Traffic hijacking identification method and device, electronic equipment, storage medium and product

Abstract

The present disclosure provides a traffic hijacking identification method and device, electronic equipment, storage medium and product. The method comprises: sending a server response packet to a client, wherein the server response packet comprises SSL characteristic information of a server; obtaining response data sent by the client in response to the server response packet; and determining whether the client is a client with traffic hijacking behavior based on the response data.

Description

Technical Field

[0001] This disclosure relates to the field of traffic security technology, and in particular to a traffic hijacking identification method, apparatus, electronic device, storage medium and product. Background Technology

[0002] In related technologies, the identification of client traffic hijacking behavior usually adopts two methods: First, start from the network request packets and analyze whether there is an attack payload to infer whether there is traffic hijacking behavior; Second, install a monitoring agent on the client and analyze the client process through the agent to infer whether there is traffic hijacking behavior.

[0003] However, the first method mentioned above primarily relies on attack payloads for identification. Attackers can use obfuscation or escaping techniques to disguise attack payloads as legitimate messages to evade identification logic, leading to a high false negative rate. The second method, which involves installing a monitoring agent on the client side, is generally suitable for environments with strong internal regulatory requirements. However, it cannot achieve seamless deployment in public environments, impacting user experience and resulting in lower universality. Summary of the Invention

[0004] This disclosure provides a traffic hijacking identification method, apparatus, electronic device, storage medium, and product to solve problems in related technologies.

[0005] A first aspect of this disclosure provides a method for identifying traffic hijacking, the method comprising:

[0006] Send a server response packet to the client, the server response packet including the server's SSL signature information;

[0007] Obtain the response data sent by the client in response to the server's response packet;

[0008] Based on the response data, it is determined whether the client is a client that engages in traffic hijacking behavior.

[0009] In one embodiment, obtaining the response data sent by the client in response to the server's response packet includes:

[0010] In response to the client receiving the server response packet, the preset detection tool is used to obtain the client's SSL certificate information sent by the client in response to the server response packet;

[0011] The step of determining whether the client is engaging in traffic hijacking behavior based on the response data includes:

[0012] Determine whether the SSL certificate information in the SSL feature information of the server is consistent with the SSL certificate information of the client;

[0013] If the judgment result is negative, then the client is determined to be a client that engages in traffic hijacking behavior.

[0014] In one embodiment, in response to the client receiving the response packet, the method provided in this disclosure further includes:

[0015] Use preset detection tools to obtain user behavior feature information from client response packets; a client response packet refers to the response packet sent by the client to the server after receiving the server response packet; user behavior feature information includes at least one of the user's session frequency, session duration, or number of sessions;

[0016] Based on user behavior characteristics, generate a feature fingerprint of the SSL connection to be inspected;

[0017] Determine whether the SSL certificate information on the server side matches the SSL certificate information on the client side, including:

[0018] Determine whether the SSL certificate information on the server side is consistent with the SSL certificate information on the client side, and determine whether the SSL connection feature fingerprint to be inspected is consistent with the original SSL connection feature fingerprint;

[0019] If the judgment result is negative, then the client is determined to be a client engaging in traffic hijacking behavior, including:

[0020] If there is a negative result in the judgment, then the client is determined to be a client that is engaging in traffic hijacking.

[0021] In one embodiment, user behavior characteristic information includes the user's session frequency, session duration, and number of sessions;

[0022] In one embodiment, in response to the client receiving the response packet, the method provided in this disclosure further includes:

[0023] Use pre-set detection tools to obtain the client's proxy gateway characteristics; the proxy gateway characteristics include at least one of the following: the service category to which the proxy gateway belongs, the Uniform Resource Locator (URL) icon, or the port number;

[0024] Determine whether the SSL certificate information on the server side matches the SSL certificate information on the client side, and determine whether the SSL connection fingerprint under inspection matches the original SSL connection fingerprint, including:

[0025] It determines whether the SSL certificate information on the server side is consistent with the SSL certificate information on the client side, whether the SSL connection feature fingerprint to be inspected is consistent with the original SSL connection feature fingerprint, and whether the proxy gateway feature is consistent with the preset proxy gateway feature.

