A method for end-host behavior perspective of encrypted traffic in network communication

Abstract

This invention relates to the field of encrypted traffic behavior detection technology, specifically a method for end-side behavior perspective of encrypted traffic in network communication. The method includes starting the business application of the terminal to be monitored, instrumenting and collecting application process creation information, instrumenting and collecting application function call information, restoring and identifying program function call stack information, filtering and identifying function information of application network behavior, reading unencrypted and decrypted data in network behavior, constructing and restoring network behavior, and realizing end-side behavior perspective of encrypted traffic.

Description

Technical Field

[0001] This invention relates to the field of encrypted traffic behavior detection technology, specifically a method for end-side behavior analysis of encrypted traffic in network communication. Background Technology

[0002] The global cybersecurity situation is becoming increasingly severe, and people are paying more and more attention to the protection of network data. Therefore, encryption protocols, such as TLS and SSL, are widely used in network transmission to ensure data integrity and confidentiality. However, it is also common for malware to use encrypted traffic to evade network analysis and detection. Moreover, malicious encrypted traffic that evades scrutiny is showing a trend of rapid change, diversity, strong attack, and high concealment.

[0003] For behavioral analysis and identification of encrypted traffic, existing technologies generally employ reverse analysis of cryptographic protocols and decryption of bypass mirrored traffic. Specifically, reverse analysis of cryptographic protocol formats involves identifying the plaintext buffer after decryption, using this buffer as a source of contamination, and extracting the protocol format by observing how the program processes it, thereby extracting relevant packets and achieving network behavior analysis. Bypass mirrored traffic decryption involves collecting the full traffic and then decrypting it using the server's private key certificate.

[0004] The reverse analysis of cryptographic protocol formats mainly relies on statistical rules to find the decryption function and then find the decrypted plaintext. This method cannot accurately locate the encryption and decryption functions, and it consumes a lot of terminal resources (CPU, memory, etc.) when running on terminal devices.

[0005] The bypass mirror traffic decryption method collects the full traffic at the network ingress and egress points. This results in a large amount of data, a complex detection and analysis process, low efficiency, and incomplete decryption due to packet loss. Furthermore, even when using forward security encryption protocols, decryption and behavioral analysis are still not possible.

[0006] Based on the above reasons, this invention designs a method for end-side behavior perspective of encrypted traffic in network communication. By capturing process information through dynamic binary instrumentation technology, restoring and identifying program call stack information, filtering and identifying function information of network behavior, and obtaining data organization, encapsulation and encryption methods, unencrypted data and decrypted data can be read, thereby realizing end-side behavior perspective of encrypted traffic. Summary of the Invention

[0007] The purpose of this invention is to overcome the shortcomings of the prior art and provide a method for end-side behavior perspective of encrypted traffic in network communication. By capturing process information through dynamic binary instrumentation technology, restoring and identifying program call stack information, filtering and identifying function information of network behavior, and obtaining data organization, encapsulation and encryption methods, unencrypted data and decrypted data can be read, thereby realizing end-side behavior perspective of encrypted traffic.

[0008] To achieve the above objectives, this invention provides a method for end-side behavior analysis of encrypted traffic in network communication, comprising the following steps:

[0009] S1, The service application of the terminal to be monitored is started;

[0010] S2, instrumentation to collect application process creation information: adopts cross-operating system dynamic binary instrumentation technology to capture process information when the program process is created, so as to collect data for subsequent instrumentation;

[0011] S3 instrumentes and collects application function call information, records the logical flow of the program during runtime, including the function stack, and records the function address, parameters, and return result;

[0012] S4, Reconstruct and identify program function call stack information, which is reconstructed and identified through a fixed protocol format of the data segment or the data structure pointed to by the function pointer;

[0013] S5 filters and identifies function information related to the network behavior of applications. The filtering and identification is based on general data to filter functions involving network traffic. These functions include: encryption functions, sending functions, receiving functions, decryption functions, and reading functions, which reveal the data organization, encapsulation, and encryption methods.

[0014] S6 reads unencrypted and decrypted data from network activity;

[0015] S7 constructs and restores network behavior, enabling insight into the end-side behavior of encrypted traffic. The reconstruction is based on unencrypted and decrypted data in the network behavior, forming a network interaction context.

