Encrypted WEB scanning detection method, device and electronic device

Abstract

The present invention provides an encrypted WEB scanning detection method, device and electronic device, which relates to the field of network security technology. The method first collects encrypted WEB scanning traffic, and then extracts corresponding TLS handshake feature data and TCP handshake feature data from each scanning TLS data stream respectively; then respectively calculates information digests for each TLS handshake feature data and TCP handshake feature data to obtain a first group of information digest values ​​corresponding to each scanning TLS data stream; matches the second group of information digest values ​​corresponding to the TLS data stream to be detected with the first group of information digest values ​​corresponding to each scanning TLS data stream, and if the match is successful, the TLS data stream to be detected is scanning traffic. The method solves the technical problems of insufficient timely response and low accuracy for encrypted WEB scanning detection, and achieves the technical effect of improving scanning detection efficiency and accuracy.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an encrypted WEB scanning detection method, device and electronic equipment. Background Art

[0002] A network attack refers to the act of attacking systems and resources by exploiting the vulnerabilities and security flaws in network information systems. It usually consists of several subtasks with specific goals, such as reconnaissance, weaponization, delivery, utilization, installation, command, control, and implementation. In reality, programs that perform various reconnaissance tasks are collectively referred to as scanners. Depending on the scanned object, the functions of scanners can be further divided into system scanning, WEB scanning, database scanning, etc. Among them, the goal of a WEB scanner is to obtain WEB application (such as a website) information (such as the website page structure) and find vulnerabilities in order to subsequently launch attacks such as XSS (cross-site scripting attack), CSRF (cross-site request forgery), SQLi (SQL injection attack), etc., which ultimately lead to data leakage and / or loss, service interruption and other accidents.

[0003] It can be seen that once the scanning action is successfully blocked, the implementation of subsequent attacks will become groundless. However, more and more domestic and foreign scanners are currently using Transport Layer Security (TLS) encryption technology to evade detection and interception. Specifically, the network traffic packets that perform various scanning actions are fuzzy / random at the data level, which means that the defender can no longer extract specific attributes from the encrypted data packets to identify the scanning traffic. In fact, scanning and regular traffic are no different from the static data level. Even if the encrypted content is restored to plain text, it is still difficult to distinguish the two types of traffic. Furthermore, there is no significant difference between scanning and regular traffic at the dynamic data level, and it is difficult for people to find patterns from various statistical information (including but not limited to time series characteristics, such as the number, frequency, and interval of access to WEB services). On the other hand, the dynamic adaptation / adjustment function of current mainstream scanners allows them to better fit the regular traffic accessing the current scanning object at the data level, which further blurs the boundary between scanning and regular traffic. Finally, since the traffic is usually cut off or the source IP address is blocked after the scanning behavior is discovered, once a misjudgment occurs, normal business will be stopped, causing harm to the protected party.

[0004] Therefore, a WEB scanning traffic detection solution with timely response and low false alarm rate is needed to realize encrypted WEB scanning detection. In other words, the method for detecting encrypted WEB scanning in the existing technology has the technical problems of insufficient response and low accuracy. Summary of the invention

[0005] The purpose of the present invention is to provide an encrypted WEB scanning detection method, device and electronic device to alleviate the technical problems of insufficient response and low accuracy in the prior art.

[0006] In the first aspect, an embodiment of the present invention provides an encrypted WEB scanning detection method, comprising: collecting encrypted WEB scanning traffic through various WEB scanners; the above-mentioned encrypted WEB scanning traffic includes several scanning TLS data streams; extracting TLS handshake feature data and TCP handshake feature data corresponding to each of the above-mentioned scanning TLS data streams respectively; performing information digest calculation on the above-mentioned TLS handshake feature data and the above-mentioned TCP handshake feature data corresponding to each of the above-mentioned scanning TLS data streams respectively, to obtain a first group of information digest values ​​corresponding to each of the above-mentioned scanning TLS data streams; matching the second group of information digest values ​​corresponding to the TLS data stream to be detected with the first group of information digest values ​​corresponding to each of the above-mentioned scanning TLS data streams, if the match is successful, the above-mentioned TLS data stream to be detected is determined to be scanning traffic, otherwise, the above-mentioned TLS data stream to be detected is determined to be regular traffic.