[0026] In one embodiment, in response to the client receiving the response packet, the method provided in this disclosure further includes:

[0027] The first time interval from when a traffic packet is sent by the client to when it is received by the server is obtained using a preset detection tool. A traffic packet refers to a traffic packet used in communication between the client and the server.

[0028] Determine whether the SSL certificate information on the server side matches the SSL certificate information on the client side, and determine whether the SSL connection fingerprint under inspection matches the original SSL connection fingerprint, including:

[0029] It determines whether the SSL certificate information of the server is consistent with the SSL certificate information of the client, whether the SSL connection feature fingerprint to be inspected is consistent with the original SSL connection feature fingerprint, whether the proxy gateway feature is consistent with the preset proxy gateway feature, and whether the first duration is greater than the preset duration.

[0030] In one embodiment, before determining whether the SSL certificate information in the SSL feature information of the server is consistent with the SSL certificate information of the client, the method provided in this disclosure further includes:

[0031] Obtain the SSL characteristic information of the server; wherein, the SSL certificate information of the server includes at least one of the following: SSL certificate issuing authority, SSL certificate expiration time, domain name associated with the SSL certificate, IP address bound to the SSL certificate, TLS version, cipher suite, extended information, compression algorithm, and browser information.

[0032] A second aspect of this disclosure provides a traffic hijacking identification device, the device comprising:

[0033] The sending unit is used to send a server response packet to the client, wherein the server response packet includes the server's SSL characteristic information;

[0034] The acquisition unit is used to acquire the response data sent by the client in response to the server's response packet;

[0035] The determining unit is used to determine, based on the response data, whether the client is a client that engages in traffic hijacking behavior.

[0036] A third aspect of this disclosure provides an electronic device comprising:

[0037] At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the methods described in the first aspect of this disclosure.

[0038] A fourth aspect of this disclosure provides a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause a computer to perform the methods described in the first aspect of this disclosure.

[0039] A fifth aspect of this disclosure provides a computer program product including a computer program that, when executed by a processor, implements the methods described in the first aspect of this disclosure.

[0040] In summary, this disclosure proposes a traffic hijacking identification method, apparatus, electronic device, storage medium, and product. The method includes: sending a server response packet to a client, wherein the server response packet includes a preset detection tool, the preset detection tool being used to detect client characteristic information; acquiring response data sent by the client in response to the server response packet; and determining, based on the response data, whether the client is a client engaging in traffic hijacking behavior.

[0041] The solution provided in this disclosure sends a response packet containing the server's SSL signature information to the client, thereby obtaining the client's response data in response to the server's response packet. Based on this response data, it determines whether the client is engaging in traffic hijacking. In this process, since there is no need to obtain the attack payload from the client or install an agent on the client, the false negative rate of traffic hijacking is reduced, while also achieving deployment without the user's awareness.

[0042] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0043] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure, and are not intended to unduly limit this disclosure.

[0044] Figure 1 A flowchart illustrating the traffic hijacking identification method provided in this embodiment of the disclosure;

[0045] Figure 2 This is a schematic diagram of the process for generating a feature fingerprint of an SSL connection to be inspected, provided in an embodiment of this disclosure.

[0046] Figure 3 A flowchart illustrating the process of determining the characteristic fingerprint of an SSL connection to be inspected, as provided in an embodiment of this disclosure;

[0047] Figure 4A schematic diagram of the process for obtaining the proxy gateway characteristics of a client according to an embodiment of this disclosure;

[0048] Figure 5 This is a schematic diagram of the traffic hijacking identification device provided in the embodiments of this disclosure;

[0049] Figure 6 This is a schematic diagram of the hardware composition structure of an electronic device provided in an embodiment of this disclosure. Detailed Implementation

[0050] Embodiments of this disclosure are described in detail below. Examples of these embodiments are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain this disclosure, and should not be construed as limiting this disclosure.

