Network device identification method and device facing encryption gateway, electronic device, storage medium and program product

Abstract

The application provides a network device identification method and device for an encryption gateway, and the method comprises the following steps: collecting encrypted traffic of a target network device, and extracting behavior characteristic data in the encrypted traffic; performing behavior clustering analysis on the behavior characteristic data according to a pre-set behavior characteristic dimension, so as to obtain a clustering analysis result; determining the number of effective categories in the clustering analysis result, determining the encryption type of the target device based on the number of effective categories, and the encryption type comprises an encryption gateway device and a non-encryption gateway device. Thus, the method and device solve the defect of difficult identification of the encryption gateway device in the prior art, and realize rapid and accurate identification of the encryption gateway device.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and apparatus for identifying network devices for encrypted gateways. Background Technology

[0002] Cybersecurity is receiving increasing attention today. The emergence of encrypted network assets has brought new challenges to network security, and encrypted network device identification technology is gaining widespread interest. Network device identification technology refers to the identification and classification of all devices, applications, and data resources within a network. It is a crucial component of network security, providing accurate and reliable foundational information for other security technologies and helping administrators better protect network security.

[0003] Network device identification technology is crucial for network security and management. It helps administrators better understand network conditions, improve network security protection levels, and ensure efficient and stable network operation. Encryption gateway devices, due to their role, generate traffic from multiple devices within the gateway. Therefore, from both management and security perspectives, this leads to difficulties in managing traffic behind the gateway and lower security levels. Thus, the identification of encryption gateway assets is particularly important for network management and network security.

[0004] Traditional network device identification methods often utilize network protocol fingerprinting databases to identify encrypted gateways. This involves extracting a specific field value or combination of specific fields from the encrypted traffic generated by certain gateway devices to serve as their traffic fingerprint. However, this method requires prior knowledge of encryption protocol parameters and is ineffective for gateway devices lacking sufficient research data. Furthermore, it is only applicable to specific gateway devices from which network device protocol fingerprints can be extracted, such as those using TLS and IPsec protocols. However, a significant portion of encryption protocols lack valid values ​​in their protocol fields for device differentiation, and many custom encryption protocols lack valid feature field values ​​due to their unparseable protocol structures. Additionally, some encryption protocols are entirely encrypted, thus lacking effective feature field values ​​to identify specific devices.

[0005] As can be seen from the above, the existing methods for identifying encrypted network devices have at least the following technical problems:

[0006] 1. Traditional methods for identifying encrypted network devices rely on combinations of standard or feature field values ​​from specific encryption protocols. However, in cases where there are no valid feature fields, fully encrypted protocols, or custom encryption protocols, the lack of fields that can uniquely identify the device renders these identification methods ineffective.

[0007] 2. Traditional methods for identifying encrypted network devices rely on prior manual research into the traffic generated by specific network devices. By analyzing the device's characteristic values ​​in the traffic and using known device name tags, a feature library of network devices is constructed. However, this method cannot identify network devices that have not been studied before.

[0008] 3. Traditional methods for identifying encrypted network devices require manual analysis of the device's traffic, and due to inherent limitations, the number of devices that can be identified is severely restricted. Currently, with numerous network devices employing encryption protocols, traditional identification methods are insufficient to meet the identification needs of a large number of encrypted gateway devices.

[0009] In summary, existing technologies suffer from difficulties in identifying encrypted gateway devices. Summary of the Invention

[0010] This invention provides a method and apparatus for identifying network devices for encrypted gateways, which solves the problem of difficulty in identifying encrypted gateway devices in the prior art and achieves fast and accurate identification of encrypted gateway devices.

[0011] This invention provides a network device identification method for encrypted gateways, the method comprising:

[0012] Collect encrypted traffic from the target network device;

[0013] Extract behavioral feature data from the encrypted traffic;

[0014] Based on the pre-defined behavioral characteristic dimensions, behavioral clustering analysis is performed on the behavioral characteristic data to obtain clustering analysis results;

[0015] Determine the number of valid clusters in the cluster analysis results;

[0016] The encryption type of the target device is determined based on the number of valid categories, and the encryption type includes encrypted gateway devices and unencrypted gateway devices.