[0016] Compared to existing technologies, this invention employs end-side behavior visualization technology and operating system-level dynamic binary instrumentation to achieve real-time capture during application process creation. This effectively reduces terminal resource consumption and avoids the massive data volume and packet loss issues associated with bypass mirror traffic decryption, thus improving the efficiency and accuracy of encrypted traffic analysis. By instrumenting application function call information, this invention can accurately record the program's runtime logic flow, including key information such as function addresses, parameters, and return results. Combined with reconstructing and identifying program function call stack information, it can deeply analyze the data organization and encapsulation methods in encrypted traffic, providing a new perspective for identifying malicious encrypted behavior. This invention filters and identifies encryption and decryption functions in network behavior, directly reading unencrypted and decrypted data from network behavior, bypassing the limitations of traditional decryption methods. This method not only improves analysis efficiency but also addresses forward security encryption protocols, enabling in-depth behavioral analysis and visualization of encrypted traffic, effectively enhancing network security protection capabilities. Attached Figure Description

[0017] Figure 1 This is a schematic diagram of the overall method flow of the present invention. Detailed Implementation

[0018] The present invention will now be further described with reference to the accompanying drawings.

[0019] join Figure 1 This invention provides a method for viewing the end-side behavior of encrypted traffic in network communication:

[0020] Includes the following steps:

[0021] S1, The service application of the terminal to be monitored is started;

[0022] S2, instrumentation to collect application process creation information: adopts cross-operating system dynamic binary instrumentation technology to capture process information when the program process is created, so as to collect data for subsequent instrumentation;

[0023] S3 instrumentes and collects application function call information, records the logical flow of the program during runtime, including the function stack, and records the function address, parameters, and return result;

[0024] S4, Reconstruct and identify program function call stack information, which is reconstructed and identified through a fixed protocol format of the data segment or the data structure pointed to by the function pointer;

[0025] S5 filters and identifies function information related to the network behavior of applications. The filtering and identification is based on general data to filter functions involving network traffic. These functions include: encryption functions, sending functions, receiving functions, decryption functions, and reading functions, which reveal the data organization, encapsulation, and encryption methods.

[0026] S6 reads unencrypted and decrypted data from network activity;

[0027] S7 constructs and restores network behavior, enabling insight into the end-side behavior of encrypted traffic. The reconstruction is based on unencrypted and decrypted data in the network behavior, forming a network interaction context.

[0028] The above are merely preferred embodiments of the present invention, intended only to aid in understanding the method and core ideas of this application. The scope of protection of the present invention is not limited to the above embodiments; all technical solutions falling within the scope of the present invention's concept are within its protection. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of the present invention should also be considered within the scope of protection of the present invention.

[0029] This invention comprehensively solves the problems of high decryption overhead, difficulty in decrypting nested encrypted streams, and inability to accurately identify terminal host network behavior in the behavior identification and analysis of encrypted traffic in existing technologies. Through end-side behavior perspective technology, accurate collection and reconstruction of function call information, and direct reading of unencrypted and decrypted data, it improves the efficiency and accuracy of encrypted traffic analysis. It deeply analyzes the data organization and encapsulation methods in encrypted traffic, providing a new perspective for identifying malicious encrypted behavior. It not only improves the efficiency of analysis but also can cope with forward security encryption protocols, realizing in-depth behavior analysis and perspective of encrypted traffic, and effectively enhancing network security protection capabilities.

Claims

1. A method for end-side behavior analysis of encrypted traffic in network communication, characterized in that, Includes the following steps: S1, The service application of the terminal to be monitored is started; S2, instrumentation to collect application process creation information: adopts cross-operating system dynamic binary instrumentation technology to capture process information when the program process is created, so as to collect data for subsequent instrumentation; S3 instrumentes and collects application function call information, records the logical flow of the program during runtime, including the function stack, and records the function address, parameters, and return result; S4, Restore and identify the program function call stack information, wherein the restoration and identification is performed by restoring and identifying through the data segment fixed protocol format or the data structure pointed to by the function pointer; S5, filter and identify function information of application network behavior. The filtering and identification is to filter functions involving network traffic based on general data. The functions include: encryption function, sending function, receiving function, decryption function, and reading function, to know the data organization, encapsulation, and encryption methods. S6 reads unencrypted and decrypted data from network activity; S7, construct and restore network behavior to achieve insight into the end-side behavior of encrypted traffic. The construction and restoration is to form a network interaction context based on the unencrypted data and decrypted data in the network behavior.

Images