Method and device for detecting encrypted tunnel communication in financial cloud data center

Abstract

The invention discloses a method and device for detecting encrypted tunnel communication in a financial cloud data center, which belongs to the field of network security technology. The method includes the following steps: Step S1, collecting the traffic of the financial cloud data center, decoding the HTTP protocol, and obtaining HTTP protocol elements, wherein the HTTP protocol elements include five-tuple information, request header, request body, response header, and response body; Step S2, judging and identifying the gibberish elements in the HTTP protocol elements, and identifying the gibberish elements, wherein the gibberish is an encrypted / encoded string; Step S3, analyzing the gibberish elements by means of big data streaming analysis, filtering false positives, detecting threats, and issuing alarms. The invention can effectively identify malicious encrypted traffic transmitted using HTTP tunneling technology, and solves the problem that the prior art is difficult to detect such traffic.

Description

Technical Field

[0001] The present invention relates to a method and a device for detecting encrypted tunnel communication in a financial cloud data center, belonging to the technical field of network security. Background Art

[0002] With the construction and use of financial cloud data centers, HTTP protocol communication has gradually become the mainstream way of business interaction. At the same time, the number of HTTP-based WEB attacks is on the rise, and the confrontational nature of network security in the external environment is becoming stronger and stronger. In this context, attackers have derived many technical means to attack and exploit through encrypted traffic, encoding or encrypting malicious attack payloads and communicating with the controlled end, thereby bypassing the detection and analysis of feature-based security devices. This technology is called HTTP tunneling technology.

[0003] The widespread application of HTTP tunneling technology poses the following challenges to the security defense system of financial cloud data centers: 1) Traditional security devices or security products such as IDS / WAF / situational awareness identify threats based on content features or behavioral features. Encrypted or encoded malicious payload content no longer has threat features and cannot be matched and identified by traditional security products. 2) Existing HTTP tunneling technology has gradually matured, with popular tools such as HTTPTunnel and reGeorg. This type of attack method has become popular and mature. 3) The malicious traffic initiated by the attacker imitates normal HTTP traffic in request behavior, making it difficult for detection methods based on behavioral analysis to work.

[0004] Facing this new type of network threat, there is currently no effective identification measure, so the present invention proposes a method and device for detecting encrypted tunnel communications in a financial cloud data center. Summary of the invention

[0005] In order to solve the above problems, the present invention proposes a method and device for detecting encrypted tunnel communications in a financial cloud data center, which can effectively identify malicious encrypted traffic transmitted using HTTP tunnel technology, and solve the problem that the existing technology is difficult to detect such traffic.

[0006] The technical solution adopted by the present invention to solve the technical problem is:

[0007] In a first aspect, an embodiment of the present invention provides a method for detecting encrypted tunnel communication in a financial cloud data center, comprising the following steps:

[0008] Step S1, collecting traffic from the financial cloud data center, decoding the HTTP protocol, and obtaining HTTP protocol elements, wherein the HTTP protocol elements include five-tuple information, a request header, a request body, a response header, and a response body;

[0009] Step S2, judging and identifying the gibberish element in the HTTP protocol element, identifying the gibberish element, wherein the gibberish is an encrypted / encoded character string;

[0010] Step S3: Analyze the gibberish elements through big data streaming analysis, filter out false positives, detect threats and issue alarms.

[0011] As a possible implementation of this embodiment, the step S1, collecting the traffic of the financial cloud data center and decoding the HTTP protocol, includes:

[0012] Use the Suricata network traffic capture tool to obtain all traffic in the encrypted tunnel of the financial cloud data center;

[0013] Parse all traffic to obtain HTTP protocol elements;

[0014] Decode the HTTP protocol elements and put the data into MQ (message queue) in the form of JSON.

[0015] As a possible implementation of this embodiment, the step S2, judging and identifying the gibberish element in the HTTP protocol element, and identifying the gibberish element, includes:

[0016] Step S21, determining the request content length of the HTTP protocol element, if the length is greater than 128 bytes, proceeding to the next step, otherwise the HTTP protocol element is not processed and the analysis is skipped;

[0017] Step S22, determine whether the HTTP protocol element is a non-visible character, take the first 64 bytes and the last 64 bytes of the message, read the number of non-visible characters, the definition of non-visible characters is that the ascill code value is less than 32 or the ascill code value is greater than 126, and the ascii code is not equal to the line feed, carriage return, space, tab character, if the proportion of non-visible characters is greater than 30%, then directly define the message as an encrypted message, if not an encrypted message, then enter the next step to continue to determine;

[0018] Step S23, delete the leading and trailing blank characters of the message, determine whether the message starts with { and ends with}, if yes, parse it through json, if it can be parsed, perform key:value mapping; and traverse the element set, if the length of the value is less than 64, directly discard it;

