Encrypted traffic vulnerability scanning detection method, device, electronic device and storage medium

Abstract

The present invention provides a method, device, electronic device and storage medium for scanning and detecting vulnerabilities in encrypted traffic, the method comprising: obtaining encrypted traffic to be processed; decrypting the encrypted traffic to be processed to obtain a plaintext message corresponding to the encrypted traffic to be processed; according to the service type or message sensitivity of the plaintext message, calling a vulnerability scanning strategy corresponding to the service type or message sensitivity to process the plaintext message to obtain a processed plaintext message, and sending the processed plaintext message to a server; receiving a response message corresponding to the processed plaintext message sent by the server, and determining whether the encrypted traffic to be processed has a vulnerability based on the response message. Vulnerability detection of encrypted traffic is achieved, thereby ensuring network security in the context of encrypted traffic.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an encrypted traffic vulnerability scanning detection method, device, electronic device and storage medium. Background Art

[0002] With the rapid development of the Internet, network security issues have become increasingly prominent. Among the many network security issues, vulnerability issues are particularly serious. Vulnerability scanning technology is widely used as an efficient way to discover vulnerabilities, but existing technologies mainly focus on scanning non-encrypted traffic. However, with the widespread application of traffic encryption technology, non-encrypted traffic is becoming less and less, and in-depth vulnerability scanning in encrypted traffic scenarios has become a problem that needs to be solved urgently.

[0003] Therefore, finding a scanning and detection method for encrypted traffic vulnerabilities has become a research hotspot. Summary of the invention

[0004] The present invention provides an encrypted traffic vulnerability scanning detection method, device, electronic device and storage medium, which realizes vulnerability detection on encrypted traffic, thereby ensuring network security in the context of encrypted traffic.

[0005] The present invention provides an encrypted traffic vulnerability scanning and detection method, the method comprising: obtaining encrypted traffic to be processed; decrypting the encrypted traffic to be processed to obtain a plaintext message corresponding to the encrypted traffic to be processed; according to the business type or message sensitivity of the plaintext message, calling a vulnerability scanning strategy corresponding to the business type or message sensitivity to process the plaintext message to obtain a processed plaintext message; receiving a response message corresponding to the processed plaintext message sent by a server, and determining whether the encrypted traffic to be processed has a vulnerability based on the response message.

[0006] According to an encrypted traffic vulnerability scanning and detection method provided by the present invention, the vulnerability scanning strategy corresponding to the business type is called according to the business type of the plaintext message to process the plaintext message to obtain a processed plaintext message, which specifically includes: when the business type of the plaintext message is a first business type that interacts with a user, a first vulnerability scanning strategy corresponding to the first business type is called, wherein a first vulnerability scanning granularity of the first vulnerability scanning strategy is less than a first granularity threshold; parameters in the plaintext message are scanned and processed according to the first vulnerability scanning granularity to obtain a processed plaintext message; when the business type of the plaintext message is a second business type that does not interact with a user, a second vulnerability scanning strategy corresponding to the second business type is called, wherein a second vulnerability scanning granularity of the second vulnerability scanning strategy is greater than or equal to the first granularity threshold; parameters in the plaintext message are scanned and processed according to the second vulnerability scanning granularity to obtain a processed plaintext message.

[0007] According to an encrypted traffic vulnerability scanning and detection method provided by the present invention, according to the message sensitivity of the plaintext message, calling the vulnerability scanning strategy corresponding to the message sensitivity to process the plaintext message to obtain a processed plaintext message, specifically including: when the message sensitivity of the plaintext message is a first message sensitivity, calling the third vulnerability scanning strategy corresponding to the first message sensitivity, wherein the plaintext message with the message sensitivity of the first message sensitivity has sensitive information; the third vulnerability scanning granularity of the third vulnerability scanning strategy is less than the second granularity threshold; scanning and processing the parameters in the plaintext message according to the third vulnerability scanning granularity to obtain a processed plaintext message; when the message sensitivity of the plaintext message is a second message sensitivity, calling the fourth vulnerability scanning strategy corresponding to the second message sensitivity, wherein the plaintext message with the message sensitivity of the second message sensitivity does not have sensitive information; the fourth vulnerability scanning granularity of the fourth vulnerability scanning strategy is greater than or equal to the second granularity threshold; scanning and processing the parameters in the plaintext message according to the fourth vulnerability scanning granularity to obtain a processed plaintext message.

[0008] According to an encrypted traffic vulnerability scanning and detection method provided by the present invention, the vulnerability scanning strategy corresponding to the business type or message sensitivity is called to process the plaintext message, which specifically includes: calling the vulnerability scanning strategy corresponding to the business type or message sensitivity to add abnormal code to the plaintext message.

