A web application system identification method, device and readable storage medium

Abstract

The application provides a web application system identification method, device and readable storage medium, and belongs to the technical field of networks.The method comprises the following steps: collecting SSL certificate information and domain names in network traffic, and classifying web application systems according to the domain names to generate a classification result; collecting and analyzing web data traffic in the network traffic, counting behavior information parameters of each web application system by executing a behavior information parameter extraction process, generating behavior information fingerprints of each web application system by using a behavior information coding process, and constructing a behavior information database; obtaining target traffic to be identified; counting communication behavior information fingerprints of the target traffic; comparing the communication behavior information fingerprints with the behavior information fingerprints in the behavior information database, and determining matching degrees of the behavior information fingerprints of each web application system; and determining the web application system to which the target traffic to be identified belongs according to the matching degrees.

Description

Technical Field

[0001] This invention relates to the field of network technology, and more specifically to a web application system identification method, apparatus, and readable storage medium. Background Technology

[0002] With the rapid development of the internet, network security and management have become increasingly important and urgent, with network traffic analysis and identification technology being a key task in this field. The internet's growth has led to a surge in the number of web application systems, and more and more of these systems are using HTTPS to ensure secure data transmission. While HTTPS is highly effective at encrypting data, it also presents challenges for network traffic identification and analysis.

[0003] Traditional traffic analysis methods primarily rely on detecting features in network traffic, including port signature detection, application protocol type detection, and packet payload content detection, to identify different applications. However, with the widespread adoption of encrypted communication (HTTPS), traditional traffic analysis methods have clearly demonstrated insufficient identification capabilities. Firstly, because the payload content of encrypted HTTPS traffic is encrypted, traditional methods cannot directly access the packet content. Secondly, while traditional methods rely on port and protocol detection, encrypted traffic typically shares the same ports and protocols, making it difficult to reliably distinguish between different applications.

[0004] In recent years, machine learning-based feature training methods have been introduced to analyze network traffic. These methods primarily utilize large amounts of traffic data for training, learning application characteristics, vectorizing them, and summarizing traffic models for different applications to distinguish between them. However, these methods have also revealed some problems in practice. For example, they require a large amount of labeled training data, and the data samples need to be continuously updated and labeled to keep pace with application version updates. Obtaining a large amount of labeled feature data and keeping up with application version updates can be quite difficult. Summary of the Invention

[0005] To address the above problems, the present invention aims to provide a web application system identification method, apparatus, and readable storage medium. By utilizing bypass access to an existing network and mirroring its network traffic, different web application systems can be distinguished by analyzing the certificates of the web application systems and their communication behavior.

[0006] To achieve the above objectives, this invention provides the following technical solution: a web application system identification method, comprising: Capture network traffic of web application systems using bypass redirection; Collect SSL certificate information and domain names from network traffic, identify the company that registered the domain name, classify web application systems based on the domain name, and generate classification results; Collect and analyze web data traffic in network traffic, and statistically analyze the behavioral information parameters of each web application system by executing a behavioral information parameter extraction process; Based on the behavioral information parameters, a behavioral information fingerprint is generated for each web application system using a behavioral information encoding process. A behavioral information database is constructed using the classification results and behavioral information fingerprints of each web application system. Obtain the target traffic to be identified; Extract the domain name information from the target traffic, calculate the communication behavior information parameters of the target traffic by executing the behavior information parameter extraction process, and generate the communication behavior information fingerprint using the behavior information encoding process; The domain name information and communication behavior fingerprint of the target traffic are compared with the behavior fingerprint in the behavior information database to determine the matching degree between the communication behavior fingerprint and the behavior fingerprint of each web application system. The web application system to which the target traffic belongs is determined based on the matching degree.

[0007] Furthermore, the process of collecting SSL certificate information and domain names from network traffic, identifying the company registering the domain names, and classifying web application systems based on the domain names to generate classification results includes: Use network packet capture technology to capture SSL protocol traffic; Extract the SSL certificate from the captured traffic and obtain the domain information from it; Based on the domain name information, query the company information that registered the domain name; Based on the company information, identify the web application system released by the company; Based on the domain name information, all web application systems are categorized and associated with the domain name information.