[0019] Step S24, if the parsing cannot be performed through json, determine whether the non-end of the message contains an = character, and if so, map the key-value pairs in a urlencode manner, using & as a group separator and = as a variable separator;

[0020] Step S25, if there is no = character at the non-end of the message, group it according to [,:;], and map the data to _no_key_n=value, where n is an increasing value; determine whether the length of value is greater than 64, if it is less than 64, discard it, and loop through until a set of all value key-value pairs with a length greater than 64 is obtained;

[0021] Step S26, traverse all key:value elements in the set, first convert the value to lowercase, determine the frequency of the characters [0-9, af], if the proportion is above 95, it is determined to be hexadecimal encoding, and the encoding label is hex, and the key value is output at the same time, and it is determined that the value is gibberish; if the proportion is less than 95, further gibberish recognition is performed.

[0022] As a possible implementation of this embodiment, in the process of judging and identifying gibberish elements in HTTP protocol elements, if a character combination cannot be understood or read by humans, it is judged as gibberish, that is, a value whose string is readable and understandable is defined as non-gibberish; a character combination whose meaning cannot be judged is defined as gibberish.

[0023] As a possible implementation of this embodiment, in the process of judging and identifying the gibberish element in the HTTP protocol element,

[0024] If the number of occurrences of high-frequency letters and low-frequency letters in a string conforms to the frequency distribution, it is considered readable and non-gibberish; if a readable string is encoded, hashed or encrypted, the frequency of its letters will most likely change and will not conform to the frequency distribution, then it is considered unreadable and gibberish.

[0025] As a possible implementation of this embodiment, different business systems are distinguished in the statistical process, the frequency of each letter in the message received each time in each business system is counted, and the frequencies are sorted according to the number of occurrences of each frequency, and the top 5 digits of each frequency are selected to participate in the final frequency calculation process.

[0026] Select the top 5 values ​​of each letter frequency and calculate the final letter frequency:

[0027] ,

[0028] in, Represents the final frequency of each letter, The number ranking is The frequency of letters, Indicates the number of occurrences of high-frequency words;

[0029] If the total frequency of high-frequency letters in a string is greater than a threshold, the string is determined to be gibberish.

[0030] As a possible implementation of this embodiment, step S3, analyzing the gibberish elements by big data streaming analysis, filtering false positives, detecting threats and issuing alarms, includes:

[0031] Step S31, using the streaming analysis method (flink) of the big data analysis platform, an alarm is issued when a certain HTTP interface of nonsense language is continuously accessed within a period of time;

[0032] Step S32, performing refined alarm noise reduction by adding the gibberish parameters and gibberish type elements screened in the gibberish recognition process;

[0033] Step S33: output HTTP encrypted tunnel threat identification results.

[0034] In a second aspect, an embodiment of the present invention provides a device for detecting encrypted tunnel communication in a financial cloud data center, comprising:

[0035] A data collection module is used to collect the traffic of the financial cloud data center, decode the HTTP protocol, and obtain HTTP protocol elements, wherein the HTTP protocol elements include five-tuple information, a request header, a request body, a response header, and a response body;

[0036] A gibberish judgment module, used to judge and identify gibberish elements in HTTP protocol elements, and identify gibberish elements, wherein the gibberish is an encrypted / encoded string;

[0037] The gibberish analysis module is used to analyze gibberish elements through big data streaming analysis, filter false positives, detect threats and issue alarms.

[0038] In a third aspect, an embodiment of the present invention provides an electronic device, comprising a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor communicates with the memory through the bus, and the processor executes the machine-readable instructions to perform the steps of any of the above-mentioned methods for detecting encrypted tunnel communications in a financial cloud data center.

[0039] In a fourth aspect, an embodiment of the present invention provides a storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above-mentioned methods for detecting encrypted tunnel communications in a financial cloud data center are executed.

[0040] The beneficial effects of the technical solution of the embodiment of the present invention are as follows:

[0041] A method for detecting encrypted tunnel communication in a financial cloud data center according to the technical solution of an embodiment of the present invention comprises the following steps: step S1, collecting the traffic of the financial cloud data center, decoding the HTTP protocol, and obtaining HTTP protocol elements, wherein the HTTP protocol elements include five-tuple information, request header, request body, response header, and response body; step S2, judging and identifying the gibberish elements in the HTTP protocol elements, and identifying the gibberish elements, wherein the gibberish is an encrypted / encoded string; step S3, analyzing the gibberish elements by means of big data streaming analysis, filtering false positives, detecting threats, and issuing alarms. The present invention can effectively identify malicious encrypted traffic transmitted using HTTP tunnel technology, and solves the problem that the prior art is difficult to detect such traffic. The present invention discovers the abnormality of such traffic based on gibberish recognition and behavior analysis, does not rely on content detection and feature matching, can effectively resist unknown attack methods, and is expected to become a powerful technical means for identifying this new type of network threat.

