Network security detection method and device, storage medium and electronic equipment

Abstract

The application discloses a network security detection method and device, a storage medium and an electronic device. The method comprises the following steps: sending N first messages in a preset time length according to random time intervals through a virtual private network, and obtaining N first processing time lengths of the N first messages; sending N second messages in the preset time length according to the random time intervals through the virtual private network, and obtaining N second processing time lengths of the N second messages; determining a first target processing time length based on the N first processing time lengths, and determining a second target processing time length based on the N second processing time lengths; calculating a difference value between the first target processing time length and the second target processing time length to obtain a target value, and determining a security risk situation of the virtual private network based on the target value and a preset threshold. Through the application, the problem that the virtual private network has a security risk in the related art is solved.

Description

Technical Field

[0001] This application relates to the field of cybersecurity, and more specifically, to a cybersecurity detection method, apparatus, storage medium, and electronic device. Background Technology

[0002] A Virtual Private Network (VPN) is a technology that establishes a private network over a public network for encrypted communication. It utilizes tunneling technology to build a VPN. Based on the many advantages of IPsec (Internet Protocol Security, a network security protocol), many enterprises and organizations use IPsec to establish secure tunnels, protecting confidential information while ensuring employee access to the company intranet. However, if the pre-shared key of a VPN is cracked, a man-in-the-middle attack can impersonate an ordinary user to access confidential data, posing network security risks such as data breaches.

[0003] There is currently no effective solution to the security risks associated with virtual private networks (VPNs) in related technologies. Summary of the Invention

[0004] The main purpose of this application is to provide a network security detection method, device, storage medium, and electronic device to solve the security risks of virtual private networks in related technologies.

[0005] To achieve the above objectives, according to one aspect of this application, a network security detection method is provided. The method includes: sending N first packets at random time intervals within a preset duration via a Virtual Private Network (VPN), and obtaining N first processing durations for the N first packets, where N is a positive integer and the first packets are unencrypted packets; sending N second packets at random time intervals within the preset duration via the VPN, and obtaining N second processing durations for the N second packets, where the second packets are encrypted packets and have the same length as the first packets; determining a first target processing duration based on the N first processing durations, and determining a second target processing duration based on the N second processing durations, where the first target processing duration is used to characterize the central tendency of the N first processing durations, and the second target processing duration is used to characterize the central tendency of the N second processing durations; calculating the difference between the first target processing duration and the second target processing duration to obtain a target value, and determining the security risk status of the VPN based on the target value and a preset threshold.

[0006] Optionally, determining the security risk of a virtual private network based on a target value and a preset threshold includes: determining whether the target value is greater than or equal to the preset threshold; if the target value is greater than or equal to the preset threshold, determining that the virtual private network has a security risk; if the target value is less than the preset threshold, determining that the virtual private network does not have a security risk.

[0007] Optionally, after determining the security risk of the virtual private network based on the target value and a preset threshold, the method further includes: if there is a security risk in the virtual private network, terminating the second phase negotiation of the network security protocol of the virtual private network application and issuing a prompt message, wherein the prompt message is used to inform the user that there is a security risk in the virtual private network and to refuse access to the data; or, if there is no security risk in the virtual private network, performing the second phase negotiation, and obtaining the target data accessed by the user through the virtual private network after the second phase negotiation is completed.

[0008] Optionally, determining the first target processing time based on N first processing times and the second target processing time based on N second processing times includes: removing error data from the N first processing times to obtain M first processing times, and removing error data from the N second processing times to obtain K second processing times, where M and K are both positive integers, M is less than N, and K is less than N; calculating the average of the M first processing times to obtain a first average processing time, and determining the first average processing time as the first target processing time; calculating the average of the K second processing times to obtain a second average processing time, and determining the second average processing time as the second target processing time.

[0009] Optionally, removing error data from N first processing times to obtain M first processing times, and removing error data from N second processing times to obtain K second processing times, includes: calculating the first average of the N first processing times and the second average of the N second processing times, and calculating the first variance of the N first processing times and the second variance of the N second processing times; for each first processing time, calculating the first difference between the first processing time and the first average, and calculating the ratio of the first difference to the first variance to obtain the first target score for the first processing time; for each second processing time, calculating the second processing time... The second difference between the duration and the second average is calculated, and the ratio of the second difference to the second variance is calculated to obtain the second target score of the second processing duration. If the first target score is greater than or equal to the score threshold, the first processing duration to which the first target score belongs is determined as the first data to be eliminated. If the second target score is greater than or equal to the score threshold, the second processing duration to which the second target score belongs is determined as the second data to be eliminated. All the first data to be eliminated are eliminated from the N first processing durations to obtain M first processing durations, and all the second data to be eliminated are eliminated from the N second processing durations to obtain K second processing durations.