[0017] In some embodiments, extracting behavioral feature data from the encrypted traffic specifically includes:

[0018] If the encryption protocol is determined to be TCP based on the encrypted traffic, extract the behavioral characteristic data of the packets.

[0019] In some embodiments, determining that the encryption protocol is TCP based on the encrypted traffic specifically includes:

[0020] How to obtain the interaction method for the minimum length packet in encrypted traffic;

[0021] The behavior identifiers for the start and end of a TCP session are determined based on the interaction method of the minimum length message.

[0022] From the start and end behavior identifier information, confirm the interaction mode of the encrypted traffic with packets longer than the minimum length;

[0023] Based on the interaction method of packets in the encrypted traffic whose packet length is greater than the minimum length, the data transmission packets and pure ACK packets of the encrypted traffic are determined.

[0024] In some embodiments, determining the number of valid clusters in the clustering analysis results specifically includes:

[0025] In the clustering analysis results, if the number of categories is greater than 1 and the distance between different categories is greater than a preset category distance threshold, it is determined to be a valid classification;

[0026] Count the number of all valid categories to obtain the number of valid categories.

[0027] In some embodiments, determining the encryption type of the target device based on the number of valid categories specifically includes:

[0028] If the number of valid categories is greater than 1, then the target device is determined to be an encryption gateway device.

[0029] In some embodiments, determining the encryption type of the target device based on the number of valid categories specifically includes:

[0030] If the number of valid categories is less than or equal to 1, the target device is determined to be a non-encrypted gateway device.

[0031] The present invention also provides a network device identification device for encrypted gateways, the device comprising:

[0032] Traffic acquisition unit, used to collect encrypted traffic from target network devices;

[0033] The feature extraction unit is used to extract behavioral feature data from the encrypted traffic;

[0034] The clustering analysis unit is used to perform behavioral clustering analysis on the behavioral feature data according to the pre-defined behavioral feature dimensions to obtain the clustering analysis results;

[0035] A category statistics unit is used to determine the number of valid categories in the cluster analysis results;

[0036] The result generation unit is used to determine the encryption type of the target device based on the number of valid categories, wherein the encryption type includes encrypted gateway devices and unencrypted gateway devices.

[0037] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method as described above.

[0038] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described in any of the above descriptions.

[0039] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the method as described above.

[0040] The present invention provides a network device identification method and apparatus for encrypted gateways. This method collects encrypted traffic from a target network device and extracts behavioral feature data from the encrypted traffic. Based on pre-defined behavioral feature dimensions, it performs behavioral clustering analysis on the behavioral feature data to obtain clustering results. It then determines the number of valid categories in the clustering results and determines the encryption type of the target device based on the number of valid categories. The encryption type includes encrypted gateway devices and non-encrypted gateway devices. This method identifies encrypted gateways without requiring manual analysis of the traffic generated by the encrypted gateway devices, thus broadening the scope of encrypted gateway device identification and enabling the identification of unknown encrypted gateway devices. Furthermore, this method is not limited to a specific encryption protocol and supports encryption protocols without valid feature fields, non-standard encryption protocols, and fully encrypted protocols, thus enabling the identification of a wider range of encrypted gateway devices. Therefore, this method and apparatus overcome the difficulty of identifying encrypted gateway devices in existing technologies, achieving rapid and accurate identification of encrypted gateway devices. Attached Figure Description

[0041] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0042] Figure 1 This is a flowchart illustrating the network device identification method for encrypted gateways provided by the present invention.

[0043] Figure 2 A screenshot showing the interface in a specific use case.

[0044] Figure 3 This is a flowchart illustrating the network device identification device for encrypted gateways provided by the present invention.

[0045] Figure 4 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0046] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0047] This invention provides a network device identification method for encrypted gateways. The following are some specific reasons why network device identification technology is needed:

[0048] Identifying cybersecurity threats is crucial; it's difficult to guarantee the security of all devices on a network, necessitating the identification and classification of all devices to promptly detect cybersecurity threats. For example, if a new device or application is discovered on the network, administrators need to investigate and test it to determine if it poses any security threat.

[0049] Identifying network vulnerabilities: By identifying and classifying network assets, administrators can promptly discover vulnerabilities and weaknesses in the network for timely patching. For example, if an unauthorized device or application is found on the network, the administrator needs to take immediate action to prevent the security vulnerabilities it may cause.