[0008] Furthermore, the behavioral information parameters include: The average duration of a single data stream link, link type, request-response interval, range of communication traffic for requests, range of communication traffic for responses, average communication traffic for requests, and average communication traffic for responses.

[0009] Furthermore, the behavioral information parameter extraction process includes: Identify the type of a single data stream; If a single data stream is a connectionless UDP stream, record the duration for which the upstream and downstream of the data stream have the same information, and calculate the average duration of the recorded duration within a preset period as the average duration of a single data stream connection; If a single data stream is a connection-oriented TCP stream, the time point with the SYN flag is taken as the starting point, and the time point with the FIN or RST flag is taken as the ending point to determine the connection duration of a single data stream; the average connection duration of a single data stream within a preset period is calculated as the average connection duration of a single data stream. Identify real-time communication methods in web data traffic; If the TCP or UDP connection resources established last time are reused every time the web application system is accessed, the connection type is a long connection; if the connection information is different each time it is accessed, the connection type is a short connection. Record the response message time T1 and request message sending time T2 of a single data stream. Calculate the interval T between the request and response for each data stream using the formula T = T1 - T2. Calculate the average interval T between the request and response for each data stream within a preset period, and use this as the request-response interval. Statistically analyze the maximum, minimum, and average values ​​of the request message payload to determine the range and average value of the requested communication traffic. The maximum, minimum, and average values ​​of the response message payload are statistically analyzed to determine the range and average communication traffic of the response.

[0010] Furthermore, the behavior information encoding process includes: The behavioral information is encoded using the following format to generate a behavioral information fingerprint, web_sig. web_sig=avg_time(±N)|conn_type|trans_delay(±N)|request_min-request_max|request_avg(±N)|response_min-response_max|response_avg(±N); Where | is the separator, the parentheses contain error parameters, avg_time is the average duration of a single data stream connection, conn_type is the connection type, trans_delay is the request-response interval, request_min - request_max is the range of communication traffic for requests, response_min - response_max is the range of communication traffic for responses, request_avg is the average communication traffic for requests, and response_avg is the average communication traffic for responses.

[0011] Furthermore, the step of constructing a behavioral information database using the classification results and behavioral information fingerprints of each web application system includes: A web application system that stores domain name information and the association of each domain name; Based on the web application system behavior represented by each behavioral information fingerprint, the behavioral information fingerprint is associated with and stored with the web application system; Establish a behavior information database using a three-level directory structure that incorporates domain name information, web application systems, and behavior information fingerprints.

[0012] Furthermore, the step of comparing the domain name information and communication behavior fingerprint of the target traffic with the behavior fingerprint in the behavior information database, and determining the matching degree between the communication behavior fingerprint and the behavior fingerprint of each web application system, includes: Based on the domain information of the target traffic, search for the same domain information in the behavior information database to determine the web application system associated with the domain information of the target traffic, which serves as the matching range; The communication behavior information fingerprint is compared and matched with all behavior information fingerprints within the matching range, and the matching results are recorded. Using the formula P=n / N, the matching degree P between the communication behavior information fingerprint and the behavior information fingerprint of each web application system is calculated. Where N is the total number of behavioral information fingerprints for any web application system, and n is the number of matching communication behavioral information fingerprints among all behavioral information fingerprints in that web application system.

[0013] Furthermore, determining the web application system to which the target traffic to be identified belongs based on the matching degree includes: When the matching degree between the behavioral information fingerprint of any web application system and the communication behavioral information fingerprint is greater than 80%, then the web application system is the web application system to which the target traffic to be identified belongs.

[0014] Accordingly, the present invention discloses a web application system identification device, comprising: Memory is used to store the web application system identification program; A processor is configured to implement the steps of the web application system identification method described above when executing the web application system identification program.

[0015] Accordingly, the present invention discloses a readable storage medium storing a web application system identification program, wherein when the web application system identification program is executed by a processor, it implements the steps of the web application system identification method described in any of the above descriptions.