[0010] Optionally, obtaining the N first processing times for N first messages includes: for each first message, obtaining the first sending time of the first message and the first receiving time of the response message of the first message; calculating the difference between the first receiving time and the first sending time to obtain the first processing time of the first message; obtaining the N second processing times for N second messages includes: for each second message, obtaining the second sending time of the second message and the second receiving time of the response message of the second message; calculating the difference between the second receiving time and the second sending time to obtain the second processing time of the second message.

[0011] Optionally, before sending N first packets via the virtual private network at random time intervals within a preset time period, the method further includes: detecting whether the network security protocol of the virtual private network application has completed the first phase negotiation; if the network security protocol of the virtual private network application has not completed the first phase negotiation, performing the first phase negotiation of the network security protocol; if the network security protocol of the virtual private network application has completed the first phase negotiation, performing the step of sending N first packets via the virtual private network at random time intervals within a preset time period.

[0012] To achieve the above objectives, according to another aspect of this application, a network security detection device is provided. The device includes: a first sending unit, configured to send N first packets at random time intervals within a preset duration via a virtual private network (VPN), and obtain N first processing durations for the N first packets, where N is a positive integer, and the first packets are unencrypted packets; a second sending unit, configured to send N second packets at random time intervals within a preset duration via the VPN, and obtain N second processing durations for the N second packets, where the second packets are encrypted packets, and the second packets have the same length as the first packets; a determining unit, configured to determine a first target processing duration based on the N first processing durations, and a second target processing duration based on the N second processing durations, where the first target processing duration is used to characterize the central tendency of the N first processing durations, and the second target processing duration is used to characterize the central tendency of the N second processing durations; and a calculation unit, configured to calculate the difference between the first target processing duration and the second target processing duration to obtain a target value, and determine the security risk status of the VPN based on the target value and a preset threshold.

[0013] To achieve the above objectives, according to another aspect of this application, a non-volatile storage medium is provided, the non-volatile storage medium including a stored program, wherein, when the program is executed, it controls the device where the non-volatile storage medium is located to perform the network security detection method described in any of the foregoing embodiments.

[0014] To achieve the above objectives, according to another aspect of this application, an electronic device is provided, including one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the network security detection method described in any of the foregoing embodiments.

[0015] This application employs the following steps: N first messages are sent via a Virtual Private Network (VPN) at random time intervals within a preset duration, and N first processing durations for the N first messages are obtained, where N is a positive integer and the first messages are unencrypted; N second messages are sent via the VPN at random time intervals within the preset duration, and N second processing durations for the N second messages are obtained, where the second messages are encrypted and have the same length as the first messages; a first target processing duration is determined based on the N first processing durations, and a second target processing duration is determined based on the N second processing durations, where the first target processing duration represents the central tendency of the N first processing durations, and the second target processing duration represents the central tendency of the N second processing durations; the difference between the first target processing duration and the second target processing duration is calculated to obtain a target value, and the security risk of the VPN is determined based on the target value and a preset threshold, thus solving the security risk problem of VPNs in related technologies. The first target processing time and the second target processing time are determined by the processing time of the first message and the second message. The security risk of the virtual private network is determined based on the difference between the first target processing time and the second target processing time and a preset threshold, thereby improving the security of the virtual private network. Attached Figure Description

[0016] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0017] Figure 1 This is a flowchart of a network security detection method provided according to an embodiment of this application;

[0018] Figure 2 This is a schematic diagram of message exchange in the absence of a man-in-the-middle, according to an embodiment of this application.

[0019] Figure 3 This is a schematic diagram of message exchange in the presence of a man-in-the-middle, provided according to an embodiment of this application;

[0020] Figure 4 This is a schematic diagram of a network security detection device provided according to an embodiment of this application;

[0021] Figure 5 This is a schematic diagram of an electronic device provided according to an embodiment of this application. Detailed Implementation

[0022] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0023] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0024] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate for the embodiments of this application described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0025] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data used for analysis, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties.

[0026] The present invention will now be described in conjunction with preferred implementation steps. Figure 1 This is a flowchart of a network security detection method provided according to an embodiment of this application, such as... Figure 1 As shown, the method includes the following steps:

[0027] Step S101: Send N first messages at random time intervals within a preset time period through the virtual private network, and obtain N first processing times for the N first messages, where N is a positive integer and the first message is an unencrypted message.