[0050] Improve security protection levels; by identifying and classifying network assets, administrators can better understand the security situation in the network and better formulate security policies and control measures to improve network security protection levels.

[0051] Managing network performance: Resources such as devices, applications, and data within a network all impact network performance. By identifying and categorizing network assets, administrators can better manage network performance and ensure stable and efficient network operation.

[0052] The following is combined with Figure 1 The present invention describes a network device identification method for encrypted gateways. Figure 1 This is a flowchart illustrating the network device identification method for encrypted gateways provided by the present invention, as shown below. Figure 1 As shown, the method includes the following steps:

[0053] S110: Collect encrypted traffic from the target network device. In specific use cases, encrypted traffic can be collected for each IP device on the internal network. Subsequent traffic analysis is also based on each device IP to determine whether the traffic generated by this IP is gateway traffic. Furthermore, since machine learning algorithms are needed for subsequent data analysis, a certain number of traffic samples need to be collected. Because this embodiment only involves the assessment of encrypted gateways, only encrypted traffic is collected and processed.

[0054] S120: Extract behavioral feature data from the encrypted traffic; specifically, if the encryption protocol is determined to be TCP protocol through the encrypted traffic, extract the behavioral feature data of the packets.

[0055] S130: Based on the pre-defined behavioral characteristic dimensions, perform behavioral clustering analysis on the behavioral characteristic data to obtain clustering analysis results;

[0056] S140: Determine the number of valid clusters in the cluster analysis results;

[0057] S150: Determine the encryption type of the target device based on the number of valid categories, wherein the encryption type includes encrypted gateway devices and unencrypted gateway devices.

[0058] In some embodiments, determining that the encryption protocol is TCP through encrypted traffic specifically includes the following steps:

[0059] How to obtain the interaction method for the minimum length packet in encrypted traffic;

[0060] The behavior identifiers for the start and end of a TCP session are determined based on the interaction method of the minimum length message.

[0061] From the start and end behavior identifier information, confirm the interaction mode of the encrypted traffic with packets longer than the minimum length;

[0062] Based on the interaction method of packets in the encrypted traffic whose packet length is greater than the minimum length, the data transmission packets and pure ACK packets of the encrypted traffic are determined.

[0063] Specifically, traffic behavior data is extracted from traffic generated by the target IP. Since the traffic needs to be detected from the encrypted gateway, the content data of the traffic generated by the encrypted gateway is not actually very usable. This embodiment extracts valid traffic behavior information that can reflect whether the traffic was generated by the gateway device, that is, the traffic was generated by multiple devices rather than a single device.

[0064] The behavioral characteristics involved include, but are not limited to, the following behavioral characteristic information:

[0065] For channel encryption protocols below the transport layer, the behavior information of TCP pure ACK packets can be obtained: [the number of ACK packets of the sender type, delayack].

[0066] Furthermore, the method for determining whether the encrypted protocol is TCP rather than UDP by analyzing the encrypted traffic involves identifying the interaction patterns of the smallest packets in the encrypted stream to determine the start and end of a TCP session: the three-way handshake and the four-way handshake. Then, from these start and end event identifiers, the interaction patterns of larger packets (i.e., packets with a length greater than the minimum packet length) are identified to confirm the data transmission packets and the pure ACK packets (the minimum packet length). This method effectively confirms that the encrypted protocol internally uses the TCP protocol, enhancing the accuracy of encrypted ACK packet analysis.

[0067] In principle, the differences in ACK packet behavior across different operating systems may be due to the following reasons:

[0068] 1. Generally, the Linux operating system's TCP stack typically attempts to use delayed ACK to reduce the number of ACK acknowledgment packets. Delayed ACK is an optimization mechanism that combines ACK acknowledgment packets from multiple packets into one, thereby reducing network traffic and CPU usage. Specifically, when the Linux TCP stack receives a packet, it waits a short period (usually 200ms) to confirm whether another packet needs to be sent. If no other packets need to be sent during this time, the TCP stack sends an ACK acknowledgment packet. In contrast, the Windows operating system's TCP stack typically does not use delayed ACK, but instead uses immediate ACK to acknowledge each received packet. This means that, in some cases, the Windows TCP stack may generate more ACK acknowledgment packets.