[0009] According to an encrypted traffic vulnerability scanning and detection method provided by the present invention, the response message is an encrypted response message; before receiving the response message sent by the server corresponding to the processed plaintext message, the method also includes: decrypting the encrypted response message to obtain a decrypted response message; the receiving the response message sent by the server corresponding to the processed plaintext message, and determining whether the encrypted traffic to be processed has a vulnerability based on the response message, specifically includes: receiving the decrypted response message sent by the server, wherein the decrypted response message corresponds to the processed plaintext message; when detecting that the decrypted response message has a preset identifier, determining that the encrypted traffic to be processed has a vulnerability; when detecting that the decrypted response message does not have a preset identifier, determining that the encrypted traffic to be processed does not have a vulnerability.

[0010] According to an encrypted traffic vulnerability scanning and detection method provided by the present invention, before decrypting the encrypted traffic to be processed to obtain a plaintext message corresponding to the encrypted traffic to be processed, the method also includes: screening the encrypted traffic to be processed to obtain key traffic in the encrypted traffic to be processed; decrypting the encrypted traffic to be processed to obtain a plaintext message corresponding to the encrypted traffic to be processed specifically includes: decrypting the key traffic to obtain a plaintext message corresponding to the encrypted traffic to be processed.

[0011] According to an encrypted traffic vulnerability scanning and detection method provided by the present invention, after obtaining the processed plaintext message, the method also includes: encrypting the processed plaintext message to obtain an encrypted plaintext message, and using the encrypted plaintext message as the processed plaintext message; sending the processed plaintext message to the server specifically includes: sending the encrypted plaintext message to the server; receiving a response message sent by the server corresponding to the processed plaintext message specifically includes: receiving a response message sent by the server corresponding to the encrypted plaintext message.

[0012] The present invention also provides an encrypted traffic vulnerability scanning and detection device, which includes: an acquisition module, used to acquire the encrypted traffic to be processed; a decryption module, used to decrypt the encrypted traffic to be processed to obtain a plaintext message corresponding to the encrypted traffic to be processed; a calling module, used to call a vulnerability scanning strategy corresponding to the business type or message sensitivity to process the plaintext message according to the business type or message sensitivity of the plaintext message, obtain a processed plaintext message, and send the processed plaintext message to a server; a processing module, used to receive a response message sent by the server corresponding to the processed plaintext message, and determine whether there is a vulnerability in the encrypted traffic to be processed based on the response message.

[0013] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the encrypted traffic vulnerability scanning and detection method as described in any one of the above is implemented.

[0014] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the encrypted traffic vulnerability scanning and detection method as described in any one of the above is implemented.

[0015] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the encrypted traffic vulnerability scanning and detection method as described above is implemented.

[0016] The encrypted traffic vulnerability scanning detection method, device, electronic device and storage medium provided by the present invention obtain the encrypted traffic to be processed; decrypt the encrypted traffic to be processed to obtain the plaintext message corresponding to the encrypted traffic to be processed; then according to the business type or message sensitivity of the plaintext message, call the vulnerability scanning strategy corresponding to the business type or message sensitivity to process the plaintext message to obtain the processed plaintext message, and send the processed plaintext message to the server; and receive the response message sent by the server corresponding to the processed plaintext message, and determine whether the encrypted traffic to be processed has a vulnerability based on the response message. Vulnerability detection of encrypted traffic is achieved, thereby ensuring network security in the context of encrypted traffic. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction is given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0018] Figure 1 This is one of the flow charts of the encrypted traffic vulnerability scanning detection method provided by the present invention;

[0019] Figure 2 The present invention provides a flow chart of invoking a vulnerability scanning strategy corresponding to a business type to process a plaintext message according to the business type of the plaintext message to obtain the processed plaintext message;

[0020] Figure 3 The present invention provides a flow chart of invoking a vulnerability scanning strategy corresponding to the message sensitivity to process the plaintext message according to the message sensitivity of the plaintext message to obtain the processed plaintext message;

[0021] Figure 4 It is a structural schematic diagram of the encrypted traffic vulnerability scanning and detection device provided by the present invention;

[0022] Figure 5 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0024] The encrypted traffic vulnerability scanning and detection method provided by the present invention can deeply detect the specific plaintext parameters of the encrypted traffic, thereby improving the accuracy and efficiency of the encrypted traffic vulnerability scanning.

[0025] Figure 1 This is one of the flow charts of the encrypted traffic vulnerability scanning detection method provided by the present invention.

[0026] The following will be combined Figure 1 The process of the encrypted traffic vulnerability scanning detection method provided by the present invention is described.

[0027] In an exemplary embodiment of the present invention, Figure 1 It can be seen that the encrypted traffic vulnerability scanning detection method may include steps 110 to 140, and each step will be introduced below.

[0028] In step 110, encrypted traffic to be processed is obtained.

[0029] In one embodiment, the encrypted traffic to be processed can be obtained, wherein the encrypted traffic to be processed can be obtained between the network link between the client and the server. In another example, the encrypted traffic to be processed between the network link between the client and the server can be obtained in an embedded manner.