[0051] To address the shortcomings of related technologies, this disclosure provides a traffic hijacking identification method, apparatus, electronic device, storage medium, and product. The traffic hijacking method provided in this disclosure obtains the client's SSL certificate information through a preset detection tool within the server-side response packet sent to the client. Then, it determines whether the client is engaging in traffic hijacking behavior based on whether the server's SSL certificate information matches the client's SSL certificate information. In this process, since there is no need to obtain the attack payload from the client or install an agent on the client, the false negative rate of traffic hijacking behavior is reduced, and deployment is achieved without the user's awareness.

[0052] The traffic hijacking method disclosed herein can be applied to the data transmission system described below.

[0053] The data transmission system includes several node devices, and the number of node devices is not limited. Node devices can be servers or terminals; this application uses a terminal as an example. The client is deployed on the terminal. The client can run on the terminal via a browser or as a standalone application (APP), etc. The specific form of the client is not limited here. The server involved in this application can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms. The terminal can be a mobile phone, computer, smart voice interaction device, smart home appliance, vehicle terminal, or aircraft, but is not limited to these. The embodiments of this application can be applied to various scenarios, including but not limited to cloud technology, artificial intelligence, smart transportation, and assisted driving.

[0054] The present disclosure will now be described in further detail with reference to the accompanying drawings and specific embodiments.

[0055] like Figure 1 As shown, Figure 1 This is a flowchart illustrating the traffic hijacking identification method provided in this embodiment of the disclosure. The traffic hijacking identification method provided in this embodiment of the disclosure includes the following steps:

[0056] Step 101: Send a server response packet to the client. The server response packet includes the server's Secure Socket Layer (SSL) feature information.

[0057] In one embodiment, the SSL feature information includes at least the SSL certificate information of the server.

[0058] In one embodiment, SSL is a cryptographic security protocol. SSL initiates an authentication process called a handshake between two communicating devices to ensure that the two devices are indeed the real identities they claim. For example, a handshake between a server and a client.

[0059] In one embodiment, SSL also digitally signs the data transmitted between the server and the client to provide data integrity and verify that the data has not been tampered with before reaching the target recipient.

[0060] In one embodiment, the SSL certificate information of the server includes at least one of the following: SSL certificate issuing authority, SSL certificate expiration time, domain name associated with the SSL certificate, IP address bound to the SSL certificate, TLS version, cipher suite, extended information, compression algorithm, and browser information.

[0061] Step 102: Obtain the response data sent by the client in response to the server's response packet;

[0062] In one embodiment, a preset detection tool can be used to obtain the response data sent by the client in response to the server's response packet.

[0063] In one embodiment, the preset detection tool is used to detect client feature information.

[0064] In one embodiment, the client characteristic information includes at least the client's SSL certificate information.

[0065] In one embodiment, the server response packet refers to the response packet generated by the server in response to the handshake request from the client.

[0066] In one embodiment, during the handshake authentication process between the server and the client, the server generates its own SSL certificate information, and the client generates its own SSL certificate information.

[0067] Step 103: Based on the response data, determine whether the client is a client that is engaging in traffic hijacking behavior.

[0068] In summary, the traffic hijacking identification method provided in this disclosure includes: sending a server response packet to a client, wherein the server response packet includes a preset detection tool, the preset detection tool being used to detect client characteristic information; obtaining the response data sent by the client in response to the server response packet; and determining, based on the response data, whether the client is a client engaging in traffic hijacking behavior.

[0069] The solution provided in this disclosure sends a response packet containing the server's SSL signature information to the client, thereby obtaining the client's response data in response to the server's response packet. Based on this response data, it determines whether the client is engaging in traffic hijacking. In this process, since there is no need to obtain the attack payload from the client or install an agent on the client, the false negative rate of traffic hijacking is reduced, while also achieving deployment without the user's awareness.

[0070] In one embodiment, step 102 includes:

[0071] In response to the client receiving the server response packet, the preset detection tool is used to obtain the client's SSL certificate information sent by the client in response to the server response packet;

[0072] In one embodiment, the preset detection tool may be a tool that is implanted into the server response packet in the form of code or script.

[0073] In one embodiment, a preset detection tool is used to obtain the client's SSL certificate information after the client receives the data.