[0007] In some optional implementations, TLS handshake feature data and TCP handshake feature data corresponding to each of the above-mentioned scanned TLS data streams are extracted respectively from each of the above-mentioned scanned TLS data streams, including: performing feature extraction on each of the above-mentioned scanned TLS data streams according to the data packet type, and obtaining the TLS handshake features and TCP handshake features corresponding to each of the above-mentioned scanned TLS data streams; numbering the TLS handshake features and TCP handshake features corresponding to the above-mentioned scanned TLS data streams, and determining the first category number, the second category number and the third category number and the features corresponding to each number respectively; performing byte value sampling on the above-mentioned TLS handshake features and the above-mentioned TCP handshake features respectively, and obtaining the byte value sampling results; preprocessing the above-mentioned byte value sampling results to obtain TLS handshake feature data and TCP handshake feature data.

[0008] In some optional implementations, byte values ​​are taken for the above-mentioned TLS handshake features and the above-mentioned TCP handshake features respectively, including: for the features corresponding to a category of numbers in the above-mentioned TLS handshake features and the above-mentioned TCP handshake features, only the byte values ​​of the type fields are extracted; for the features corresponding to numbers other than the above-mentioned category of numbers in the above-mentioned TLS handshake features and the above-mentioned TCP handshake features, the byte values ​​of all fields are extracted.

[0009] In some optional implementations, the results of the above-mentioned byte value extraction are preprocessed, including: segmenting the results of byte value extraction for the features corresponding to the second type of numbers in the above-mentioned TLS handshake features and the above-mentioned TCP handshake features; serializing the segmented bytes after segmentation in the order before segmentation; converting the results of the above-mentioned byte value extraction into corresponding decimal numbers; and discretizing the results of byte value extraction for the features corresponding to the third type of numbers in the above-mentioned TLS handshake features and the above-mentioned TCP handshake features according to pre-established rules.

[0010] In some optional implementations, the above method also includes: extracting TLS handshake feature data and TCP handshake feature data corresponding to the TLS data stream to be detected and performing information digest calculation to obtain a second set of information digest values ​​corresponding to the above TLS data stream to be detected.

[0011] In some optional implementations, the first group of information digest values ​​includes: a first standard scan MD5 value, a second standard scan MD5 value, and a third standard scan MD5 value; the second group of information digest values ​​includes a first MD5 value to be detected, a second MD5 value to be detected, and a third MD5 value to be detected; the second group of information digest values ​​corresponding to the TLS data stream to be detected is matched with the first group of information digest values ​​corresponding to each of the scanned TLS data streams, including: matching the second group of information digest values ​​corresponding to the TLS data stream to be detected with the first group of information digest values ​​corresponding to each of the scanned TLS data streams according to a preset matching rule.

[0012] In some optional implementations, the preset matching rules include: the first MD5 value to be detected is the same as any one of the several first standard scan MD5 values; or, the first MD5 value to be detected is the same as any one of the several first standard scan MD5 values, and the second MD5 value to be detected is the same as any one of the several second standard scan MD5 values, and the same first standard scan MD5 value and the second standard scan MD5 value belong to the same group or different groups in the first group of information summary values; or, the first MD5 value to be detected is the same as any one of the several first standard scan MD5 values, and the third MD5 value to be detected is the same as any one of the several third standard scan MD5 values, and the same first standard scan MD5 value and the third standard scan MD5 value belong to the same group or different groups in the first group of information summary values.

[0013] In the second aspect, an embodiment of the present invention provides an encrypted WEB scanning detection device, including: a collection module, used to collect encrypted WEB scanning traffic through various WEB scanners; the above-mentioned encrypted WEB scanning traffic includes several scanning TLS data streams; an extraction module, used to extract TLS handshake feature data and TCP handshake feature data corresponding to each of the above-mentioned scanning TLS data streams respectively; a calculation module, used to perform information digest calculation on the above-mentioned TLS handshake feature data and the above-mentioned TCP handshake feature data corresponding to each of the above-mentioned scanning TLS data streams, and obtain a first group of information digest values ​​corresponding to each of the above-mentioned scanning TLS data streams; a matching module, used to match the second group of information digest values ​​corresponding to the TLS data stream to be detected with the first group of information digest values ​​corresponding to each of the above-mentioned scanning TLS data streams; if the match is successful, the above-mentioned TLS data stream to be detected is determined to be scanning traffic, otherwise, the above-mentioned TLS data stream to be detected is determined to be regular traffic.

[0014] In a third aspect, an embodiment of the present invention provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program executable on the processor, and when the processor executes the computer program, the steps of any one of the methods described in the first aspect are implemented.