[0030] In step 120, the encrypted traffic to be processed is decrypted to obtain a plaintext message corresponding to the encrypted traffic to be processed.

[0031] In another embodiment, since the encrypted traffic to be processed is in an encrypted state, in order to effectively obtain the plaintext parameters in the encrypted traffic to be processed and to better implement vulnerability detection of the encrypted traffic to be processed, the encrypted traffic to be processed can be decrypted to obtain the plaintext message corresponding to the encrypted traffic to be processed.

[0032] In another embodiment, the encrypted traffic to be processed can be decrypted by a decryption algorithm, wherein the decryption algorithm can be a hardware acceleration algorithm to increase the encryption and decryption speed. The decryption algorithm can also be AES, RSA, national encryption, etc., and the decryption algorithm is not specifically limited in this embodiment.

[0033] In step 130, based on the business type or message sensitivity of the plaintext message, a vulnerability scanning strategy corresponding to the business type or message sensitivity is called to process the plaintext message to obtain a processed plaintext message, and the processed plaintext message is sent to the server.

[0034] In one embodiment, the vulnerability scanning strategy corresponding to the service type or message sensitivity of the plaintext message can be adaptively called to process the plaintext message according to the service type or message sensitivity of the plaintext message to obtain the processed plaintext message. By adaptively calling the corresponding vulnerability scanning strategy to process the plaintext message according to the service type or message sensitivity of the plaintext message, the detection efficiency can be improved by selecting a suitable vulnerability scanning strategy while ensuring effective scanning of the vulnerability.

[0035] In yet another embodiment, the proxy-posted plaintext message may also be sent to a server so that the server can generate a response message corresponding to the proxy-posted plaintext message.

[0036] In another exemplary embodiment of the present invention, the above-mentioned embodiment is continued as an example to explain that calling a vulnerability scanning strategy corresponding to a service type or message sensitivity to process a plaintext message can be implemented in the following manner:

[0037] Call the vulnerability scanning strategy corresponding to the business type or message sensitivity to add abnormal code to the plaintext message.

[0038] In one embodiment, through the corresponding vulnerability scanning strategy, the plaintext message can be detected and an abnormal code Payload can be added. Payload refers to the code carried by malware or viruses, which can perform various operations on the infected system, including stealing sensitive information, destroying system functions, controlling remote servers, etc.

[0039] In step 140, a response message corresponding to the processed plaintext message sent by the server is received, and it is determined based on the response message whether there is a vulnerability in the encrypted traffic to be processed.

[0040] In another embodiment, a response message corresponding to the processed plaintext message sent by the server can be received, and whether there is a vulnerability in the encrypted traffic to be processed can be determined based on the response message. In one example, it can be determined whether the response message with the Payload successfully exploits the vulnerability. It can be understood that if the response message with the Payload successfully exploits the vulnerability, it means that there is a vulnerability in the encrypted traffic to be processed; if the response message with the Payload does not successfully exploit the vulnerability, it means that there is no vulnerability in the encrypted traffic to be processed.

[0041] The encrypted traffic vulnerability scanning and detection method provided by the present invention obtains the encrypted traffic to be processed; decrypts the encrypted traffic to be processed to obtain a plaintext message corresponding to the encrypted traffic to be processed; then, according to the business type or message sensitivity of the plaintext message, calls a vulnerability scanning strategy corresponding to the business type or message sensitivity to process the plaintext message to obtain a processed plaintext message, and sends the processed plaintext message to a server; and receives a response message corresponding to the processed plaintext message sent by the server, and determines whether there is a vulnerability in the encrypted traffic to be processed based on the response message. Vulnerability detection of encrypted traffic is achieved, thereby ensuring network security in the context of encrypted traffic.

[0042] Figure 2 The present invention provides a flow chart of processing the plaintext message according to the business type of the plaintext message by calling the vulnerability scanning strategy corresponding to the business type to obtain the processed plaintext message.

[0043] The following will be combined Figure 2 The process of invoking a vulnerability scanning strategy corresponding to a business type to process a plaintext message according to the business type of the plaintext message and obtaining the processed plaintext message is described.

[0044] In an exemplary embodiment of the present invention, Figure 2 It can be seen that according to the business type of the plaintext message, the vulnerability scanning strategy corresponding to the business type is called to process the plaintext message, and the processed plaintext message may include steps 210 to 240, and each step will be introduced below.

[0045] In step 210, when the service type of the plaintext message is a first service type for interacting with a user, a first vulnerability scanning strategy corresponding to the first service type is called, wherein a first vulnerability scanning granularity of the first vulnerability scanning strategy is less than a first granularity threshold.

[0046] In step 220, the parameters in the plaintext message are scanned and processed according to the first vulnerability scanning granularity to obtain a processed plaintext message.