[0074] In one embodiment, the preset detection tool can be used as a patch or similar tool, and is sent to the client along with the server response packet when the server sends the server response packet to the client.

[0075] Accordingly, step 103 includes:

[0076] Determine whether the SSL certificate information in the SSL feature information of the server is consistent with the SSL certificate information of the client;

[0077] In one embodiment, packet capture tools used for traffic hijacking must set themselves as HTTPS proxy gateways to capture traffic. To make HTTPS traffic appear trustworthy, a common method is to forge the SSL certificate of the business system.

[0078] In one embodiment, a pre-defined detection tool obtains the client's SSL certificate information when establishing an HTTPS connection and compares it with the server's SSL certificate information. If a difference exists, the forged SSL certificate of the business system can be used as evidence that the client is engaging in traffic hijacking.

[0079] If the judgment result is negative, then the client is determined to be a client that engages in traffic hijacking behavior.

[0080] Step 105: If the judgment result is negative, then the client is determined to be a client that engages in traffic hijacking behavior.

[0081] In one embodiment, when a client establishes an SSL connection with a server, the characteristics of each ClientHello packet sent by the same application will be identical. However, the characteristics of different applications will vary. Therefore, the characteristic information of different applications can be reduced in dimensionality to generate feature fingerprints, which can serve as key factors for identifying the application.

[0082] Based on this, such as Figure 2 As shown, in one embodiment, after the client receives the server response packet, the traffic hijacking behavior identification method further includes:

[0083] Step 201: Use the preset detection tool to obtain user behavior feature information of the client;

[0084] In one embodiment, the user behavior feature information includes at least one of the user's session frequency, session duration, or number of sessions.

[0085] In one embodiment, data based on the SSL protocol is typically used for web page interaction, instant messaging, and voice. Therefore, to achieve efficient traffic capture, it is also necessary to focus on user behavior characteristics.

[0086] In one embodiment, user behavior characteristics can generally be divided into two main categories: user stickiness and user activity. User stickiness is mainly measured by session frequency and session duration, while user activity is mainly measured by the number of sessions.

[0087] In one embodiment, a preset probe tool in the server response packet sent by the server to the client can be used to parse the client response packet sent during the SSL handshake on the server side, and obtain one of the user's session frequency, session time, or session number in the ClientHello packet in turn.

[0088] Step 202: Based on the user behavior feature information, generate the feature fingerprint of the SSL connection to be inspected;

[0089] Accordingly, in one embodiment, step 103 includes:

[0090] Determine whether the SSL certificate information of the server is consistent with the SSL certificate information of the client, and determine whether the SSL connection feature fingerprint to be inspected is consistent with the original SSL connection feature fingerprint;

[0091] If there is a negative result, then the client is determined to be a client that is engaging in traffic hijacking.

[0092] In one embodiment, if the SSL certificate information of the server is inconsistent with the SSL certificate information of the client, or / and the SSL connection feature fingerprint to be inspected is inconsistent with the original SSL connection feature fingerprint, the client can be determined to be a client that has engaged in traffic hijacking behavior.

[0093] Based on the foregoing description, in one embodiment, user behavior feature information includes the user's session frequency, session duration, and number of sessions;

[0094] Correspondingly, such as Figure 3 As shown, in one embodiment, step 202 includes:

[0095] Step 301: Use the Message Digest Algorithm 5 (MD5) to convert the session frequency, session time, and number of sessions into 64-bit hash values.

[0096] In one embodiment, MD5 can take in information of any length and output 64-bit fixed-length binary data.

[0097] In one embodiment, MD5 has a fast processing speed: MD5 operations are all 32-bit bitwise operations such as AND, OR, NOT, and bit shift, so its processing speed is fast and consumes almost no CPU time.

[0098] Step 302: The preset weights corresponding to the session frequency, the session time, and the number of sessions are weighted together with the 64-bit hash values ​​converted from the session frequency, the session time, and the number of sessions to obtain the weighted 64-bit hash values ​​corresponding to the session frequency, the session time, and the number of sessions.