[0016] Compared with the prior art, the beneficial effects of the present invention are as follows: The present invention discloses a web application system identification method, device and readable storage medium. Based on people's browsing and use habits of a type of product and the protocol characteristics of the product itself, it cleverly abstracts information such as people's browsing speed, browsing duration, click frequency and the amount of reply content into the behavioral information fingerprint of the web application system for identification. Combined with the SSL certificate information captured in the traffic and the analysis of the behavioral characteristics of the application system traffic, the web application system is identified.

[0017] This invention differs from traditional feature recognition methods in that it cannot identify HTTPS encrypted traffic and does not require the cumbersome investment of extensive training and labeling of machine learning features. Compared to existing technologies, the advantages of this invention are: 1. Lightweight, requiring no extensive feature labeling and easy integration; 2. Strong compatibility, applicable to any network topology, and can serve as an extension to supplement existing technologies; 3. It solves the problem of encrypted traffic identification to a certain extent.

[0018] This invention can be applied to product fields that require application identification, such as network security detection, traffic management, and business monitoring.

[0019] Therefore, it is evident that the present invention has outstanding substantive features and significant progress compared with the prior art, and the beneficial effects of its implementation are also obvious. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0021] Figure 1 This is a flowchart illustrating a specific embodiment of the present invention.

[0022] Figure 2 This is a structural diagram of a device according to a specific embodiment of the present invention.

[0023] In the diagram, 101 is the processor; 102 is the memory; 103 is the input interface; 104 is the output interface; 105 is the communication unit; 106 is the keyboard; 107 is the display; and 108 is the mouse. Detailed Implementation

[0024] like Figure 1 As shown in the figure, this embodiment provides a web application system identification method, including the following steps: S1: Capture network traffic of web application systems using bypass redirection.

[0025] It is important to note that this method uses a bypass network access approach to obtain network traffic. Bypass network access means that it does not intrude into the existing network structure, does not act as an intermediary proxy, and does not affect the existing network structure. It simply involves bypassing the existing network and mirroring its network traffic for analysis.

[0026] S2: Collect SSL certificate information and domain names from network traffic, determine the company that registered the domain name, classify web application systems based on the domain name, and generate classification results.

[0027] In a specific implementation, this step includes: collecting SSL certificate information and domain names, identifying the company that registered the domain name, and classifying web application product information.

[0028] Collecting SSL certificate information and domain names: First, use network packet capture technology to capture SSL protocol traffic. Then, extract the SSL certificate and obtain the domain name information from the captured traffic.

[0029] Determine the company that registered the domain name: Use the domain name information extracted by S to query the company information that registered the domain name. This query can be performed through pre-crawl or online API.

[0030] Classify web application system product information: Based on the domain names of different companies, associate each company's domain name with its released web application system products and classify them, that is, which web application systems each domain name should correspond to.

[0031] S3: Collects and analyzes web data traffic in network traffic, and performs statistical analysis of behavioral information parameters for each web application system by executing a behavioral information parameter extraction process.

[0032] The behavioral information parameters include: the average duration of a single data stream link, link type, request-response interval duration, request communication traffic range, response communication traffic range, average request communication traffic, and average response communication traffic.

[0033] In this step, traffic analysis technology is used to extract information from the traffic of each web application system by executing a behavioral information parameter extraction process. The specific extraction process is as follows: 1. Extraction of the average duration of a single data flow link: First, it is necessary to identify the type of a single data stream. Specifically, this includes two types: connectionless UDP streams and connectionless TCP streams.

[0034] When a single data stream is a connectionless UDP stream: the source IP, destination IP, source port, and destination port have the same information in both upstream and downstream as the identification criteria. The duration of the same information in both upstream and downstream of a single data stream is counted, and then the average duration of the single data stream connection is extracted by taking the average of the statistical period.

[0035] When a single data stream is a connection-oriented TCP stream: similarly, the duration of a single data stream connection is calculated by counting the time from the start of the SYN flag to the end of the FIN or RST flag, according to the source IP, destination IP, source port, and destination port. Then, the average duration of a single data stream connection can be extracted by taking the average of the statistical periods.