[0047] In one embodiment, when the service type of the plaintext message is the first service type for interacting with users, that is, when the encrypted traffic to be processed corresponds to interacting with users (the first service type), since interacting with users requires more network security, a deeper vulnerability scan is required. During the application process, the first vulnerability scanning strategy corresponding to the first service type can be called, and the parameters in the plaintext message can be scanned and processed according to the first vulnerability scanning granularity of the first vulnerability scanning strategy to obtain the processed plaintext message. Since the first vulnerability scanning granularity is less than the first granularity threshold, it means that a more fine-grained vulnerability scan can be performed, and a deeper vulnerability scan can be achieved, thereby effectively ensuring network security.

[0048] In step 230, when the service type of the plaintext message is a second service type that does not interact with the user, a second vulnerability scanning strategy corresponding to the second service type is called, wherein a second vulnerability scanning granularity of the second vulnerability scanning strategy is greater than or equal to the first granularity threshold.

[0049] In step 240, the parameters in the plaintext message are scanned and processed according to the second vulnerability scanning granularity to obtain a processed plaintext message.

[0050] In another embodiment, when the service type of the plaintext message is the second service type that does not interact with the user, that is, when the encrypted traffic to be processed corresponds to the second service type that does not interact with the user, there is no need to perform a deeper vulnerability scan because there is no interaction with the user. During the application process, the second vulnerability scanning strategy corresponding to the second service type can be called, and the parameters in the plaintext message can be scanned and processed according to the second vulnerability scanning granularity of the second vulnerability scanning strategy to obtain the processed plaintext message. Since the second vulnerability scanning granularity is greater than or equal to the first granularity threshold, it means that a non-deep vulnerability scan can be performed, which can reduce the amount of calculation in the vulnerability scanning process. Since for the encrypted traffic to be processed of the second service type, there is no need to perform a higher level of vulnerability scanning to ensure relative security, it does not affect user use, and achieves a balance between scanning cost and scanning security.

[0051] Figure 3 The present invention provides a flow chart of processing the plaintext message according to the message sensitivity of the plaintext message by calling the vulnerability scanning strategy corresponding to the message sensitivity to obtain the processed plaintext message.

[0052] In another exemplary embodiment of the present invention, Figure 3It can be seen that according to the message sensitivity of the plaintext message, the vulnerability scanning strategy corresponding to the message sensitivity is called to process the plaintext message to obtain the processed plaintext message, which may include steps 310 to 240, and each step will be introduced below.

[0053] In step 310, when the message sensitivity of the plaintext message is the first message sensitivity, the third vulnerability scanning strategy corresponding to the first message sensitivity is called, wherein the plaintext message with the message sensitivity being the first message sensitivity has sensitive information; and the third vulnerability scanning granularity of the third vulnerability scanning strategy is less than the second granularity threshold.

[0054] In step 320, the parameters in the plaintext message are scanned and processed according to the third vulnerability scanning granularity to obtain a processed plaintext message.

[0055] In one embodiment, when the message sensitivity of the plaintext message is the first message sensitivity, that is, when the encrypted traffic to be processed contains sensitive information, network security needs to be guaranteed more due to the presence of sensitive information of the user, so a deeper vulnerability scan is required. During the application process, a third vulnerability scanning strategy corresponding to the first message sensitivity can be called, and the parameters in the plaintext message can be scanned and processed according to the third vulnerability scanning granularity of the third vulnerability scanning strategy to obtain a processed plaintext message. Since the third vulnerability scanning granularity is less than the second granularity threshold, it means that a more fine-grained vulnerability scan can be performed, and a deeper vulnerability scan can be achieved, thereby effectively ensuring network security. Among them, the second fine-grained threshold can be the same as the first fine-grained threshold. In this embodiment, no specific limitation is made on the first fine-grained threshold and the second fine-grained threshold.

[0056] In step 330, when the message sensitivity of the plaintext message is the second message sensitivity, the fourth vulnerability scanning strategy corresponding to the second message sensitivity is called, wherein the plaintext message with the message sensitivity of the second message sensitivity does not have sensitive information; and the fourth vulnerability scanning granularity of the fourth vulnerability scanning strategy is greater than or equal to the second granularity threshold.

[0057] In step 340, the parameters in the plaintext message are scanned and processed according to the fourth vulnerability scanning fine granularity to obtain a processed plaintext message.

[0058] In another embodiment, when the message sensitivity of the plaintext message is the second message sensitivity, that is, when the encrypted traffic to be processed does not contain sensitive information, there is no need to perform a deeper vulnerability scan because the encrypted traffic to be processed does not contain sensitive information. During the application process, the fourth vulnerability scanning strategy corresponding to the second message sensitivity can be called, and the parameters in the plaintext message can be scanned and processed according to the fourth vulnerability scanning granularity of the fourth vulnerability scanning strategy to obtain the processed plaintext message. Since the fourth vulnerability scanning granularity is greater than or equal to the second granularity threshold, it means that a non-deep vulnerability scan can be performed, which can reduce the amount of calculation in the vulnerability scanning process. Since there is no need to perform a higher level of vulnerability scanning for the encrypted traffic to be processed that does not contain sensitive information, relative security can be guaranteed without affecting user use, thereby achieving a balance between scanning cost and scanning security.