[0028] Specifically, the Virtual Private Network (VPN) can be used, with a preset duration of a fixed time period, such as 7:00 AM to 9:00 AM on a certain day. The first packet can be an ICMP (Internet Control Message Protocol) packet or a DPD (Dead Peer Detection) packet. N first packets are sent at random time intervals to simulate the random packet sending scenario of the VPN. When a client accesses the internal network to obtain data through the VPN, the client sends a request packet to the internal network and then receives a response packet from the internal network. The time between the client sending the request packet and receiving the response packet is the processing time of the request packet on the internal network. To test whether the VPN is susceptible to man-in-the-middle attacks and security risks, the first packet is sent through the VPN, and the first processing time of the first packet is recorded. This first processing time is then used as a parameter to determine whether the VPN has security risks.

[0029] In this embodiment, a man-in-the-middle attack (MITM attack) is an "indirect" intrusion attack. This attack mode uses various technical means to virtually place a computer controlled by the intruder between two communicating computers in a network connection. This computer is called the "man in the middle".

[0030] In some examples, the first processing time of the nth first message out of N first messages can be: the time difference between receiving the response message for the nth first message and sending the nth first message. n is a positive integer greater than or equal to 1 and less than or equal to N.

[0031] In some examples, the second processing time of the m-th second message out of N second messages can be: the time difference between receiving the response message for the m-th second message and sending the m-th second message. m is a positive integer greater than or equal to 1 and less than or equal to N.

[0032] Step S102: Send N second messages at random time intervals within a preset time period through the virtual private network, and obtain N second processing times for the N second messages. The second messages are encrypted messages and have the same message length as the first messages.

[0033] Specifically, the second message can be a message encrypted using a network security protocol, such as IPSec. The second message can be a DPD message or ICMP message encrypted using IPSec. The message types of the first and second messages can be the same or different. The second message has the same length as the first message. The second message is sent through the VPN and its second processing time is recorded. The VPN then uses a comparison between the first and second processing times to determine if there are any security risks associated with the VPN.

[0034] In some examples, step S102 can be executed before step S101, after step S101, or simultaneously with step S101. This embodiment does not specifically limit this.

[0035] Step S103: Determine a first target processing time based on N first processing times, and determine a second target processing time based on N second processing times, wherein the first target processing time is used to characterize the central tendency of the N first processing times, and the second target processing time is used to characterize the central tendency of the N second processing times.

[0036] In some examples, the first objective processing time can be the average or variance of N first processing times. The second objective processing time can be the average or variance of N second processing times.

[0037] In some examples, considering the impact of network fluctuations and other issues, some of the N first processing times and N second processing times may contain erroneous data. Therefore, the Z-score method can be used to filter the N first processing times and N second processing times, removing erroneous data to obtain M valid first processing times and K valid second processing times after removing erroneous data. The first target processing time can be the average or variance of the M first processing times, or other values ​​representing the central tendency of the M first processing times. The second target processing time can be the average or variance of the K second processing times, or other values ​​representing the central tendency of the K second processing times. Since the quantities of M and K are different, they cannot be compared one by one. Therefore, the first target processing time and the second target processing time are used as comparative data to determine the security risks of the VPN.

[0038] Step S104: Calculate the difference between the processing time of the first target and the processing time of the second target to obtain the target value, and determine the security risk of the virtual private network based on the target value and the preset threshold.

[0039] Here, the preset threshold can be set based on expert experience or determined through machine learning; no specific limitation is made here.

[0040] In some examples, the target value can be the difference between the processing time of the second target and the processing time of the first target, and the preset threshold can be a preset difference threshold.

[0041] In other examples, the target value can be the ratio of the difference between the second target processing time and the first target processing time to the first target processing time, and the preset threshold can be a preset ratio threshold.

[0042] Specifically, the first target processing time is the processing time of the test packet. The test packet does not undergo the encryption / decryption process of a man-in-the-middle attack; therefore, the first target processing time is the normal processing time of the packet in the VPN. The second target processing time is the packet encrypted using the IPsec protocol. A man-in-the-middle attack would encrypt and decrypt the second packet to illegally obtain data. Therefore, if a man-in-the-middle attack is occurring in the VPN, the second target processing time will differ significantly from the first target processing time. Thus, by setting a preset threshold and comparing the target value with the preset threshold, it can be determined whether a man-in-the-middle attack exists in the VPN.

[0043] It should be noted that in a normal network environment, a single interaction through a VPN—that is, from one end sending a message to the response—requires one decryption and one encryption. However, in the event of a man-in-the-middle attack, a single interaction requires three decryption and three encryption operations. Figure 2 This is a schematic diagram of message exchange in the absence of a man-in-the-middle, according to an embodiment of this application. Figure 3 This is a schematic diagram of message exchange in the presence of a man-in-the-middle, provided according to an embodiment of this application. Figure 2 and Figure 3 As shown. Since encryption and decryption are time-consuming, there are significant differences in the processing time for man-in-the-middle messages in a virtual private network, and this time difference can be used for man-in-the-middle detection.