[0036] 2. Determining the link type: The connection type refers to whether the web application system uses a long connection or a short connection for instant communication. A long connection means that the web application system reuses the TCP or UDP connection resources established last time for each access, while a short connection means that the connection information is different each time it is accessed.

[0037] 3. Extraction of the request-response interval: Record the response message time T1 and request message sending time T2 for each data stream. Calculate the interval T between the request and response for each data stream using the formula T = T1 - T2. Take the average value of the statistical period as the request-response interval.

[0038] 4. Extracting the range of request and response communication traffic sizes: Traffic volume, which is the size of the packet payload, is calculated as follows: The maximum, minimum, and average values ​​of the request message payload are statistically analyzed to determine the range and average value of the requested communication traffic.

[0039] The maximum, minimum, and average values ​​of the response message payload are statistically analyzed to determine the range and average value of the response's communication traffic.

[0040] The accuracy of the above-mentioned calculated values ​​can be increased through repeated extraction and training.

[0041] S4: Based on the behavioral information parameters, generate behavioral information fingerprints for each web application system using the behavioral information encoding process.

[0042] In a specific implementation, the behavioral information parameters extracted in the previous step are encoded using a behavioral information encoding process to generate a behavioral information fingerprint, web_sig, with the following specific format: web_sig=avg_time(±N)|conn_type|trans_delay(±N)|request_min-request_max|request_avg(±N)|response_min-response_max|response_avg(±N); Where | is the separator, the parentheses contain error parameters, avg_time is the average duration of a single data stream connection, conn_type is the connection type, trans_delay is the request-response interval, request_min - request_max is the range of communication traffic for requests, response_min - response_max is the range of communication traffic for responses, request_avg is the average communication traffic for requests, and response_avg is the average communication traffic for responses.

[0043] S5: Build a behavioral information database using the classification results and behavioral information fingerprints of each web application system.

[0044] In a specific implementation, a behavior information database is established, storing domain name information and the web application system information associated with each domain name. Since each web_sig represents a web application system behavior, one web application system is associated with multiple behavior information fingerprints. These behavior information fingerprints are then stored in the behavior information database in association with the web application systems. Furthermore, for ease of retrieval, the behavior information database employs a three-level directory structure: domain name information, web application system, and behavior information fingerprint.

[0045] S6: Obtain the target traffic to be identified.

[0046] S7: Extract the domain name information from the target traffic, calculate the communication behavior information parameters of the target traffic by executing the behavior information parameter extraction process, and generate the communication behavior information fingerprint using the behavior information encoding process.

[0047] The purpose of this step is to extract SSL domain information and communication behavior fingerprints from unknown traffic. For specific extraction methods, refer to the behavior information parameter extraction process and behavior information encoding process disclosed in steps S3 and S4.

[0048] S8: Compare the domain name information and communication behavior information fingerprint of the target traffic with the behavior information fingerprint in the behavior information database, and determine the matching degree between the communication behavior information fingerprint and the behavior information fingerprint of each web application system.

[0049] In a specific implementation, firstly, based on the domain name information of the target traffic, the database is searched for identical domain names to determine the web application systems associated with the domain name information of the target traffic, which serve as the matching range. Then, the communication behavior information fingerprint is compared and matched with all behavior information fingerprints within the matching range, and the matching results are recorded. The matching method is to compare each indicator of the fingerprint segment with the error parameter N value in parentheses; if each indicator is within the error range, the match is successful.

[0050] Once all communication behavior information fingerprints have been matched and compared, the matching degree P between the communication behavior information fingerprint and the behavior information fingerprint of each web application system is calculated using the formula P=n / N; where N is the total number of behavior information fingerprints of any web application system, and n is the number of matching fingerprints of the communication behavior information fingerprint among all behavior information fingerprints of that web application system.

[0051] By calculating the matching degree, the hit ratio between the communication behavior information fingerprint and the behavior information fingerprint of each web application system can be determined. The higher the hit ratio, the higher the matching degree. When the matching degree is greater than a certain value, the corresponding web application system can be identified.

[0052] S9: Determine the web application system to which the target traffic to be identified belongs based on the matching degree.

