognition module for further recognition.

9. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor implements the steps of the method according to any one of claims 1 to 7 when executing the program.

10. A non-transitory computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program implements the steps of the method according to any one of claims 1 to 7 when executed by the processor.

Images