[0015] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores machine-executable instructions. When the computer-executable instructions are called and executed by a processor, the computer-executable instructions cause the processor to execute any method described in the first aspect above.

[0016] The present invention provides an encrypted WEB scanning detection method, device and electronic device. The method first collects encrypted WEB scanning traffic through various WEB scanners, and the encrypted WEB scanning traffic includes several scanning TLS data streams; then extracts corresponding TLS handshake feature data and TCP handshake feature data from each scanning TLS data stream; then performs information digest calculation on each TLS handshake feature data and TCP handshake feature data to obtain a first group of information digest values ​​corresponding to each scanning TLS data stream; matches the second group of information digest values ​​corresponding to the TLS data stream to be detected with the first group of information digest values ​​corresponding to each scanning TLS data stream, and if the match is successful, the TLS data stream to be detected is determined to be scanning traffic. This method solves the technical problems of the prior art that the response to encrypted WEB scanning detection is not timely enough and the accuracy is low, and achieves the technical effect of improving the efficiency and accuracy of scanning detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0018] Figure 1 A schematic diagram of a flow chart of an encrypted WEB scanning detection method provided by an embodiment of the present invention;

[0019] Figure 2 A flowchart for collecting scan traffic and extracting and preprocessing features from its TLS data stream in an embodiment of the present invention;

[0020] Figure 3 This is a schematic diagram of segmenting, concatenating, and converting the byte values ​​of a feature (CH-11 in this example) in the preprocessing stage in an embodiment of the present invention;

[0021] Figure 4 This is a flowchart of obtaining the decimal value of the serial feature and calculating the MD5 value in an embodiment of the present invention;

[0022] Figure 5 This is a diagram showing the differences between the five MD5 matching modes in the embodiment of the present invention;

[0023] Figure 6 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0024] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0025] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0026] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings. Some embodiments of the present invention are described in detail below in conjunction with the drawings. The following embodiments and features in the embodiments can be combined with each other without conflict.

[0027] Currently, more and more domestic and foreign scanners use Transport Layer Security (TLS) encryption technology to evade detection and interception. Specifically, network traffic packets that perform various scanning actions are fuzzy / random at the data level, which means that the defender can no longer extract specific attributes from the encrypted data packets to identify scanning traffic. In fact, scanning and regular traffic are no different from the static data level. Even if the encrypted content is restored to plain text, it is still difficult to distinguish the two types of traffic. Furthermore, there is no significant difference between scanning and regular traffic at the dynamic data level, and it is difficult for people to find patterns from various statistical information (including but not limited to temporal characteristics, such as the number, frequency, and interval of access to WEB services). On the other hand, the dynamic adaptation / adjustment function of current mainstream scanners allows them to better fit the regular traffic accessing the current scanning object at the data level, which further blurs the boundary between scanning and regular traffic. Finally, since the traffic is usually cut off or the source IP address is blocked after the scanning behavior is discovered, once a misjudgment occurs, normal business will be stopped, causing harm to the protected party. Therefore, a WEB scanning traffic detection solution with timely response and low false alarm rate is needed to realize encrypted WEB scanning detection. In other words, the method for detecting encrypted WEB scanning in the existing technology has the technical problems of insufficient response and low accuracy.

[0028] Based on this, the embodiments of the present invention provide an encrypted WEB scanning detection method, device and electronic device to solve the technical problems of insufficient response and low accuracy in the prior art.

[0029] To facilitate understanding of this embodiment, firstly, an encrypted WEB scanning detection method disclosed in an embodiment of the present invention is described in detail, see Figure 1 The flowchart of an encrypted WEB scanning detection method shown in FIG. 1 is a flowchart of an encrypted WEB scanning detection method, which can be executed by an electronic device and mainly includes the following steps S110 to S140:

[0030] S110: Collect encrypted WEB scanning traffic through various WEB scanners; encrypted WEB scanning traffic includes several scanning TLS data streams;

[0031] S120: extracting TLS handshake feature data and TCP handshake feature data corresponding to each scanned TLS data stream from each scanned TLS data stream;

[0032] In one embodiment, extracting TLS handshake feature data and TCP handshake feature data corresponding to each scanned TLS data stream from each scanned TLS data stream respectively includes:

[0033] Extract features from each scanned TLS data stream according to the data packet type, and obtain TLS handshake features and TCP handshake features corresponding to each scanned TLS data stream;

[0034] Numbering the TLS handshake features and TCP handshake features corresponding to the scanned TLS data stream, and determining the first-class number, the second-class number, and the third-class number and the features corresponding to each number;

[0035] Perform byte sampling on the TLS handshake feature and the TCP handshake feature respectively to obtain the byte sampling result;

[0036] The byte value extraction result is preprocessed to obtain TLS handshake feature data and TCP handshake feature data.