[0069] 2. Congestion Control Algorithms: The TCP protocol stack uses different congestion control algorithms to manage network congestion. Linux typically uses TCP congestion control algorithms such as CUBIC, BIC, Reno, and NewReno, while Windows typically uses algorithms such as Compound TCP and NewReno. These differences in algorithms can also lead to the operating system's TCP protocol stack generating different numbers of ACK acknowledgment packets.

[0070] 3. MSS Size: MSS (Maximum Segment Size) refers to the maximum data size in a TCP packet. During the TCP handshake, the client and server negotiate the MSS size. If the MSS size is small, the TCP protocol stack may need to send more ACK acknowledgment packets to complete data transmission.

[0071] 4. Operating System Kernel Parameters: The configuration of operating system kernel parameters can also affect the behavior of the TCP protocol stack. For example, the Linux kernel has some parameters that can control the behavior of the TCP protocol stack, such as tcp_ack_frequency and tcp_slow_start_after_idle. The configuration of these parameters may also affect the number of ACK acknowledgment packets sent by the TCP protocol stack.

[0072] To make it easier to understand, the method for determining whether encrypted traffic is TCP or UDP will be explained further below.

[0073] Because an ACK packet without payload is a very small packet containing only the underlying protocol header, its length is fixed. Although the encryption gateway encrypts the content of the network payload, it has no impact on the behavior of ACK packets with only the protocol header (transmission quantity, latency, interaction method, etc.).

[0074] It should be understood that the two most widely used protocols in current internet applications are UDP and TCP. Because UDP is a connectionless protocol, there is no session negotiation process; data transmission begins directly from the first UDP packet. Furthermore, due to the inherent working mechanism of the UDP protocol layer, it lacks the additional ACK confirmation mechanism of TCP. Therefore, each application implements its own data acknowledgment method, without a unified approach. TCP, on the other hand, is a standard low-level protocol with a three-way handshake, four-way handshake, ACK confirmation, and retransmission. These standard workflows result in its traffic behavior exhibiting standard repetitive characteristics. For example, in the TCP three-way handshake phase, each of the three packets only contains a protocol header and no application-layer payload. This leads to the following traffic behavior: first, the client sends a small packet (with a fixed packet length, and this packet will continue to appear); then the server replies with a small packet (with the same characteristics); then the client replies with another small packet (with the same characteristics). Then, the application layer begins transmitting data, meaning the subsequent packets are longer than the first three packets. Furthermore, in data transmission, a pattern emerges where one or more large packets are followed by a smaller reply packet (i.e., a TCP ACK packet, which only contains a protocol header and no application payload). Therefore, by analyzing traffic exhibiting this pattern, and given the widespread use of TCP, a certain threshold can be used to confirm that the encrypted traffic is carrying application-layer data via TCP, rather than UDP. Similarly, the TCP four-way handshake can be determined using this method. Thus, once the establishment and dismantling of a TCP connection are identified, the intermediate traffic will inevitably contain TCP traffic, significantly increasing the accuracy of TCP ACK packet identification.

[0075] In some embodiments, determining the number of valid clusters in the clustering analysis results specifically includes:

[0076] In the clustering analysis results, if the number of categories is greater than 1 and the distance between different categories is greater than a preset category distance threshold, it is determined to be a valid classification;

[0077] Count the number of all valid categories to obtain the number of valid categories.

[0078] Specifically, after acquiring the collected traffic behavior data, clustering algorithms such as DBSCAN can be used for cluster analysis based on the determined behavioral feature dimensions. If, after cluster analysis, a pre-set class distance threshold ε is used for judgment, and it is found that the number of clusters is greater than 1 and the distance between different classes is greater than the class distance threshold ε, then the classification is deemed valid.

[0079] Specifically, determining the encryption type of the target device based on the number of valid categories includes:

[0080] If the number of valid categories is greater than 1, then the target device is determined to be an encryption gateway device;

[0081] If the number of valid categories is less than or equal to 1, the target device is determined to be a non-encrypted gateway device.

[0082] Specifically, it is determined whether the number of valid categories is greater than 1. If it is greater than 1, it indicates that the network traffic is generated by multiple types of devices; otherwise, it indicates that the traffic is generated by a single type of device. Further, when it is determined that the traffic is generated by multiple types of devices, the IP device is determined to be an encrypted gateway device; when it is determined that the traffic is generated by a single type of device, the IP device is determined to be an unencrypted gateway device.