[0099] Step 303: The 64-bit hash values ​​corresponding to the weighted session frequency, session time and session number are summed to obtain the summed 64-bit hash value.

[0100] Step 304: Use the Simhash algorithm to perform dimensionality reduction processing on the accumulated 64-bit hash value to obtain the feature fingerprint of the SSL connection to be inspected.

[0101] In one embodiment, when a client engages in traffic hijacking, it will inevitably activate a web service as a proxy gateway. Therefore, the service category, Uniform Resource Locator (URL) icon, and port number of this proxy gateway exhibit regularity. A pre-defined detection tool in the server-side response packet can collect and compare these regularities to determine whether the client is engaging in traffic hijacking.

[0102] Based on this, such as Figure 4 As shown, in one embodiment, in response to the client receiving the server response packet, the traffic hijacking behavior identification method further includes:

[0103] Step 401: Use the preset detection tool to obtain the proxy gateway characteristics of the client; the proxy gateway characteristics include at least one of the service category to which the proxy gateway belongs, the Uniform Resource Locator (URL) icon, or the port number;

[0104] Accordingly, in one embodiment, step 103 includes:

[0105] Determine whether the SSL certificate information of the server is consistent with the SSL certificate information of the client, determine whether the SSL connection feature fingerprint to be inspected is consistent with the original SSL connection feature fingerprint, and determine whether the proxy gateway feature is consistent with the preset proxy gateway feature.

[0106] If there is a negative result, then the client is determined to be a client that is engaging in traffic hijacking.

[0107] In one embodiment, if the SSL certificate information of the server is inconsistent with the SSL certificate information of the client, or / and the SSL connection feature fingerprint to be inspected is inconsistent with the original SSL connection feature fingerprint, or / and the proxy gateway feature is inconsistent with the preset proxy gateway feature, the client can be determined to be a client that has engaged in traffic hijacking behavior.

[0108] In one embodiment, the normal time for a client request data packet to travel from the client's browser to the server's reception is usually short. However, when an attacker intercepts the request data packet using tools, there is a delay in analyzing the message. This results in a longer time from packet transmission to reception. A pre-set detection tool in the server's response packet can be written into the request after encrypting the packet's transmission timestamp. When the server receives the data packet, it calculates the negative deviation of the time consumption from the normal average, which is then used as one of the preliminary factors for determining whether the client is engaging in traffic hijacking.

[0109] Based on this, in one embodiment, in response to the client receiving the server response packet, the traffic hijacking behavior identification method further includes:

[0110] The preset detection tool is used to obtain the first duration from when a traffic packet is sent by the client to when it is received by the server, where the traffic packet refers to the traffic packet used in the communication between the client and the server.

[0111] Accordingly, in one embodiment, step 103 includes:

[0112] The system determines whether the SSL certificate information of the server is consistent with the SSL certificate information of the client, whether the SSL connection feature fingerprint to be inspected is consistent with the original SSL connection feature fingerprint, whether the proxy gateway feature is consistent with the preset proxy gateway feature, and whether the first duration is greater than the preset duration.

[0113] To implement the traffic hijacking identification method provided in this disclosure, this disclosure also provides a traffic hijacking identification device, such as... Figure 5 As shown. Figure 5 This is a schematic diagram of the traffic hijacking identification device provided in an embodiment of the present disclosure. The traffic hijacking identification device 500 includes:

[0114] The sending unit 501 is used to send a server response packet to the client, wherein the server response packet includes the server's SSL characteristic information;

[0115] The acquisition unit 502 is used to acquire the response data sent by the client in response to the server response packet;

[0116] The determining unit 503 is used to determine, based on the response data, whether the client is a client that engages in traffic hijacking behavior.

[0117] In one embodiment, the acquisition unit 502 is specifically used for:

[0118] In response to the client receiving the server response packet, the preset detection tool is used to obtain the client's SSL certificate information sent by the client in response to the server response packet;

[0119] Accordingly, unit 503 is specifically used for:

[0120] Determine whether the SSL certificate information in the SSL feature information of the server is consistent with the SSL certificate information of the client;

[0121] If the judgment result is negative, then the client is determined to be a client that engages in traffic hijacking behavior.