[0044] The network security detection method provided in this application embodiment sends N first packets at random time intervals within a preset time period through a virtual private network (VPN), and obtains N first processing times for the N first packets, where N is a positive integer and the first packets are unencrypted packets; sends N second packets at random time intervals within the preset time period through the VPN, and obtains N second processing times for the N second packets, where the second packets are encrypted packets and have the same length as the first packets; determines a first target processing time based on the N first processing times, and determines a second target processing time based on the N second processing times, where the first target processing time is used to characterize the central tendency of the N first processing times, and the second target processing time is used to characterize the central tendency of the N second processing times; calculates the difference between the first target processing time and the second target processing time to obtain a target value, and determines the security risk status of the VPN based on the target value and a preset threshold, thus solving the problem of security risks existing in VPNs in related technologies. The first target processing time and the second target processing time are determined by the processing time of the first message and the second message. The security risk of the virtual private network is determined based on the difference between the first target processing time and the second target processing time and a preset threshold, thereby improving the security of the virtual private network.

[0045] The security risk of a virtual private network (VPN) is determined by comparing a target value with a preset threshold. Optionally, in the network security detection method provided in this application embodiment, determining the security risk of a VPN based on a target value and a preset threshold includes: determining whether the target value is greater than or equal to the preset threshold; if the target value is greater than or equal to the preset threshold, determining that the VPN has a security risk; if the target value is less than the preset threshold, determining that the VPN does not have a security risk.

[0046] Specifically, the preset threshold can be a manually set value. By comparing the target value with the preset threshold, the existence of a security risk in the VPN is determined. If the target value is greater than or equal to the preset threshold, it indicates a significant difference in processing time between the second target and the first target, meaning the VPN is susceptible to man-in-the-middle attacks and poses a security risk. If the target value is less than the preset threshold, it indicates a small difference in processing time between the second target and the first target, meaning the VPN is not susceptible to man-in-the-middle attacks and poses no security risk. This embodiment determines the security risk of the VPN and takes timely measures to protect it, preventing important data from being stolen by man-in-the-middle attacks.

[0047] To protect data in a timely manner by terminating the second phase of negotiation, the network security detection method provided in this application embodiment, after determining the security risk of the virtual private network based on the target value and preset threshold, further includes: terminating the second phase of negotiation of the network security protocol of the virtual private network application when there is a security risk in the virtual private network, and issuing a prompt message, wherein the prompt message is used to inform the user that there is a security risk in the virtual private network and to refuse access to the data; or, performing the second phase of negotiation when there is no security risk in the virtual private network, and obtaining the target data accessed by the user through the virtual private network after the second phase of negotiation is completed.

[0048] Specifically, the network security detection method provided in this application is performed before the second phase of IPsec protocol negotiation (after the first phase) begins. If a security risk is detected in the VPN, the second phase of IPsec protocol negotiation is terminated promptly to prevent data leakage. Simultaneously, a notification is sent to the client indicating a security risk in the VPN, and access to data is denied. If no security risk is detected in the VPN, the second phase of IPsec protocol negotiation continues, and the target data accessed by the user is obtained through the VPN after the second phase negotiation is completed. This embodiment reduces the risk of data theft by identifying whether IPsec traffic is subject to a man-in-the-middle attack during the IKE (Internet Key Exchange) phase of the IPsec protocol.

[0049] It's important to note that the IPsec protocol establishes a secure communication connection through Phase 1 and Phase 2 negotiations. Phase 1 involves establishing a secure association between the communicating parties, verifying each other's identities, and negotiating the key materials and security parameters used to protect the communication. During Phase 1, the parties exchange information such as encryption algorithms, authentication methods, and key exchange protocols, and perform authentication and key exchange processes, ultimately establishing a secure association. Phase 2, following the establishment of the secure association, involves the parties further negotiating the key materials and security parameters used to protect data transmission. During Phase 2, the parties confirm the establishment of the secure association and negotiate the key materials and parameters used for encryption, authentication, and data transmission, ultimately completing the establishment of the secure communication connection.

[0050] Optionally, in the network security detection method provided in this application embodiment, determining a first target processing time based on N first processing times and determining a second target processing time based on N second processing times includes: removing error data from the N first processing times to obtain M first processing times, and removing error data from the N second processing times to obtain K second processing times, where M and K are both positive integers, M is less than N, and K is less than N; calculating the average of the M first processing times to obtain a first average processing time, and determining the first average processing time as the first target processing time; calculating the average of the K second processing times to obtain a second average processing time, and determining the second average processing time as the second target processing time.