[0059] In another exemplary embodiment of the present invention, continuing with the above Figure 1 The embodiment described above is used as an example for explanation. Among them, the response message can be an encrypted response message. The encrypted response message is encrypted on the server side, which can avoid leakage or tampering during the transmission process. Before receiving the response message sent by the server corresponding to the processed plaintext message (corresponding to step 140), the encrypted traffic vulnerability scanning detection method can also include the following steps:

[0060] Decrypting the encrypted response message to obtain a decrypted response message;

[0061] Among them, receiving a response message sent by the server corresponding to the processed plaintext message, and determining whether there is a vulnerability in the encrypted traffic to be processed based on the response message (corresponding to step 140) can be implemented in the following manner:

[0062] Receiving a decrypted response message sent by the server, wherein the decrypted response message corresponds to the processed plaintext message;

[0063] When it is detected that the decrypted response message has a preset identifier, it is determined that the encrypted traffic to be processed has a vulnerability;

[0064] When it is detected that the decrypted response message does not have a preset identifier, it is determined that there is no vulnerability in the encrypted traffic to be processed.

[0065] In one embodiment, the encrypted response message may be decrypted to obtain a decrypted response message. Further, the decrypted response message sent by the receiving server is received, wherein, since the encrypted response message is obtained based on the processed plaintext message before encryption, the decrypted response message corresponds to the processed plaintext message.

[0066] During the application process, when it is detected that the decrypted response message has a preset identifier, it can be determined that there is a vulnerability in the encrypted traffic to be processed; when it is detected that the decrypted response message does not have a preset identifier, it can be determined that there is no vulnerability in the encrypted traffic to be processed. Among them, the preset identifier can be determined according to the actual situation and is not specifically limited in this embodiment. In another example, if the response message with the Payload successfully exploits the vulnerability, it can be indicated that the response message has a preset identifier, indicating that there is a vulnerability in the encrypted traffic to be processed; if the response message with the Payload does not successfully exploit the vulnerability, it can be indicated that the response message does not have a preset identifier, indicating that there is no vulnerability in the encrypted traffic to be processed.

[0067] In another exemplary embodiment of the present invention, the above-mentioned embodiment is continued to be used as an example for explanation. Before decrypting the encrypted traffic to be processed to obtain a plaintext message corresponding to the encrypted traffic to be processed (corresponding to step 120), the encrypted traffic vulnerability scanning and detection method may further include the following steps:

[0068] Screen the encrypted traffic to be processed to obtain key traffic in the encrypted traffic to be processed;

[0069] The encrypted traffic to be processed is decrypted to obtain a plaintext message corresponding to the encrypted traffic to be processed (corresponding to step 120), which can be implemented in the following manner:

[0070] Decrypt the key traffic to obtain the plaintext message corresponding to the encrypted traffic to be processed.

[0071] In one embodiment, the encrypted traffic to be processed can be screened to obtain key traffic in the encrypted traffic to be processed, wherein the key traffic can be considered as the core traffic in the encrypted traffic to be processed, and after decrypting it, key parameter information about the encrypted traffic to be processed can be obtained. Further, the key traffic can be decrypted to obtain a plaintext message corresponding to the encrypted traffic to be processed. In this embodiment, by eliminating irrelevant traffic and decrypting the key traffic, the calculation amount of the decryption step can be reduced, and the work efficiency is improved while ensuring the final result.

[0072] In another exemplary embodiment of the present invention, the above-mentioned embodiment is continued to be used as an example for description. After obtaining the processed plaintext message, the encrypted traffic vulnerability scanning and detection method may further include the following steps:

[0073] Encrypting the processed plaintext message to obtain an encrypted plaintext message, and using the encrypted plaintext message as the processed plaintext message;

[0074] Among them, sending the processed plaintext message to the server can be achieved in the following ways:

[0075] Send the encrypted plaintext message to the server;

[0076] Among them, receiving the response message sent by the server corresponding to the processed plaintext message can be implemented in the following ways:

[0077] Receive the response message sent by the server corresponding to the encrypted plaintext message.

[0078] In one embodiment, the processed plaintext message can also be encrypted to obtain an encrypted plaintext message, thereby ensuring the security of the plaintext message and preventing it from being tampered with or attacked during transmission. Further, the encrypted plaintext message can be used as the processed plaintext message, and the encrypted plaintext message can be sent to the server. Thus, the security during transmission to the server is ensured. Further, a response message corresponding to the encrypted plaintext message sent by the server can be received. In this embodiment, by encrypting the processed plaintext message to obtain an encrypted plaintext message, the security of the plaintext message can be ensured, preventing it from being tampered with or attacked during transmission, and laying a foundation for the accuracy of subsequent vulnerability detection.