[0083] To facilitate understanding, the following uses a specific application scenario as an example to briefly describe the implementation process and technical effects of the method provided by this invention.

[0084] like Figure 2 The image shows a user interface demonstration in a specific use case. It illustrates a VPN server where the IP address 10.0.1.3 is the physical network interface card (NIC) address, corresponding to the IPSec (a VPN encryption protocol) address 192.168.42.1. The client's physical NIC address is 10.0.1.2, corresponding to the VPN address 192.168.42.10. The client accesses an HTTP service within the VPN server to request a TCP session stream corresponding to a file. The 192.168.42 address segment, obtained internally within the VPN, is in plaintext. The 10.0.1 address segment, obtained externally, is encrypted using the IPSec protocol. As shown in the packet mapping diagram, there is a one-to-one correspondence in both packet time and packet length. This is because the encryption protocol encrypts the packet content, without altering the time, relative packet length, or interaction direction. Therefore, if the original message exhibits a pattern in terms of relative changes in packet length, time, and interaction direction, then the encrypted message will also be applicable.

[0085] In the above specific embodiments, the network device identification method for encrypted gateways provided by the present invention collects encrypted traffic from the target network device and extracts behavioral feature data from the encrypted traffic; performs behavioral clustering analysis on the behavioral feature data according to a pre-set behavioral feature dimension to obtain clustering analysis results; determines the number of valid categories in the clustering analysis results; and determines the encryption type of the target device based on the number of valid categories, wherein the encryption type includes encrypted gateway devices and non-encrypted gateway devices. Thus, this method for identifying encrypted gateways does not require manual study of the traffic generated by relevant encrypted gateway devices, thereby expanding the scope of encrypted gateway device identification and enabling the identification of unknown encrypted gateway devices. Furthermore, this method is not limited to a specific encryption protocol and can support encryption protocols without valid feature fields, non-standard encryption protocols, and fully encrypted protocols, thus enabling the identification of a wider range of encrypted gateway devices. In this way, the method solves the problem of difficulty in identifying encrypted gateway devices in the prior art, achieving rapid and accurate identification of encrypted gateway devices.

[0086] In addition to the methods described above, the present invention also provides a network device identification device for encrypted gateways, the device comprising:

[0087] Traffic acquisition unit 310 is used to collect encrypted traffic of the target network device;

[0088] Feature extraction unit 320 is used to extract behavioral feature data from the encrypted traffic;

[0089] Clustering analysis unit 330 is used to perform behavioral clustering analysis on the behavioral feature data according to a pre-defined behavioral feature dimension to obtain clustering analysis results;

[0090] Category statistics unit 340 is used to determine the number of valid categories in the cluster analysis results;

[0091] The result generation unit 350 is used to determine the encryption type of the target device based on the number of valid categories, wherein the encryption type includes encrypted gateway devices and unencrypted gateway devices.

[0092] In some embodiments, extracting behavioral feature data from the encrypted traffic specifically includes:

[0093] If the encryption protocol is determined to be TCP based on the encrypted traffic, extract the behavioral characteristic data of the packets.

[0094] In some embodiments, determining that the encryption protocol is TCP based on the encrypted traffic specifically includes:

[0095] How to obtain the interaction method for the minimum length packet in encrypted traffic;

[0096] The behavior identifiers for the start and end of a TCP session are determined based on the interaction method of the minimum length message.

[0097] From the start and end behavior identifier information, confirm the interaction mode of the encrypted traffic with packets longer than the minimum length;

[0098] Based on the interaction method of packets in the encrypted traffic whose packet length is greater than the minimum length, the data transmission packets and pure ACK packets of the encrypted traffic are determined.

[0099] In some embodiments, determining the number of valid clusters in the clustering analysis results specifically includes:

[0100] In the clustering analysis results, if the number of categories is greater than 1 and the distance between different categories is greater than a preset category distance threshold, it is determined to be a valid classification;

[0101] Count the number of all valid categories to obtain the number of valid categories.

[0102] In some embodiments, determining the encryption type of the target device based on the number of valid categories specifically includes:

[0103] If the number of valid categories is greater than 1, then the target device is determined to be an encryption gateway device.