[0051] Specifically, the first target processing time can be the average of M first processing times, i.e., the first average processing time, and the second target processing time can be the average of K second processing times, i.e., the second average processing time. It should be noted that the first target processing time and the second target processing time can also be selected from other data that characterize central tendency, such as variance, etc. In this embodiment, the calculation of the first target processing time and the second target processing time provides a data basis for determining the security risk of the virtual private network.

[0052] In some examples, to avoid erroneous data affecting the judgment of network security risks, it is necessary to remove erroneous data from the first processing time and the second processing time. Optionally, in the network security detection method provided in this application embodiment, removing erroneous data from N first processing times to obtain M first processing times, and removing erroneous data from N second processing times to obtain K second processing times includes: calculating a first average value of the N first processing times and a second average value of the N second processing times, and calculating a first variance of the N first processing times and a second variance of the N second processing times; for each first processing time, calculating a first difference between the first processing time and the first average value, and calculating a first difference between the first difference and the first average value. The ratio of variances is used to obtain the first target score for the first processing duration. For each second processing duration, the second difference between the second processing duration and the second average is calculated, and the ratio of the second difference to the second variance is calculated to obtain the second target score for the second processing duration. If the first target score is greater than or equal to the score threshold, the first processing duration to which the first target score belongs is determined as the first data to be eliminated. If the second target score is greater than or equal to the score threshold, the second processing duration to which the second target score belongs is determined as the second data to be eliminated. All the first data to be eliminated are eliminated from the N first processing durations to obtain M first processing durations, and all the second data to be eliminated are eliminated from the N second processing durations to obtain K second processing durations.

[0053] Specifically, when network fluctuations occur, the first and second processing times may differ. Therefore, the Z-score method is used to remove erroneous data, reducing the impact of network fluctuations on the first and second processing times. The score threshold can be set to -3, +3, or other values. When the Z-score of the first processing time is greater than or equal to the score threshold, that first processing time is an outlier. When the Z-score of the second processing time is greater than or equal to the score threshold, that second processing time is an outlier. Outliers are data to be removed. All first data to be removed are removed from N first processing times, resulting in M ​​first processing times. Similarly, all second data to be removed are removed from N second processing times, resulting in K second processing times. This embodiment avoids the impact of network fluctuations on the first and second processing times by removing erroneous data.

[0054] It should be noted that the Z-score is calculated as follows: For a set of N data points, calculate the mean of the N data points, then calculate the variance of the N data points. The Z-score for each data point is then calculated from the mean and variance of the N data points. The formula for the Z-score is Z... i =(X i -mean) / variance, where Z i X represents the Z-score of the i-th data point out of N data points. i This represents the i-th data point out of N data points.

[0055] Optionally, in the network security detection method provided in this application embodiment, obtaining N first processing times for N first messages includes: for each first message, obtaining the first sending time of the first message and obtaining the first receiving time of the response message of the first message; calculating the difference between the first receiving time and the first sending time to obtain the first processing time of the first message; obtaining N second processing times for N second messages includes: for each second message, obtaining the second sending time of the second message and obtaining the second receiving time of the response message of the second message; calculating the difference between the second receiving time and the second sending time to obtain the second processing time of the second message.

[0056] Specifically, for each first message sent, the sending time T1 is recorded, and the time of receiving the response message is recorded T2. The message processing time interval is Ta = T2 – T1. Ta is also known as the first processing duration. For each second message sent, the sending time T3 is recorded, and the time of receiving the response message is recorded T4. The message processing time interval is Tb = T4 – T3. Tb is also known as the second processing duration. This embodiment determines the first target processing duration by calculating the first processing duration, and determines the second target processing duration by calculating multiple second processing durations.

[0057] Optionally, in the network security detection method provided in this application embodiment, before sending N first packets through the virtual private network at random time intervals within a preset time period, the method further includes: detecting whether the network security protocol of the virtual private network application has completed the first phase negotiation; if the network security protocol of the virtual private network application has not completed the first phase negotiation, performing the first phase negotiation of the network security protocol; if the network security protocol of the virtual private network application has completed the first phase negotiation, performing the step of sending N first packets through the virtual private network at random time intervals within a preset time period.

[0058] Specifically, the system checks whether the Virtual Private Network (VPN) application has completed the first phase of IPSec negotiation. If not, it continues to complete the first phase of negotiation; if the first phase of negotiation is completed, the network security detection method of this embodiment is executed. This embodiment performs man-in-the-middle detection after completing the first phase of IPSec negotiation, thereby determining whether a man-in-the-middle attack is occurring based on the packet processing time.