[0037] In one embodiment, byte values ​​are taken for the TLS handshake feature and the TCP handshake feature respectively, including:

[0038] For features corresponding to a class of numbers in TLS handshake features and TCP handshake features, only the byte value of the type field is extracted;

[0039] For features corresponding to numbers other than a category of numbers in TLS handshake features and TCP handshake features, byte values ​​of all fields are extracted.

[0040] As a specific example, all TLS data streams (the number is recorded as N) are extracted from the scanned traffic, and byte values ​​of 8 and 11 features (see Table 1) are respectively extracted from the TCP-SYN and TLS-ClientHello packets of each TLS data stream, and the byte values ​​are preprocessed;

[0041] Table 1 - Two sets of features extracted from TCP-SYN and TLS-ClientHello packets of TLS data flows;

[0042] .

[0043] Among them, the features SYN-08 and CH-12 corresponding to the first category numbers (08 and 12) only extract the byte value of the type field. The features corresponding to the second category numbers (11-14) are shown in Table 2; the features SYN-03 and CH-03 corresponding to the third category number 03.

[0044] In one embodiment, the result of byte value extraction is preprocessed, including:

[0045] (S21) dividing the results of taking byte values ​​of the features corresponding to the second type of numbers in the TLS handshake features and the TCP handshake features;

[0046] (S22) sequentially concatenating the segmented bytes after segmentation in the order before segmentation;

[0047] (S23) converting the result of the byte value extraction into a corresponding decimal number;

[0048] (S24) Discretizing the results of byte value selection of the features corresponding to the three types of numbers in the TLS handshake features and the TCP handshake features according to a pre-defined rule.

[0049] As a specific example, the preprocessing method is divided into the following two steps:

[0050] (1) The features extracted in the above steps are processed as follows:

[0051] The byte values ​​of the following features (see Table 2) corresponding to the second category numbers (No. 11-14) are divided into units of 1 or 2 bytes;

[0052] Use the connector S2 (default is a hyphen) to connect the bytes of each segment after the segmentation in the order before segmentation.

[0053] Convert all byte values ​​in the feature (whether segmented or not) to corresponding decimal numbers;

[0054] Table 2 - Features that need to be segmented by bytes;

[0055] .

[0056] (2) The three types of features numbered 03 (denoted as ) is discretized as follows:

[0057] S130: performing information digest calculations on the TLS handshake characteristic data and the TCP handshake characteristic data corresponding to each scanned TLS data stream, respectively, to obtain a first group of information digest values ​​corresponding to each scanned TLS data stream;

[0058] In one embodiment, obtaining the first group of information digest values ​​corresponding to each of the TLS data streams includes: preprocessing the results of the byte value extraction, dividing the preprocessed features into three groups and sorting them within the groups; and sequentially concatenating the results of the byte value extraction of each group of features according to the sorting within the group to generate three byte strings. The first group of information digest values ​​includes: a first standard scan MD5 value, a second standard scan MD5 value, and a third standard scan MD5 value.

[0059] As a specific example, the preprocessed features are divided into 3 groups, and the features in each group are sorted within the group (see Table 3). The byte values ​​of each group of features are serially connected in sequence according to the predetermined ranking using the connector S1 (the default English comma) to form a byte string, and the MD5 value of each byte string is calculated respectively (that is, each TLS data stream corresponds to 1 line of 3 MD5 values, and the existing N TLS data streams generate N lines of MD5 values ​​in total);

[0060] Table 3 - Grouping, number and ranking of features;

[0061] .

[0062] In one embodiment, the method further includes: extracting TLS handshake feature data and TCP handshake feature data corresponding to the TLS data stream to be detected and performing information digest calculation to obtain a second group of information digest values ​​corresponding to the TLS data stream to be detected. The second group of information digest values ​​includes a first MD5 value to be detected, a second MD5 value to be detected, and a third MD5 value to be detected.