[0079] According to the above description, the encrypted traffic vulnerability scanning and detection method provided by the present invention obtains the encrypted traffic to be processed; decrypts the encrypted traffic to be processed to obtain the plaintext message corresponding to the encrypted traffic to be processed; then, according to the business type or message sensitivity of the plaintext message, calls the vulnerability scanning strategy corresponding to the business type or message sensitivity to process the plaintext message to obtain the processed plaintext message, and sends the processed plaintext message to the server; and receives the response message corresponding to the processed plaintext message sent by the server, and determines whether there is a vulnerability in the encrypted traffic to be processed based on the response message. Vulnerability detection of encrypted traffic is achieved, thereby ensuring network security in the context of encrypted traffic.

[0080] Based on the same concept, the present invention also provides an encrypted traffic vulnerability scanning and detection device.

[0081] The encrypted traffic vulnerability scanning detection device provided by the present invention is described below. The encrypted traffic vulnerability scanning detection device described below and the encrypted traffic vulnerability scanning detection method described above can be referenced to each other.

[0082] Figure 4 It is a structural schematic diagram of the encrypted traffic vulnerability scanning detection device provided by the present invention.

[0083] In an exemplary embodiment of the present invention, Figure 4It can be seen that the encrypted traffic vulnerability scanning and detection device may include an acquisition module 410, a decryption module 420, a calling module 430, and a processing module 440, and each module will be introduced below.

[0084] The acquisition module 410 may be configured to acquire encrypted traffic to be processed;

[0085] The decryption module 420 may be configured to decrypt the encrypted traffic to be processed to obtain a plaintext message corresponding to the encrypted traffic to be processed;

[0086] The calling module 430 may be configured to call a vulnerability scanning strategy corresponding to the service type or message sensitivity of the plaintext message to process the plaintext message according to the service type or message sensitivity of the plaintext message, obtain a processed plaintext message, and send the processed plaintext message to the server;

[0087] The processing module 440 may be configured to receive a response message sent by the server corresponding to the processed plaintext message, and determine whether the encrypted traffic to be processed has a vulnerability based on the response message.

[0088] In an exemplary embodiment of the present invention, the calling module 430 may use the following method to implement, according to the service type of the plaintext message, calling the vulnerability scanning strategy corresponding to the service type to process the plaintext message to obtain the processed plaintext message:

[0089] In the case where the service type of the plaintext message is a first service type for interacting with a user, calling a first vulnerability scanning strategy corresponding to the first service type, wherein a first vulnerability scanning granularity of the first vulnerability scanning strategy is less than a first granularity threshold;

[0090] Scan and process the parameters in the plaintext message according to the first vulnerability scanning granularity to obtain a processed plaintext message;

[0091] In the case where the service type of the plaintext message is a second service type that does not interact with a user, calling a second vulnerability scanning strategy corresponding to the second service type, wherein a second vulnerability scanning granularity of the second vulnerability scanning strategy is greater than or equal to a first granularity threshold;

[0092] The parameters in the plaintext message are scanned and processed according to the second vulnerability scanning granularity to obtain a processed plaintext message.

[0093] In an exemplary embodiment of the present invention, the calling module 430 may use the following method to process the plaintext message according to the message sensitivity of the plaintext message by calling the vulnerability scanning strategy corresponding to the message sensitivity to obtain the processed plaintext message:

[0094] In the case where the message sensitivity of the plaintext message is the first message sensitivity, calling a third vulnerability scanning strategy corresponding to the first message sensitivity, wherein the plaintext message whose message sensitivity is the first message sensitivity has sensitive information; and the third vulnerability scanning granularity of the third vulnerability scanning strategy is less than the second granularity threshold;

[0095] Scan and process the parameters in the plaintext message according to the third vulnerability scanning granularity to obtain a processed plaintext message;

[0096] In the case where the message sensitivity of the plaintext message is the second message sensitivity, calling a fourth vulnerability scanning strategy corresponding to the second message sensitivity, wherein the plaintext message whose message sensitivity is the second message sensitivity does not have sensitive information; and the fourth vulnerability scanning granularity of the fourth vulnerability scanning strategy is greater than or equal to the second granularity threshold;

[0097] The parameters in the plaintext message are scanned and processed according to the fourth vulnerability scanning granularity to obtain a processed plaintext message.

[0098] In an exemplary embodiment of the present invention, the calling module 430 may use the following method to call the vulnerability scanning strategy corresponding to the service type or message sensitivity to process the plaintext message:

[0099] A vulnerability scanning strategy corresponding to the business type or message sensitivity is called to add abnormal code to the plaintext message.