[0059] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0060] This application also provides a network security detection device. It should be noted that the network security detection device of this application can be used to execute the network security detection method provided in this application. The network security detection device provided in this application is described below.

[0061] Figure 4 This is a schematic diagram of a network security detection device provided according to an embodiment of this application. Figure 4 As shown, the device includes:

[0062] The first sending unit 10 is used to send N first messages at random time intervals within a preset time period through a virtual private network, and to obtain N first processing times for the N first messages, where N is a positive integer and the first message is an unencrypted message.

[0063] The second sending unit 20 is used to send N second messages at random time intervals within a preset time period through a virtual private network, and to obtain N second processing times for the N second messages, wherein the second message is an encrypted message and the message length of the second message is the same as that of the first message;

[0064] The determining unit 30 is used to determine a first target processing time based on N first processing times and a second target processing time based on N second processing times, wherein the first target processing time is used to characterize the central tendency of the N first processing times and the second target processing time is used to characterize the central tendency of the N second processing times.

[0065] The calculation unit 40 is used to calculate the difference between the processing time of the first target and the processing time of the second target, obtain the target value, and determine the security risk of the virtual private network based on the target value and a preset threshold.

[0066] The network security detection device provided in this application embodiment, through a first sending unit 10, sends N first packets at random time intervals within a preset time period via a virtual private network, and obtains N first processing times for the N first packets, where N is a positive integer, and the first packets are unencrypted packets; a second sending unit 20 sends N second packets at random time intervals within a preset time period via a virtual private network, and obtains N second processing times for the N second packets, where the second packets are encrypted packets, and the second packets have the same packet length as the first packets; a determining unit 30 determines a first target processing time based on the N first processing times, and determines a second target processing time based on the N second processing times, and its In this process, the first target processing time is used to characterize the central tendency of N first processing times, and the second target processing time is used to characterize the central tendency of N second processing times. The calculation unit 40 calculates the difference between the first target processing time and the second target processing time to obtain the target value, and determines the security risk of the virtual private network based on the target value and a preset threshold. This solves the problem of security risks in virtual private networks in related technologies. The first target processing time and the second target processing time are determined by the processing time of the first message and the second message. The security risk of the virtual private network is determined based on the difference between the first target processing time and the second target processing time and the preset threshold, thereby improving the security of the virtual private network.

[0067] Optionally, in the network security detection device provided in this application embodiment, the calculation unit 40 includes: a judgment module, used to judge whether the target value is greater than or equal to a preset threshold; a first determination module, used to determine that the virtual private network has a security risk when the target value is greater than or equal to the preset threshold; and a second determination module, used to determine that the virtual private network does not have a security risk when the target value is less than the preset threshold.

[0068] Optionally, in the network security detection device provided in the embodiments of this application, the device further includes: a termination unit, configured to terminate the second phase negotiation of the network security protocol of the virtual private network application when there is a security risk in the virtual private network, and issue a prompt message, wherein the prompt message is used to prompt the user that there is a security risk in the virtual private network and refuse access to data; or, a first execution unit, configured to perform the second phase negotiation when there is no security risk in the virtual private network, and obtain the target data accessed by the user through the virtual private network after the second phase negotiation is completed.

[0069] Optionally, in the network security detection device provided in this application embodiment, the determining unit 30 includes: a rejection module, used to reject error data from N first processing times to obtain M first processing times, and to reject error data from N second processing times to obtain K second processing times, wherein M and K are both positive integers, M is less than N, and K is less than N; a first calculation module, used to calculate the average value of the M first processing times to obtain a first average processing time, and to determine the first average processing time as a first target processing time; and a second calculation module, used to calculate the average value of the K second processing times to obtain a second average processing time, and to determine the second average processing time as a second target processing time.

[0070] Optionally, in the network security detection device provided in this application embodiment, the elimination module includes: a first calculation submodule, used to calculate a first average value of N first processing times and a second average value of N second processing times, and to calculate a first variance of the N first processing times and a second variance of the N second processing times; a second calculation submodule, used to calculate, for each first processing time, a first difference between the first processing time and the first average value, and to calculate the ratio of the first difference to the first variance to obtain a first target score for the first processing time; and a third calculation submodule, used to calculate, for each second processing time, a second processing time and a second average value. The second difference is calculated, and the ratio of the second difference to the second variance is used to obtain the second target score for the second processing time. The determination submodule is used to determine the first processing time to which the first target score belongs as the first data to be eliminated when the first target score is greater than or equal to the score threshold, and to determine the second processing time to which the second target score belongs as the second data to be eliminated when the second target score is greater than or equal to the score threshold. The elimination submodule is used to eliminate all the first data to be eliminated from N first processing times to obtain M first processing times, and eliminate all the second data to be eliminated from N second processing times to obtain K second processing times.