[0122] In one embodiment, the traffic hijacking identification device 500 further includes a unit for generating a fingerprint of the SSL connection to be inspected. The unit for generating a fingerprint of the SSL connection to be inspected is used for:

[0123] Use preset detection tools to obtain user behavior feature information from client response packets; a client response packet refers to the response packet sent by the client to the server after receiving the server response packet; user behavior feature information includes at least one of the user's session frequency, session duration, or number of sessions;

[0124] Based on user behavior characteristics, generate a feature fingerprint of the SSL connection to be inspected.

[0125] Accordingly, in one embodiment, the determining unit 503 is specifically used for:

[0126] Determine whether the SSL certificate information on the server side is consistent with the SSL certificate information on the client side, and determine whether the SSL connection feature fingerprint to be inspected is consistent with the original SSL connection feature fingerprint;

[0127] If there is a negative result in the judgment, then the client is determined to be a client that is engaging in traffic hijacking.

[0128] In one embodiment, generating a feature fingerprint unit for the SSL connection to be inspected is specifically used for:

[0129] Based on user behavior characteristics, a feature fingerprint of the SSL connection to be inspected is generated, including:

[0130] The MD5 message digest algorithm is used to convert the session frequency, session time and number of sessions into 64-bit hash values.

[0131] The preset weights corresponding to session frequency, session time and session number are weighted together with the 64-bit hash values ​​converted from session frequency, session time and session number to obtain the weighted 64-bit hash values ​​corresponding to session frequency, session time and session number.

[0132] The 64-bit hash values ​​corresponding to the weighted session frequency, session time and session number are summed to obtain the summed 64-bit hash value.

[0133] The Simhash algorithm is used to reduce the dimensionality of the accumulated 64-bit hash value to obtain the feature fingerprint of the SSL connection to be inspected.

[0134] In one embodiment, the traffic hijacking identification device 500 further includes a proxy gateway feature acquisition unit, which is used to:

[0135] Use pre-set detection tools to obtain the client's proxy gateway characteristics; the proxy gateway characteristics include at least one of the following: the service category to which the proxy gateway belongs, the Uniform Resource Locator (URL) icon, or the port number;

[0136] Accordingly, in one embodiment, the determining unit 503 is specifically used for:

[0137] It determines whether the SSL certificate information on the server side is consistent with the SSL certificate information on the client side, whether the SSL connection feature fingerprint to be inspected is consistent with the original SSL connection feature fingerprint, and whether the proxy gateway feature is consistent with the preset proxy gateway feature.

[0138] In one embodiment, the traffic hijacking identification device 500 further includes a duration acquisition unit, which is used for:

[0139] The first time interval from when a traffic packet is sent by the client to when it is received by the server is obtained using a preset detection tool. A traffic packet refers to a traffic packet used in communication between the client and the server.

[0140] Accordingly, in one embodiment, the determining unit 503 is specifically used for:

[0141] It determines whether the SSL certificate information of the server is consistent with the SSL certificate information of the client, whether the SSL connection feature fingerprint to be inspected is consistent with the original SSL connection feature fingerprint, whether the proxy gateway feature is consistent with the preset proxy gateway feature, and whether the first duration is greater than the preset duration.

[0142] In one embodiment, the SSL certificate information on the server side includes at least one of the following: SSL certificate issuing authority, SSL certificate expiration time, domain name associated with the SSL certificate, IP address bound to the SSL certificate, TLS version, cipher suite, extended information, compression algorithm, and browser information.

[0143] It should be noted that the traffic hijacking identification device provided in the above embodiments is only illustrated by the division of the above program modules when performing traffic hijacking identification. In actual applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the traffic hijacking identification device can be divided into different program modules to complete all or part of the processing described above. In addition, the traffic hijacking identification device provided in the above embodiments and the traffic hijacking identification method embodiments provided in this disclosure belong to the same concept, and the specific implementation process is detailed in the method embodiments, which will not be repeated here.