[0100] In an exemplary embodiment of the present invention, the response message is an encrypted response message; the processing module 440 may also be configured to:

[0101] Decrypting the encrypted response message to obtain a decrypted response message;

[0102] The processing module 440 may also receive a response message sent by the server corresponding to the processed plaintext message, and determine whether the encrypted traffic to be processed has a vulnerability based on the response message in the following manner:

[0103] Receiving the decrypted response message sent by the server, wherein the decrypted response message corresponds to the processed plaintext message;

[0104] In the case where it is detected that the decrypted response message has a preset identifier, determining that the encrypted traffic to be processed has a vulnerability;

[0105] When it is detected that the decrypted response message does not have a preset identifier, it is determined that the encrypted traffic to be processed does not have a vulnerability.

[0106] In an exemplary embodiment of the present invention, the decryption module 420 may also be configured to:

[0107] Screening the encrypted traffic to be processed to obtain key traffic in the encrypted traffic to be processed;

[0108] The decryption module 420 may implement decryption processing on the encrypted traffic to be processed to obtain a plaintext message corresponding to the encrypted traffic to be processed in the following manner:

[0109] The key traffic is decrypted to obtain a plaintext message corresponding to the encrypted traffic to be processed.

[0110] In an exemplary embodiment of the present invention, the calling module 430 may also be configured to:

[0111] Encrypting the processed plaintext message to obtain an encrypted plaintext message, and using the encrypted plaintext message as the processed plaintext message;

[0112] The calling module 430 may implement sending the processed plaintext message to the server in the following manner:

[0113] Sending the encrypted plaintext message to a server;

[0114] The processing module 440 may implement receiving a response message sent by the server corresponding to the processed plaintext message in the following manner:

[0115] Receive a response message sent by the server corresponding to the encrypted plaintext message.

[0116] Figure 5 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 5As shown, the electronic device may include: a processor 510, a communication interface 520, a memory 530 and a communication bus 540, wherein the processor 510, the communication interface 520 and the memory 530 communicate with each other through the communication bus 540. The processor 510 may call the logic instructions in the memory 530 to execute the encrypted traffic vulnerability scanning detection method, which includes: obtaining the encrypted traffic to be processed; decrypting the encrypted traffic to be processed to obtain a plaintext message corresponding to the encrypted traffic to be processed; according to the service type or message sensitivity of the plaintext message, calling the vulnerability scanning strategy corresponding to the service type or message sensitivity to process the plaintext message to obtain a processed plaintext message, and sending the processed plaintext message to the server; receiving a response message corresponding to the processed plaintext message sent by the server, and determining whether the encrypted traffic to be processed has a vulnerability based on the response message.

[0117] In addition, the logic instructions in the above-mentioned memory 530 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0118] On the other hand, the present invention also provides a computer program product, which includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the encrypted traffic vulnerability scanning and detection method provided by the above-mentioned methods, and the method includes: obtaining the encrypted traffic to be processed; decrypting the encrypted traffic to be processed to obtain a plaintext message corresponding to the encrypted traffic to be processed; according to the business type or message sensitivity of the plaintext message, calling the vulnerability scanning strategy corresponding to the business type or message sensitivity to process the plaintext message to obtain a processed plaintext message, and sending the processed plaintext message to a server; receiving a response message sent by the server corresponding to the processed plaintext message, and determining whether there is a vulnerability in the encrypted traffic to be processed based on the response message.

[0119] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the encrypted traffic vulnerability scanning and detection method provided by the above-mentioned methods, the method comprising: obtaining the encrypted traffic to be processed; decrypting the encrypted traffic to be processed to obtain a plaintext message corresponding to the encrypted traffic to be processed; according to the business type or message sensitivity of the plaintext message, calling a vulnerability scanning strategy corresponding to the business type or message sensitivity to process the plaintext message to obtain a processed plaintext message, and sending the processed plaintext message to a server; receiving a response message sent by the server corresponding to the processed plaintext message, and determining whether there is a vulnerability in the encrypted traffic to be processed based on the response message.

[0120] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0121] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0122] It is further understood that, although the operations are described in a specific order in the accompanying drawings in the embodiments of the present invention, it should not be understood as requiring the operations to be performed in the specific order or serial order shown, or requiring the execution of all the operations shown to obtain the desired results. In certain environments, multitasking and parallel processing may be advantageous.