[0071] Optionally, in the network security detection device provided in this application embodiment, the first sending unit 10 includes: a first acquisition module, used to acquire the first sending time of the first message and the first receiving time of the response message of the first message for each first message; a third calculation module, used to calculate the difference between the first receiving time and the first sending time to obtain the first processing time of the first message; the second sending unit 20 includes: a second acquisition module, used to acquire the second sending time of the second message and the second receiving time of the response message of the second message for each second message; a fourth calculation module, used to calculate the difference between the second receiving time and the second sending time to obtain the second processing time of the second message.

[0072] Optionally, in the network security detection device provided in the embodiments of this application, the device further includes: a detection unit, used to detect whether the network security protocol of the virtual private network application has completed the first phase negotiation; a second execution unit, used to execute the first phase negotiation of the network security protocol when the network security protocol of the virtual private network application has not completed the first phase negotiation; and a third execution unit, used to execute the step of sending N first messages through the virtual private network at random time intervals within a preset time period when the network security protocol of the virtual private network application has completed the first phase negotiation.

[0073] The network security detection device includes a processor and a memory. The first sending unit 10, the second sending unit 20, the determining unit 30, and the calculating unit 40 are all stored in the memory as program units. The processor executes the program units stored in the memory to realize the corresponding functions.

[0074] The processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured, and adjusting kernel parameters can improve the security of the virtual private network.

[0075] The memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0076] This invention provides a computer-readable storage medium storing a program that, when executed by a processor, implements a network security detection method.

[0077] This invention provides a processor for running a program, wherein the program executes a network security detection method during runtime.

[0078] Figure 5 This is a schematic diagram of an electronic device provided according to an embodiment of this application. For example... Figure 5As shown, electronic device 501 includes a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, it performs the following steps: sending N first messages at random time intervals within a preset time period via a virtual private network (VPN), and obtaining N first processing times for the N first messages, where N is a positive integer and the first messages are unencrypted; sending N second messages at random time intervals within a preset time period via the VPN, and obtaining N second processing times for the N second messages, where the second messages are encrypted and have the same message length as the first messages; determining a first target processing time based on the N first processing times, and determining a second target processing time based on the N second processing times, where the first target processing time is used to characterize the central tendency of the N first processing times, and the second target processing time is used to characterize the central tendency of the N second processing times; calculating the difference between the first target processing time and the second target processing time to obtain a target value, and determining the security risk of the VPN based on the target value and a preset threshold. The devices mentioned in this article can be servers, PCs, tablets, mobile phones, etc.

[0079] This application also provides a computer program product, which, when executed on a data processing device, is suitable for executing an initialization program with the following method steps: sending N first messages at random time intervals within a preset duration via a virtual private network, and obtaining N first processing durations for the N first messages, where N is a positive integer and the first messages are unencrypted messages; sending N second messages at random time intervals within a preset duration via the virtual private network, and obtaining N second processing durations for the N second messages, where the second messages are encrypted messages and have the same message length as the first messages; determining a first target processing duration based on the N first processing durations, and determining a second target processing duration based on the N second processing durations, where the first target processing duration is used to characterize the central tendency of the N first processing durations, and the second target processing duration is used to characterize the central tendency of the N second processing durations; calculating the difference between the first target processing duration and the second target processing duration to obtain a target value, and determining the security risk status of the virtual private network based on the target value and a preset threshold.

[0080] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0081] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0082] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0083] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0084] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0085] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0086] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0087] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0088] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0089] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A network security detection method, characterized in that, include: N first messages are sent at random time intervals within a preset time period through a virtual private network, and the N first processing times of the N first messages are obtained, where N is a positive integer and the first messages are unencrypted messages; The virtual private network sends N second messages at random time intervals within the preset time period, and obtains N second processing times for the N second messages, wherein the second message is an encrypted message and the second message has the same message length as the first message; A first target processing time is determined based on the N first processing times, and a second target processing time is determined based on the N second processing times, wherein the first target processing time is used to characterize the central tendency of the N first processing times, and the second target processing time is used to characterize the central tendency of the N second processing times; The difference between the first target processing time and the second target processing time is calculated to obtain the target value, and the security risk of the virtual private network is determined based on the target value and a preset threshold. If a security risk exists in the VPN, the second phase negotiation of the network security protocol of the VPN application is terminated, and a prompt message is issued, wherein the prompt message is used to inform the user that the VPN has a security risk and to refuse access to data; or, if there is no security risk in the VPN, the second phase negotiation is performed, and the target data accessed by the user is obtained through the VPN after the second phase negotiation is completed.