[0144] Figure 6 This is a schematic diagram of the hardware composition structure of the electronic device provided in the embodiments of this disclosure, such as... Figure 6 As shown, the electronic device 600 includes at least one processor 602; and a memory 601 communicatively connected to at least one processor 602; wherein the memory 601 stores instructions executable by at least one processor 602, the instructions being executed by at least one processor 602 to implement the steps of the traffic hijacking identification method of the present disclosure embodiments.

[0145] Optionally, the electronic device may specifically be the traffic hijacking identification device in the embodiments of this application, and the electronic device may implement the corresponding processes implemented by the traffic hijacking identification device in the various methods of the embodiments of this application. For the sake of brevity, it will not be described in detail here.

[0146] It is understood that the electronic device also includes a communication interface 603. Various components in the electronic device are coupled together via a bus system 604. It is understood that the bus system 604 is used to implement communication between these components. In addition to a data bus, the bus system 604 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in... Figure 6 The general designated all buses as Bus System 604.

[0147] It is understood that memory 601 can be volatile memory or non-volatile memory, or both. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), ferromagnetic random access memory (FRAM), flash memory, magnetic surface memory, optical disc, or compact disc read-only memory (CD ROM); magnetic surface memory can be disk storage or magnetic tape storage. Volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Synchronous Static Random Access Memory (SSRAM), Dynamic Random Access Memory (DRAM), Synchronous Dynamic Random Access Memory (SDRAM), Double Data Rate Synchronous Dynamic Random Access Memory (DDRSDRAM), Enhanced Synchronous Dynamic Random Access Memory (ESDRAM), SyncLink Dynamic Random Access Memory (SLDRAM), and Direct Rambus Random Access Memory (DRRAM).The memory 601 described in this embodiment of the invention is intended to include, but is not limited to, these and any other suitable types of memory.

[0148] The methods disclosed in the above embodiments can be applied to or implemented by processor 602. Processor 602 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above methods can be completed by integrated logic circuits in the hardware of processor 602 or by instructions in software form. Processor 602 may be a general-purpose processor, DSP, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Processor 602 can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this invention. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of this invention can be directly manifested as execution by a hardware decoding processor, or execution by a combination of hardware and software modules in the decoding processor. The software modules may be located in a storage medium, specifically memory 601. Processor 602 reads information from memory 601 and, in conjunction with its hardware, completes the steps of the aforementioned methods.

[0149] In an exemplary embodiment, the electronic device may be implemented by one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), FPGAs, general-purpose processors, controllers, MCUs, microprocessors, or other electronic components to perform the aforementioned method.

[0150] This public security embodiment also provides a non-transitory computer-readable storage medium storing computer instructions, which are used to cause a computer to execute the steps of the traffic hijacking identification method of this embodiment.

[0151] Optionally, the computer-readable storage medium can be applied to the traffic hijacking identification device in the embodiments of this application, and the computer instructions cause the computer to execute the corresponding processes implemented by the traffic hijacking identification device in the various methods of the embodiments of this application. For the sake of brevity, they will not be described in detail here.

[0152] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods, such as: multiple units or components can be combined, or integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the various components shown or discussed can be through some interfaces, and the indirect coupling or communication connection between devices or units can be electrical, mechanical, or other forms.

[0153] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the units may be selected to achieve the purpose of this embodiment according to actual needs.

[0154] In addition, in the various embodiments of the present invention, each functional unit can be integrated into one processing unit, or each unit can be a separate unit, or two or more units can be integrated into one unit; the integrated unit can be implemented in hardware or in the form of hardware plus software functional units.

[0155] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above method embodiments. The aforementioned storage medium includes various media that can store program code, such as mobile storage devices, ROM, RAM, magnetic disks, or optical disks.

[0156] Alternatively, if the integrated units of this invention are implemented as software functional modules and sold or used as independent products, they can also be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this invention, or the parts that contribute to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the methods of the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as mobile storage devices, ROM, RAM, magnetic disks, or optical disks.