[0053] In a specific implementation, when the matching degree between the behavioral information fingerprint of any web application system and the communication behavioral information fingerprint is greater than 80%, then the web application system is the web application system to which the target traffic to be identified belongs.

[0054] See Figure 2 As shown, the present invention also discloses a web application system identification device, including a processor 101 and a memory 102; wherein, when the processor 101 executes the web application system identification program stored in the memory, it performs the following steps: 1. Use bypass redirection to capture network traffic of web application systems.

[0055] 2. Collect SSL certificate information and domain names from network traffic, identify the company that registered the domain name, classify web application systems according to the domain name, and generate classification results.

[0056] 3. Collect and analyze web data traffic in network traffic, and statistically analyze the behavioral information parameters of each web application system by executing the behavioral information parameter extraction process.

[0057] 4. Based on the behavioral information parameters, generate behavioral information fingerprints for each web application system using the behavioral information encoding process.

[0058] 5. Construct a behavioral information database using the classification results and behavioral information fingerprints of each web application system.

[0059] 6. Obtain the target traffic to be identified.

[0060] 7. Extract the domain name information from the target traffic, statistically analyze the communication behavior information parameters of the target traffic by executing the behavior information parameter extraction process, and generate a communication behavior information fingerprint using the behavior information encoding process.

[0061] 8. Compare the domain name information and communication behavior fingerprint of the target traffic with the behavior fingerprint in the behavior information database, and determine the matching degree between the communication behavior fingerprint and the behavior fingerprint of each web application system.

[0062] 9. Determine the web application system to which the target traffic to be identified belongs based on the matching degree.

[0063] The web application system identification device provided in this embodiment may include, but is not limited to, smartphones, tablets, laptops, or desktop computers.

[0064] The processor 101 may include one or more processing cores, such as a quad-core processor or an octa-core processor. The processor 101 may be implemented using at least one hardware form selected from Digital Signal Processor (DSP), Field-Programmable Gate Array (FPGA), and Programmable Logic Array (PLA). The processor 101 may also include a main processor and a coprocessor. The main processor, also known as the Central Processing Unit (CPU), is used to process data in the wake-up state; the coprocessor is a low-power processor used to process data in the standby state. In some embodiments, the processor 101 may integrate a Graphics Processing Unit (GPU), which is responsible for rendering and drawing the content to be displayed on the screen. In some embodiments, the processor 101 may also include an Artificial Intelligence (AI) processor, which handles computational operations related to machine learning.

[0065] The memory 102 may include one or more computer-readable storage media, which may be non-transitory. The memory 102 may also include high-speed random access memory and non-volatile memory, such as one or more disk storage devices or flash memory devices. In this embodiment, the memory 102 is used to store at least the following computer program, which, after being loaded and executed by the processor 101, is capable of implementing the relevant steps of the web application system identification method disclosed in any of the foregoing embodiments. In addition, the resources stored in the memory 102 may also include an operating system and data, and the storage method may be temporary or permanent storage. The operating system may include Windows, Unix, Linux, etc. The data may include, but is not limited to, the data involved in the aforementioned web application system identification method.

[0066] Furthermore, the web application system identification device in this embodiment may also include: Input interface 103 is used to acquire web application system identification programs imported from external sources and save the acquired web application system identification programs to the memory 102. It can also be used to acquire various instructions and parameters transmitted from external terminal devices and transmit them to the processor 101, so that the processor 101 can perform corresponding processing using these instructions and parameters. In this embodiment, input interface 103 may specifically include, but is not limited to, a USB interface, a serial interface, a voice input interface, a fingerprint input interface, a hard disk read interface, etc.

[0067] The output interface 104 is used to output various data generated by the processor 101 to a connected terminal device, so that other terminal devices connected to the output interface can obtain the various data generated by the processor 101. In this embodiment, the output interface 104 may specifically include, but is not limited to, a USB interface, a serial interface, etc.

[0068] The communication unit 105 is used to establish a remote communication connection between the server-running business optimization configuration device and the external server, so that the web application system identification device can mount the image file to the external server. In this embodiment, the communication unit 105 may specifically include, but is not limited to, a remote communication unit based on wireless communication technology or wired communication technology.