2. The method according to claim 1, characterized in that, Determining the security risk of the virtual private network based on the target value and preset threshold includes: Determine whether the target value is greater than or equal to the preset threshold; If the target value is greater than or equal to the preset threshold, it is determined that the virtual private network has a security risk. If the target value is less than the preset threshold, it is determined that the virtual private network does not pose a security risk.

3. The method according to claim 1, characterized in that, Determining a first target processing time based on the N first processing times, and determining a second target processing time based on the N second processing times, includes: Error data is removed from the N first processing times to obtain M first processing times, and error data is removed from the N second processing times to obtain K second processing times, where M and K are both positive integers, M is less than N, and K is less than N; Calculate the average of the M first processing times to obtain the first average processing time, and determine the first average processing time as the first target processing time; Calculate the average of the K second processing times to obtain the second average processing time, and determine the second average processing time as the second target processing time.

4. The method according to claim 3, characterized in that, Error data is removed from the N first processing times to obtain M first processing times, and error data is removed from the N second processing times to obtain K second processing times, including: Calculate the first average of the N first processing times and the second average of the N second processing times, and calculate the first variance of the N first processing times and the second variance of the N second processing times; For each first processing duration, calculate the first difference between the first processing duration and the first average value, and calculate the ratio of the first difference to the first variance to obtain the first target score for the first processing duration; For each second processing duration, calculate the second difference between the second processing duration and the second average value, and calculate the ratio of the second difference to the second variance to obtain the second target score for the second processing duration; If the first target score is greater than or equal to the score threshold, the first processing time to which the first target score belongs is determined as the first data to be removed; if the second target score is greater than or equal to the score threshold, the second processing time to which the second target score belongs is determined as the second data to be removed. All first data to be removed are removed from the N first processing times to obtain the M first processing times, and all second data to be removed are removed from the N second processing times to obtain the K second processing times.

5. The method according to any one of claims 1 to 4, characterized in that, Obtaining the N first processing times for the N first messages includes: For each first message, obtain the first sending time of the first message and the first receiving time of the response message of the first message; Calculate the difference between the first receiving time and the first sending time to obtain the first processing time of the first message; Obtaining the N second processing times for the N second messages includes: For each second message, obtain the second sending time of the second message and the second receiving time of the response message of the second message; The difference between the second receiving time and the second sending time is calculated to obtain the second processing time of the second message.

6. The method according to any one of claims 1 to 4, characterized in that, Before sending N first messages at random time intervals within a preset duration via a virtual private network, the method further includes: Detect whether the network security protocol of the virtual private network application has completed the first phase of negotiation; If the network security protocol of the virtual private network application has not completed the first phase of negotiation, the first phase of negotiation of the network security protocol shall be performed. If the network security protocol of the virtual private network application completes the first phase of negotiation, the step of sending N first messages through the virtual private network at random time intervals within a preset time period is executed.

7. A network security detection device, characterized in that, include: The first sending unit is configured to send N first messages at random time intervals within a preset duration via a virtual private network, and to obtain N first processing durations for the N first messages, where N is a positive integer and the first message is an unencrypted message. The second sending unit is configured to send N second messages at random time intervals within the preset duration through the virtual private network, and to obtain N second processing durations for the N second messages, wherein the second message is an encrypted message and the second message has the same message length as the first message; A determining unit is configured to determine a first target processing time based on the N first processing times and to determine a second target processing time based on the N second processing times, wherein the first target processing time is used to characterize the central tendency of the N first processing times and the second target processing time is used to characterize the central tendency of the N second processing times. The calculation unit is used to calculate the difference between the first target processing time and the second target processing time to obtain a target value, and to determine the security risk of the virtual private network based on the target value and a preset threshold. The termination unit is configured to terminate the second phase negotiation of the network security protocol of the virtual private network application when there is a security risk in the virtual private network, and issue a prompt message, wherein the prompt message is used to inform the user that there is a security risk in the virtual private network and to refuse access to data; or, the first execution unit is configured to execute the second phase negotiation when there is no security risk in the virtual private network, and obtain the target data accessed by the user through the virtual private network after the second phase negotiation is completed.

8. A non-volatile storage medium, characterized in that, The non-volatile storage medium includes a stored program, wherein when the program is executed, it controls the device where the non-volatile storage medium is located to perform the network security detection method according to any one of claims 1 to 6.

9. An electronic device, characterized in that, It includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the network security detection method according to any one of claims 1 to 6.

Images