[0157] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A traffic hijacking identification method, characterized by, The method comprises: sending a server response packet to a client, wherein the server response packet comprises SSL feature information of a server; obtaining response data sent by the client in response to the server response packet; determining whether the client is a client with traffic hijacking behavior based on the response data; the obtaining of the response data sent by the client in response to the server response packet comprises: obtaining, by using a preset detection tool, SSL certificate information of the client, user behavior feature information, proxy gateway features, and a first time length of a traffic packet sent by the client to the server and received by the server in response to the server response packet, in response to the client receiving the server response packet, wherein the user behavior feature information at least comprises one of session frequency, session time or session quantity of a user, the proxy gateway features at least comprise one of a service category to which the proxy gateway belongs, a uniform resource locator (URL) icon or a port number, and the traffic packet refers to a traffic packet for communication between the client and the server; generating a to-be-inspected SSL connection feature fingerprint based on the user behavior feature information; the determining of whether the client is a client with traffic hijacking behavior based on the response data comprises: determining whether the SSL certificate information in the SSL feature information of the server is consistent with the SSL certificate information of the client, whether the to-be-inspected SSL connection feature fingerprint is consistent with an original SSL connection feature fingerprint, whether the proxy gateway features are consistent with preset proxy gateway features, and whether the first time length is less than a preset time length, to obtain a determination result; if there is a determination result that is false, it is determined that the client is a client with traffic hijacking behavior.

2. The method of claim 1, wherein, Before the determining of whether the SSL certificate information in the SSL feature information of the server is consistent with the SSL certificate information of the client, the method further comprises: obtaining the SSL feature information of the server, wherein the SSL certificate information of the server comprises at least one of an SSL certificate issuing authority, an SSL certificate expiration time, a domain name associated with the SSL certificate, an IP address bound to the SSL certificate, a TLS version, an encryption suite, extension information, a compression algorithm and browser information.

3. A traffic hijacking identification apparatus characterized by comprising: The method comprises: a sending unit configured to send a server response packet to a client, wherein the server response packet comprises SSL feature information of a server; an obtaining unit configured to obtain response data sent by the client in response to the server response packet; the obtaining of the response data sent by the client in response to the server response packet comprises: obtaining, by using a preset detection tool, SSL certificate information of the client, user behavior feature information, proxy gateway features, and a first time length of a traffic packet sent by the client to the server and received by the server in response to the server response packet, in response to the client receiving the server response packet, wherein the user behavior feature information at least comprises one of session frequency, session time or session quantity of a user, the proxy gateway features at least comprise one of a service category to which the proxy gateway belongs, a uniform resource locator (URL) icon or a port number, and the traffic packet refers to a traffic packet for communication between the client and the server; In response to the client receiving the server response packet, the preset detection tool is used to obtain the client's SSL certificate information, user behavior characteristic information, proxy gateway characteristics, and a first time length of a traffic packet sent by the client to the server and received by the server, the user behavior characteristic information at least including one of a user's session frequency, session time, or session quantity, the proxy gateway characteristics at least including one of a service category to which the proxy gateway belongs, a uniform resource locator (URL) icon, or a port number, and the traffic packet referring to a traffic packet communicated between the client and the server; based on the user behavior characteristic information, generating a to-be-inspected SSL connection characteristic fingerprint; a determination unit configured to determine, based on the response data, whether the client is a client with traffic hijacking behavior; the determination, based on the response data, of whether the client is a client with traffic hijacking behavior includes: determining whether the SSL certificate information in the SSL characteristic information of the server is consistent with the SSL certificate information of the client, whether the to-be-inspected SSL connection characteristic fingerprint is consistent with the original SSL connection characteristic fingerprint, whether the proxy gateway characteristics are consistent with preset proxy gateway characteristics, and whether the first time length is less than a preset time length, to obtain a determination result; if there is a determination result that is false, the client is determined to be a client with traffic hijacking behavior.

4. An electronic device, comprising: comprise: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1 to 2.

5. A non-transitory computer-readable storage medium having stored thereon computer instructions, wherein, The computer instructions are used to enable the computer to perform the method of any one of claims 1 to 2.

6. A computer program product, characterised in that, comprise a computer program that, when executed by a processor, implements the method of any one of claims 1 to 2.

Images