[0063] S140: Match the second group of information digest values ​​corresponding to the TLS data stream to be detected with the first group of information digest values ​​corresponding to each scanned TLS data stream. If the match is successful, the TLS data stream to be detected is determined to be scanned traffic; otherwise, the TLS data stream to be detected is determined to be regular traffic.

[0064] In one embodiment, matching a second group of information digest values ​​corresponding to the TLS data stream to be detected with a first group of information digest values ​​corresponding to each scanned TLS data stream includes:

[0065] The second group of information digest values ​​corresponding to the TLS data stream to be detected are matched with the first group of information digest values ​​corresponding to each scanned TLS data stream according to a preset matching rule.

[0066] In one embodiment, the preset matching rules include:

[0067] The first MD5 value to be detected is the same as any one of the plurality of first standard scan MD5 values;

[0068] Alternatively, the first MD5 value to be detected is the same as any one of the plurality of first standard scan MD5 values, and the second MD5 value to be detected is the same as any one of the plurality of second standard scan MD5 values, and the same first standard scan MD5 value and the same second standard scan MD5 value belong to the same group or different groups in the first group of information digest values;

[0069] Alternatively, the first MD5 value to be detected is the same as any one of several first standard scan MD5 values, and the third MD5 value to be detected is the same as any one of several third standard scan MD5 values, and the same first standard scan MD5 value and third standard scan MD5 value belong to the same group or different groups in the first group of information summary values.

[0070] As a specific example, the above matching includes 5 optional modes (mod), and the conditions for determining the matching of each mode are as follows:

[0071] mod = 1: The MD5-1 value of the TLS data stream to be detected appears in the N MD5-1 values ​​calculated in the above steps;

[0072] mod = 2: The MD5-1 and MD5-2 values ​​of the TLS data stream to be detected appear in the N calculated MD5-1 and MD5-2 values ​​respectively, and the matching MD5-1 and MD5-2 values ​​do not have to be in the same row;

[0073] mod = 3: The MD5-1 and MD5-3 values ​​of the TLS data stream to be detected appear in the N calculated MD5-1 and MD5-3 values ​​respectively, and the matching MD5-1 and MD5-3 values ​​do not have to be in the same row;

[0074] mod = 4: The MD5-1 and MD5-2 values ​​of the TLS data stream to be detected appear in the N calculated MD5-1 and MD5-2 values ​​respectively, and the matching MD5-1 and MD5-2 values ​​must be in the same row;

[0075] mod = 5: The MD5-1 and MD5-3 values ​​of the TLS data stream to be detected appear in the N calculated MD5-1 and MD5-3 values ​​respectively, and the matching MD5-1 and MD5-3 values ​​must be in the same row.

[0076] The present invention provides an encrypted WEB scanning detection method, which first collects encrypted WEB scanning traffic through various WEB scanners, and the encrypted WEB scanning traffic includes several scanning TLS data streams; then extracts corresponding TLS handshake feature data and TCP handshake feature data from each scanning TLS data stream; then performs information digest calculation on each TLS handshake feature data and TCP handshake feature data, and obtains a first group of information digest values ​​corresponding to each scanning TLS data stream; matches the second group of information digest values ​​corresponding to the TLS data stream to be detected with the first group of information digest values ​​corresponding to each scanning TLS data stream, and if the match is successful, the TLS data stream to be detected is determined to be scanning traffic. This method solves the technical problems of the prior art that the response to encrypted WEB scanning detection is not timely enough and the accuracy is low, and achieves the technical effect of improving the efficiency and accuracy of scanning detection.

[0077] In order to make the purpose, technical solution and advantages of the present invention more clear, a specific embodiment is shown below. Figures 2 to 5 , the present invention is described in further detail.

[0078] Figure 2 This is a flowchart of collecting scan traffic and extracting and preprocessing features from its TLS data stream in an embodiment of the present invention. Figure 3 This is a schematic diagram of the segmentation, concatenation, and conversion of the characteristic (CH-11 in this example) byte value in the preprocessing stage in an embodiment of the present invention. An encrypted WEB scanning detection method proposed in this embodiment includes the following steps:

[0079] S1. Collect scanning traffic from various WEB scanners;

[0080] S2. Extract all TLS data flows (the number is recorded as N), extract byte values ​​of 8 and 11 features (see Table 1) from the TCP-SYN and TLS-ClientHello packets of each TLS data flow, and pre-process each byte value;

[0081] Specifically, the feature extraction method includes: features 08 and 12 in the feature only extract the byte value of the type field.