[0069] Keyboard 106 is used to acquire various parameter data or commands input by the user through real-time keystrokes.

[0070] Display 107 is used to display relevant information about the identification process of running the web application system in real time.

[0071] Mouse 108 can be used to assist users in inputting data and simplifying user operations.

[0072] This invention also discloses a readable storage medium, which includes random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable hard disk, CD-ROM, or any other form of storage medium known in the art. The readable storage medium stores a web application system identification program, which, when executed by a processor, performs the following steps: 1. Use bypass redirection to capture network traffic of web application systems.

[0073] 2. Collect SSL certificate information and domain names from network traffic, identify the company that registered the domain name, classify web application systems according to the domain name, and generate classification results.

[0074] 3. Collect and analyze web data traffic in network traffic, and statistically analyze the behavioral information parameters of each web application system by executing the behavioral information parameter extraction process.

[0075] 4. Based on the behavioral information parameters, generate behavioral information fingerprints for each web application system using the behavioral information encoding process.

[0076] 5. Construct a behavioral information database using the classification results and behavioral information fingerprints of each web application system.

[0077] 6. Obtain the target traffic to be identified.

[0078] 7. Extract the domain name information from the target traffic, statistically analyze the communication behavior information parameters of the target traffic by executing the behavior information parameter extraction process, and generate a communication behavior information fingerprint using the behavior information encoding process.

[0079] 8. Compare the domain name information and communication behavior fingerprint of the target traffic with the behavior fingerprint in the behavior information database, and determine the matching degree between the communication behavior fingerprint and the behavior fingerprint of each web application system.

[0080] 9. Determine the web application system to which the target traffic to be identified belongs based on the matching degree.

[0081] In summary, this invention utilizes bypass access to an existing network, mirrors its network traffic, and analyzes the certificates of web application systems in conjunction with their communication behavior to distinguish between different web application systems.

[0082] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. The methods disclosed in the embodiments are described simply because they correspond to the systems disclosed in the embodiments; relevant details can be found in the method section.

[0083] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0084] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0085] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0086] The web application system identification method, apparatus, and readable storage medium provided by this invention have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this invention. The descriptions of the embodiments above are merely for the purpose of helping to understand the method and core ideas of this invention. It should be noted that those skilled in the art can make various improvements and modifications to this invention without departing from its principles, and these improvements and modifications also fall within the protection scope of the claims of this invention.

Claims

1. A method for identifying web application systems, characterized in that, include: Capture network traffic of web application systems using bypass redirection; Collect SSL certificate information and domain names from network traffic, identify the company that registered the domain name, classify web application systems based on the domain name, and generate classification results; Collect and analyze web data traffic in network traffic, and statistically analyze the behavioral information parameters of each web application system by executing a behavioral information parameter extraction process; Based on the behavioral information parameters, a behavioral information fingerprint is generated for each web application system using a behavioral information encoding process. A behavioral information database is constructed using the classification results and behavioral information fingerprints of each web application system. Obtain the target traffic to be identified; Extract the domain name information from the target traffic, calculate the communication behavior information parameters of the target traffic by executing the behavior information parameter extraction process, and generate the communication behavior information fingerprint using the behavior information encoding process; The domain name information and communication behavior fingerprint of the target traffic are compared with the behavior fingerprint in the behavior information database to determine the matching degree between the communication behavior fingerprint and the behavior fingerprint of each web application system. The web application system to which the target traffic belongs is determined based on the matching degree; The behavioral information is encoded using the following format to generate a behavioral information fingerprint, web_sig. web_sig=avg_time(±N)|conn_type|trans_delay(±N)|request_min-request_max|request_avg(±N)|response_min-response_max|response_avg(±N); Where | is the separator, () represents the error parameter, N is the error magnitude corresponding to the error parameter, avg_time is the average duration of a single data stream connection, conn_type is the connection type, trans_delay is the request-response interval, request_min - request_max is the range of communication traffic for requests, response_min - response_max is the range of communication traffic for responses, request_avg is the average communication traffic for requests, response_avg is the average communication traffic for responses, and N is the error magnitude corresponding to the error parameter.