[0123] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for scanning and detecting encrypted traffic vulnerabilities, characterized in that: The method comprises: Acquire the encrypted traffic to be processed, wherein the encrypted traffic to be processed is acquired between a network link between a client and a server; Decrypting the encrypted traffic to be processed to obtain a plaintext message corresponding to the encrypted traffic to be processed; According to the service type or message sensitivity of the plaintext message, calling the vulnerability scanning strategy corresponding to the service type or message sensitivity to process the plaintext message, obtaining a processed plaintext message, and sending the processed plaintext message to the server; A response message corresponding to the processed plaintext message sent by the server is received, and based on the response message, it is determined whether the encrypted traffic to be processed has a vulnerability, wherein: The calling, according to the service type of the plaintext message, a vulnerability scanning strategy corresponding to the service type to process the plaintext message to obtain a processed plaintext message specifically includes: In the case where the service type of the plaintext message is a first service type for interacting with a user, calling a first vulnerability scanning strategy corresponding to the first service type, wherein a first vulnerability scanning granularity of the first vulnerability scanning strategy is less than a first granularity threshold; Scan and process the parameters in the plaintext message according to the first vulnerability scanning granularity to obtain a processed plaintext message; In the case where the service type of the plaintext message is a second service type that does not interact with a user, calling a second vulnerability scanning strategy corresponding to the second service type, wherein a second vulnerability scanning granularity of the second vulnerability scanning strategy is greater than or equal to a first granularity threshold; Scanning and processing the parameters in the plaintext message according to the second vulnerability scanning granularity to obtain a processed plaintext message, wherein, according to the message sensitivity of the plaintext message, calling a vulnerability scanning strategy corresponding to the message sensitivity to process the plaintext message to obtain the processed plaintext message specifically includes: In the case where the message sensitivity of the plaintext message is the first message sensitivity, calling a third vulnerability scanning strategy corresponding to the first message sensitivity, wherein the plaintext message whose message sensitivity is the first message sensitivity has sensitive information; and the third vulnerability scanning granularity of the third vulnerability scanning strategy is less than the second granularity threshold; Scan and process the parameters in the plaintext message according to the third vulnerability scanning granularity to obtain a processed plaintext message; In the case where the message sensitivity of the plaintext message is the second message sensitivity, calling a fourth vulnerability scanning strategy corresponding to the second message sensitivity, wherein the plaintext message whose message sensitivity is the second message sensitivity does not have sensitive information; and the fourth vulnerability scanning granularity of the fourth vulnerability scanning strategy is greater than or equal to the second granularity threshold; The parameters in the plaintext message are scanned and processed according to the fourth vulnerability scanning granularity to obtain a processed plaintext message.

2. The encrypted traffic vulnerability scanning and detection method according to claim 1 is characterized in that: The calling of a vulnerability scanning strategy corresponding to the service type or message sensitivity to process the plaintext message specifically includes: A vulnerability scanning strategy corresponding to the business type or message sensitivity is called to add abnormal code to the plaintext message.

3. The encrypted traffic vulnerability scanning and detection method according to claim 1 is characterized in that: The response message is an encrypted response message; Before receiving a response message sent by the server corresponding to the processed plaintext message, the method further includes: Decrypting the encrypted response message to obtain a decrypted response message; The receiving a response message sent by the server corresponding to the processed plaintext message, and determining whether the encrypted traffic to be processed has a vulnerability based on the response message, specifically includes: Receiving the decrypted response message sent by the server, wherein the decrypted response message corresponds to the processed plaintext message; In the case where it is detected that the decrypted response message has a preset identifier, determining that the encrypted traffic to be processed has a vulnerability; When it is detected that the decrypted response message does not have a preset identifier, it is determined that the encrypted traffic to be processed does not have a vulnerability.

4. The encrypted traffic vulnerability scanning and detection method according to claim 1 is characterized in that: Before decrypting the encrypted traffic to be processed to obtain a plaintext message corresponding to the encrypted traffic to be processed, the method further includes: Screening the encrypted traffic to be processed to obtain key traffic in the encrypted traffic to be processed; The decrypting the encrypted traffic to be processed to obtain a plaintext message corresponding to the encrypted traffic to be processed specifically includes: The key traffic is decrypted to obtain a plaintext message corresponding to the encrypted traffic to be processed.

5. The encrypted traffic vulnerability scanning and detection method according to claim 1 is characterized in that: After obtaining the processed plaintext message, the method further includes: Encrypting the processed plaintext message to obtain an encrypted plaintext message, and using the encrypted plaintext message as the processed plaintext message; The sending the processed plaintext message to the server specifically includes: Sending the encrypted plaintext message to a server; The response message corresponding to the processed plaintext message sent by the receiving server specifically includes: Receive a response message sent by the server corresponding to the encrypted plaintext message.

6. An encrypted traffic vulnerability scanning and detection device, characterized in that: The device is used to implement the encrypted traffic vulnerability scanning detection method according to any one of claims 1 to 5, and the device includes: An acquisition module, used to acquire encrypted traffic to be processed; A decryption module, used to decrypt the encrypted traffic to be processed to obtain a plaintext message corresponding to the encrypted traffic to be processed; A calling module, used for calling a vulnerability scanning strategy corresponding to the business type or message sensitivity of the plaintext message to process the plaintext message according to the business type or message sensitivity of the plaintext message, obtaining a processed plaintext message, and sending the processed plaintext message to a server; The processing module is used to receive a response message sent by the server corresponding to the processed plaintext message, and determine whether the encrypted traffic to be processed has a vulnerability based on the response message.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the encrypted traffic vulnerability scanning and detection method as described in any one of claims 1 to 5 is implemented.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the encrypted traffic vulnerability scanning and detection method as described in any one of claims 1 to 5 is implemented.

Images