[0082] Specifically, the preprocessing method is divided into the following two steps:

[0083] (1) The extracted features are processed as follows:

[0084] The byte values ​​of the following features (see Table 3) are segmented into 1 or 2 bytes. The segmented bytes are connected in sequence using the connector S2 (default is the English hyphen) in the order before segmentation. The byte values ​​in all features (regardless of segmentation or not) are converted into corresponding decimal numbers. (2) Feature 03 (denoted as ) is discretized as follows:

[0085] At this point, the characteristics of the scan traffic preprocessing are obtained, which will be used to calculate the MD5 value used to determine the scan traffic.

[0086] Figure 4 This is a flowchart of obtaining a decimal value of a concatenated feature and calculating an MD5 value in an embodiment of the present invention. The method further includes:

[0087] S3. Divide the preprocessed features into 3 groups, sort the features in each group within the group (see Table 2), use connector S1 (default English comma) to concatenate the byte values ​​of each group of features in sequence according to the established ranking to form a byte string, and calculate the MD5 value of each byte string respectively (that is, each TLS data stream corresponds to 1 line of 3 MD5 values, and the existing N TLS data streams generate N lines of MD5 values ​​in total); so far, the MD5 value used to determine the scanning traffic is calculated using the features after scanning traffic preprocessing.

[0088] Figure 5 This is a difference diagram of five MD5 matching modes in an embodiment of the present invention (light gray and dark gray represent two compliant matches, and black represents illegal matches). The method further includes:

[0089] S4, processing the TLS data flow to be detected and calculating the corresponding 1 line of 3 MD5 values, matching the 1 line of MD5 values ​​with the calculated N lines of MD5 values, if the match is successful, determining that the TLS data flow to be detected is scanning traffic, otherwise, determining that it is regular traffic;

[0090] Specifically, the matching of the MD5 value includes:

[0091] Matching includes 5 optional modes (mod), and the conditions for determining matching in each mode are as follows:

[0092] mod = 1: The MD5-1 value of the TLS data stream to be detected appears in the N calculated MD5-1 values;

[0093] mod = 2: The MD5-1 and MD5-2 values ​​of the TLS data stream to be detected appear in the N calculated MD5-1 and MD5-2 values ​​respectively. The matching MD5-1 and MD5-2 values ​​do not have to be in the same row.

[0094] mod = 3: The MD5-1 and MD5-3 values ​​of the TLS data stream to be detected appear in the N calculated MD5-1 and MD5-3 values ​​respectively. The matching MD5-1 and MD5-3 values ​​do not have to be in the same row.

[0095] mod = 4: The MD5-1 and MD5-2 values ​​of the TLS data stream to be detected appear in the N calculated MD5-1 and MD5-2 values ​​respectively. The matching MD5-1 and MD5-2 values ​​must be in the same row.

[0096] mod = 5: The MD5-1 and MD5-3 values ​​of the TLS data stream to be detected appear in the N calculated MD5-1 and MD5-3 values ​​respectively. The matching MD5-1 and MD5-3 values ​​must be in the same row.

[0097] At this point, the TLS data stream to be detected has been determined and handled accordingly based on the matching result of the MD5 value.

[0098] In addition, an embodiment of the present invention further provides an encrypted WEB scanning detection device, comprising: a collection module, used to collect encrypted WEB scanning traffic through various WEB scanners; the encrypted WEB scanning traffic includes a plurality of scanning TLS data streams;

[0099] An extraction module is used to extract TLS handshake feature data and TCP handshake feature data corresponding to each scanned TLS data stream from each scanned TLS data stream;

[0100] A calculation module, used to perform information digest calculation on the TLS handshake characteristic data and the TCP handshake characteristic data corresponding to each scanned TLS data stream, to obtain a first group of information digest values ​​corresponding to each scanned TLS data stream;

[0101] The matching module is used to match the second group of information digest values ​​corresponding to the TLS data stream to be detected with the first group of information digest values ​​corresponding to each scanned TLS data stream. If the match is successful, the TLS data stream to be detected is determined to be scanned traffic; otherwise, the TLS data stream to be detected is determined to be regular traffic.