[0104] In some embodiments, determining the encryption type of the target device based on the number of valid categories specifically includes:

[0105] If the number of valid categories is less than or equal to 1, the target device is determined to be a non-encrypted gateway device.

[0106] In the above specific embodiments, the network device identification device for encrypted gateways provided by the present invention collects encrypted traffic from the target network device and extracts behavioral feature data from the encrypted traffic; performs behavioral clustering analysis on the behavioral feature data according to a pre-set behavioral feature dimension to obtain clustering analysis results; determines the number of valid categories in the clustering analysis results, and determines the encryption type of the target device based on the number of valid categories, wherein the encryption type includes encrypted gateway devices and non-encrypted gateway devices. Thus, this method for identifying encrypted gateways does not require manual study of the traffic generated by related encrypted gateway devices, thereby expanding the scope of encrypted gateway device identification and enabling the identification of unknown encrypted gateway devices. Furthermore, this method is not limited to a specific encryption protocol and can support encryption protocols without valid feature fields, non-standard encryption protocols, and fully encrypted protocols, thus enabling the identification of a wider range of encrypted gateway devices. Therefore, this device solves the problem of difficulty in identifying encrypted gateway devices in the prior art, achieving rapid and accurate identification of encrypted gateway devices.

[0107] Figure 4 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 4 As shown, the electronic device may include a processor 410, a communications interface 420, a memory 430, and a communication bus 440, wherein the processor 410, the communications interface 420, and the memory 430 communicate with each other through the communication bus 440. The processor 410 can call logical instructions in the memory 430 to execute the above-described method.

[0108] Furthermore, the logical instructions in the aforementioned memory 430 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0109] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer is able to perform the steps provided by the methods described above.

[0110] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the steps provided by the methods described above.

[0111] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0112] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0113] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A network device identification method for encrypted gateways, characterized in that, The method includes: Collect encrypted traffic from the target network device; Extract behavioral feature data from the encrypted traffic; Based on the pre-defined behavioral characteristic dimensions, behavioral clustering analysis is performed on the behavioral characteristic data to obtain clustering analysis results; Determining the number of valid clusters in the cluster analysis results specifically includes: in the cluster analysis results, if the number of clusters is greater than 1 and the distance between different clusters is greater than a preset cluster distance threshold, then it is determined to be a valid classification; count the number of all valid classifications to obtain the number of valid clusters; The encryption type of the target device is determined based on the number of valid categories. The encryption type includes encrypted gateway devices and unencrypted gateway devices, specifically including: If the number of valid categories is greater than 1, then the target device is determined to be an encryption gateway device; If the number of valid categories is less than or equal to 1, the target device is determined to be a non-encrypted gateway device.

2. The network device identification method for encrypted gateways according to claim 1, characterized in that, Extracting behavioral feature data from the encrypted traffic specifically includes: If the encryption protocol is determined to be TCP based on the encrypted traffic, extract the behavioral characteristic data of the packets.

3. The network device identification method for encrypted gateways according to claim 2, characterized in that, Determining that the encryption protocol is TCP by analyzing the encrypted traffic specifically includes: How to obtain the interaction method for the minimum length packet in encrypted traffic; The behavior identifiers for the start and end of a TCP session are determined based on the interaction method of the minimum length message. From the start and end behavior identifier information, confirm the interaction mode of the encrypted traffic with packets longer than the minimum length; Based on the interaction method of packets in the encrypted traffic whose packet length is greater than the minimum length, the data transmission packets and pure ACK packets of the encrypted traffic are determined.

4. A network device identification device for an encrypted gateway, used to implement the method as described in any one of claims 1-3, characterized in that, The device includes: Traffic acquisition unit, used to collect encrypted traffic from target network devices; The feature extraction unit is used to extract behavioral feature data from the encrypted traffic; The clustering analysis unit is used to perform behavioral clustering analysis on the behavioral feature data according to the pre-defined behavioral feature dimensions to obtain the clustering analysis results; A category statistics unit is used to determine the number of valid categories in the cluster analysis results; The result generation unit is used to determine the encryption type of the target device based on the number of valid categories, wherein the encryption type includes encrypted gateway devices and unencrypted gateway devices.

5. An electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the method as described in any one of claims 1 to 3.

6. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1 to 3.

7. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1 to 3.

Images