2. The web application system identification method according to claim 1, characterized in that, The process involves collecting SSL certificate information and domain names from network traffic, identifying the company that registered the domain names, and classifying web application systems based on the domain names to generate classification results, including: Use network packet capture technology to capture SSL protocol traffic; Extract the SSL certificate from the captured traffic and obtain the domain information from it; Based on the domain name information, query the company information that registered the domain name; Based on the company information, identify the web application system released by the company; Based on the domain name information, all web application systems are categorized and associated with the domain name information.

3. The web application system identification method according to claim 2, characterized in that, The behavioral information parameters include: The average duration of a single data stream link, link type, request-response interval, range of communication traffic for requests, range of communication traffic for responses, average communication traffic for requests, and average communication traffic for responses.

4. The web application system identification method according to claim 3, characterized in that, The behavioral information parameter extraction process includes: Identify the type of a single data stream; If a single data stream is a connectionless UDP stream, record the duration for which the upstream and downstream of the data stream have the same information, and calculate the average duration of the recorded duration within a preset period as the average duration of a single data stream connection; If a single data stream is a connection-oriented TCP stream, the time point with the SYN flag is taken as the starting point, and the time point with the FIN or RST flag is taken as the ending point to determine the connection duration of a single data stream; the average connection duration of a single data stream within a preset period is calculated as the average connection duration of a single data stream. Identify real-time communication methods in web data traffic; If the TCP or UDP connection resources established last time are reused every time the web application system is accessed, the connection type is a long connection; if the connection information is different each time it is accessed, the connection type is a short connection. Record the response message time T1 and request message sending time T2 of a single data stream. Calculate the interval T between the request and response for each data stream using the formula T = T1 - T2. Calculate the average interval T between the request and response for each data stream within a preset period, and use this as the request-response interval. Statistically analyze the maximum, minimum, and average values ​​of the request message payload to determine the range and average value of the requested communication traffic. The maximum, minimum, and average values ​​of the response message payload are statistically analyzed to determine the range and average communication traffic of the response.

5. The web application system identification method according to claim 1, characterized in that, The construction of a behavioral information database using the classification results and behavioral information fingerprints of each web application system includes: A web application system that stores domain name information and the association of each domain name; Based on the web application system behavior represented by each behavioral information fingerprint, the behavioral information fingerprint is associated with and stored with the web application system; Establish a behavior information database using a three-level directory structure that incorporates domain name information, web application systems, and behavior information fingerprints.

6. The web application system identification method according to claim 5, characterized in that, The step of comparing the domain name information and communication behavior fingerprint of the target traffic with the behavior fingerprint in the behavior information database, and determining the matching degree between the communication behavior fingerprint and the behavior fingerprint of each web application system, includes: Based on the domain information of the target traffic, search for the same domain information in the behavior information database to determine the web application system associated with the domain information of the target traffic, which serves as the matching range; The communication behavior information fingerprint is compared and matched with all behavior information fingerprints within the matching range, and the matching results are recorded. Using the formula P=n / N, the matching degree P between the communication behavior information fingerprint and the behavior information fingerprint of each web application system is calculated. Where N is the total number of behavioral information fingerprints for any web application system, and n is the number of matching communication behavioral information fingerprints among all behavioral information fingerprints in that web application system.

7. The web application system identification method according to claim 6, characterized in that, The step of determining the web application system to which the target traffic to be identified belongs based on the matching degree includes: When the matching degree between the behavioral information fingerprint of any web application system and the communication behavioral information fingerprint is greater than 80%, then the web application system is the web application system to which the target traffic to be identified belongs.

8. A web application system identification device, characterized in that, include: Memory is used to store the web application system identification program; A processor, configured to implement the steps of the web application system identification method as claimed in any one of claims 1 to 7 when executing the web application system identification program.

9. A readable storage medium, characterized in that: The readable storage medium stores a web application system identification program, which, when executed by a processor, implements the steps of the web application system identification method as described in any one of claims 1 to 7.

Images