[0102] The encrypted WEB scanning detection device provided in the embodiment of the present application can be specific hardware on the device or software or firmware installed on the device. The device provided in the embodiment of the present application, its implementation principle and the technical effect produced are the same as those in the aforementioned method embodiment. For the sake of brief description, for the parts not mentioned in the device embodiment, reference can be made to the corresponding contents in the aforementioned method embodiment. Technical personnel in the relevant field can clearly understand that for the convenience and conciseness of description, the specific working processes of the systems, devices and units described above can all refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. The encrypted WEB scanning detection device provided in the embodiment of the present application has the same technical features as the encrypted WEB scanning detection method provided in the above embodiment, so it can also solve the same technical problems and achieve the same technical effects.

[0103] An embodiment of the present application further provides an electronic device. Specifically, the electronic device includes a processor and a storage device. The storage device stores a computer program, and when the computer program is executed by the processor, it executes the method described in any one of the above-mentioned embodiments.

[0104] Figure 6 A structural schematic diagram of an electronic device provided in an embodiment of the present application, the electronic device 400 includes: a processor 40, a memory 41, a bus 42 and a communication interface 43, wherein the processor 40, the communication interface 43 and the memory 41 are connected via the bus 42; the processor 40 is used to execute an executable module stored in the memory 41, such as a computer program.

[0105] The memory 41 may include a high-speed random access memory (RAM), and may also include a non-volatile memory, such as at least one disk memory. The communication connection between the system network element and at least one other network element is realized through at least one communication interface 43 (which may be wired or wireless), and the Internet, wide area network, local area network, metropolitan area network, etc. may be used.

[0106] The bus 42 may be an ISA bus, a PCI bus, or an EISA bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 6 Only one bidirectional arrow is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0107] Among them, the memory 41 is used to store programs, and the processor 40 executes the program after receiving the execution instruction. The method executed by the process definition device disclosed in any embodiment of the above-mentioned embodiment of the present invention can be applied to the processor 40 or implemented by the processor 40.

[0108] The processor 40 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 40. The above processor 40 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present invention can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in the embodiments of the present invention can be directly embodied as a hardware decoding processor to execute, or can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 41, and the processor 40 reads the information in the memory 41 and completes the steps of the above method in combination with its hardware.

[0109] Corresponding to the above method, an embodiment of the present application also provides a computer-readable storage medium, which stores machine-executable instructions. When the computer-executable instructions are called and executed by a processor, the computer-executable instructions prompt the processor to execute the steps of the above method.

[0110] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0111] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0112] In addition, each functional unit in the embodiments provided in the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0113] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, electronic device, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., various media that can store program codes.

[0114] It should be noted that similar numbers and letters represent similar items in the accompanying drawings. Therefore, once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. In addition, the terms "first", "second", "third", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0115] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. An encrypted WEB scanning detection method, characterized in that: include: Collecting encrypted WEB scanning traffic through various WEB scanners; the encrypted WEB scanning traffic includes several scanning TLS data streams; Extracting TLS handshake feature data and TCP handshake feature data corresponding to each scanned TLS data stream from each scanned TLS data stream respectively; Perform information digest calculation on the TLS handshake characteristic data and the TCP handshake characteristic data corresponding to each of the scanned TLS data streams, respectively, to obtain a first group of information digest values ​​corresponding to each of the scanned TLS data streams; Matching the second group of information digest values ​​corresponding to the TLS data flow to be detected with the first group of information digest values ​​corresponding to each of the scanned TLS data flows, and if the match is successful, determining that the TLS data flow to be detected is scanned traffic, otherwise, determining that the TLS data flow to be detected is regular traffic; Wherein, extracting TLS handshake feature data and TCP handshake feature data corresponding to each scanned TLS data stream from each scanned TLS data stream respectively includes: Extract features from each of the scanned TLS data streams according to the data packet type to obtain TLS handshake features and TCP handshake features corresponding to each of the scanned TLS data streams; Numbering the TLS handshake features and the TCP handshake features corresponding to the scanned TLS data stream, and determining a first-category number, a second-category number, and a third-category number and features corresponding to each number; Perform byte sampling on the TLS handshake feature and the TCP handshake feature respectively to obtain byte sampling results; Preprocessing the result of the byte value acquisition to obtain TLS handshake feature data and TCP handshake feature data; The TLS handshake feature and the TCP handshake feature are respectively byte-valued, including: For the features corresponding to the class number in the TLS handshake features and the TCP handshake features, only the byte value of the type field is extracted; For the features corresponding to the numbers other than the one type of numbers in the TLS handshake features and the TCP handshake features, the byte values ​​of all the fields are extracted.

2. The encrypted WEB scanning detection method according to claim 1, characterized in that: The result of the byte value taking is preprocessed, including: Segment the result of taking byte values ​​of the features corresponding to the second type of numbers in the TLS handshake features and the TCP handshake features; Concatenate the segmented bytes in sequence according to the order before segmentation; Convert the result of the byte value to a corresponding decimal number; The results of byte value selection of the features corresponding to the three types of numbers in the TLS handshake features and the TCP handshake features are discretized according to a pre-defined rule.

3. The encrypted WEB scanning detection method according to claim 1, characterized in that: The method further comprises: TLS handshake characteristic data and TCP handshake characteristic data corresponding to the TLS data stream to be detected are extracted and information digest calculation is performed to obtain a second group of information digest values ​​corresponding to the TLS data stream to be detected.

4. The encrypted WEB scanning detection method according to claim 3 is characterized in that: The first group of information digest values ​​includes: a first standard scan MD5 value, a second standard scan MD5 value, and a third standard scan MD5 value; the second group of information digest values ​​includes a first MD5 value to be detected, a second MD5 value to be detected, and a third MD5 value to be detected; matching the second group of information digest values ​​corresponding to the TLS data stream to be detected with the first group of information digest values ​​corresponding to each of the scanned TLS data streams, including: The second group of information digest values ​​corresponding to the TLS data stream to be detected are matched with the first group of information digest values ​​corresponding to each of the scanned TLS data streams according to a preset matching rule.

5. The encrypted WEB scanning detection method according to claim 4, characterized in that: The preset matching rules include: The first MD5 value to be detected is the same as any one of the plurality of first standard scan MD5 values; Alternatively, the first MD5 value to be detected is the same as any one of the plurality of first standard scan MD5 values, and the second MD5 value to be detected is the same as any one of the plurality of second standard scan MD5 values, and the identical first standard scan MD5 value and the identical second standard scan MD5 value belong to the same group or different groups in the first group of information digest values; Alternatively, the first MD5 value to be detected is the same as any one of several first standard scan MD5 values, and the third MD5 value to be detected is the same as any one of several third standard scan MD5 values, and the same first standard scan MD5 value and the third standard scan MD5 value belong to the same group or different groups in the first group of information summary values.

6. An encrypted WEB scanning detection device, characterized in that: include: A collection module, used for collecting encrypted WEB scanning traffic through various WEB scanners; the encrypted WEB scanning traffic includes several scanning TLS data streams; An extraction module, used to extract TLS handshake feature data and TCP handshake feature data corresponding to each scanned TLS data stream from each scanned TLS data stream; A calculation module, used to perform information digest calculation on the TLS handshake characteristic data and the TCP handshake characteristic data corresponding to each of the scanned TLS data streams, to obtain a first group of information digest values ​​corresponding to each of the scanned TLS data streams; A matching module, used for matching a second group of information digest values ​​corresponding to the TLS data stream to be detected with a first group of information digest values ​​corresponding to each of the scanned TLS data streams, and if the match is successful, determining that the TLS data stream to be detected is scanned traffic, otherwise, determining that the TLS data stream to be detected is regular traffic; Wherein, extracting the TLS handshake feature data and TCP handshake feature data corresponding to each scanned TLS data stream from each scanned TLS data stream respectively, including: extracting features of each scanned TLS data stream according to the data packet type, and obtaining the TLS handshake features and TCP handshake features corresponding to each scanned TLS data stream; numbering the TLS handshake features and TCP handshake features corresponding to the scanned TLS data stream, and respectively determining the first category number, the second category number and the third category number and the features corresponding to each number; performing byte value sampling on the TLS handshake features and the TCP handshake features respectively, and obtaining the byte value sampling results; preprocessing the byte value sampling results, and obtaining the TLS handshake feature data and the TCP handshake feature data; The TLS handshake feature and the TCP handshake feature are respectively byte-valued, including: for the features corresponding to the category number in the TLS handshake feature and the TCP handshake feature, only the byte value of the type field is extracted; for the features corresponding to the numbers other than the category number in the TLS handshake feature and the TCP handshake feature, the byte values ​​of all fields are extracted.

7. An electronic device comprising a memory and a processor, wherein the memory stores a computer program that can be run on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 5 are implemented.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores machine executable instructions. When the computer-executable instructions are called and executed by a processor, the computer-executable instructions prompt the processor to execute the method according to any one of claims 1 to 5.

Images