[0042] The present invention adopts encrypted message recognition to solve the problem that traditional network security products cannot detect HTTP tunnel traffic that uses encoding, encryption or a mixture of the two. The present invention does not rely on known features and content analysis, so it can detect various unknown threats using HTTP tunnels, make up for the shortcomings of the data center security defense system, and improve the detection ability of unknown threats and attacks. The present invention relies on pure traffic statistical behavior analysis without checking the content, which improves the monitoring efficiency. At the same time, compared with the machine learning method, it effectively reduces the recognition performance loss and reduces the impact of normal business on detection. The present invention effectively distinguishes the difference between normal traffic and tunnel traffic, reduces false alarms, and reduces the false alarm rate of detection. The present invention only relies on the protocol itself, and can maintain its effect even if the protocol implementation changes. It is adaptable to the future development of HTTP and does not rely on specific implementations, so it can deal with variants of tunnel technology.

[0043] A device for detecting encrypted tunnel communications in a financial cloud data center according to the technical solution of an embodiment of the present invention has the same beneficial effects as a method for detecting encrypted tunnel communications in a financial cloud data center according to the technical solution of an embodiment of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 It is a flow chart of a method for detecting encrypted tunnel communication in a financial cloud data center according to an exemplary embodiment;

[0045] Figure 2 It is a schematic diagram of the structure of a device for detecting encrypted tunnel communications in a financial cloud data center according to an exemplary embodiment. DETAILED DESCRIPTION

[0046] In order to more clearly illustrate the technical features of the solution of the present invention, the present invention is described in detail below through specific implementation methods and in conjunction with the accompanying drawings.

[0047] like Figure 1 As shown, a method for detecting encrypted tunnel communication in a financial cloud data center provided by an embodiment of the present invention includes the following steps:

[0048] Step S1, collecting traffic from the financial cloud data center, decoding the HTTP protocol, and obtaining HTTP protocol elements, wherein the HTTP protocol elements include five-tuple information, a request header, a request body, a response header, and a response body;

[0049] Step S2, judging and identifying the gibberish element in the HTTP protocol element, identifying the gibberish element, wherein the gibberish is an encrypted / encoded character string;

[0050] Step S3: Analyze the gibberish elements through big data streaming analysis, filter out false positives, detect threats and issue alarms.

[0051] As a possible implementation of this embodiment, the step S1, collecting the traffic of the financial cloud data center and decoding the HTTP protocol, includes:

[0052] Use the Suricata network traffic capture tool to obtain all traffic in the encrypted tunnel of the financial cloud data center;

[0053] Parse all traffic to obtain HTTP protocol elements;

[0054] Decode the HTTP protocol elements and put the data into MQ (message queue) in the form of JSON.

[0055] As a possible implementation of this embodiment, the step S2, judging and identifying the gibberish element in the HTTP protocol element, and identifying the gibberish element, includes:

[0056] Step S21, determining the request content length of the HTTP protocol element, if the length is greater than 128 bytes, proceeding to the next step, otherwise the HTTP protocol element is not processed and the analysis is skipped;

[0057] Step S22, determine whether the HTTP protocol element is a non-visible character, take the first 64 bytes and the last 64 bytes of the message, read the number of non-visible characters, the definition of non-visible characters is that the ascill code value is less than 32 or the ascill code value is greater than 126, and the ascii code is not equal to the line feed, carriage return, space, tab character, if the proportion of non-visible characters is greater than 30%, then directly define the message as an encrypted message, if not an encrypted message, then enter the next step to continue to determine;

[0058] Step S23, delete the leading and trailing blank characters of the message, determine whether the message starts with { and ends with}, if yes, parse it through json, if it can be parsed, perform key:value mapping; and traverse the element set, if the length of the value is less than 64, directly discard it;

[0059] Step S24, if the parsing cannot be performed through json, determine whether the non-end of the message contains an = character, and if so, map the key-value pairs in a urlencode manner, using & as a group separator and = as a variable separator;

[0060] Step S25, if there is no = character at the non-end of the message, group it according to [,:;], and map the data to _no_key_n=value, where n is an increasing value; determine whether the length of value is greater than 64, if it is less than 64, discard it, and loop through until a set of all value key-value pairs with a length greater than 64 is obtained;

[0061] Step S26, traverse all key:value elements in the set, first convert the value to lowercase, determine the frequency of the characters [0-9, af], if the proportion is above 95, it is determined to be hexadecimal encoding, and the encoding label is hex, and the key value is output at the same time, and it is determined that the value is gibberish; if the proportion is less than 95, further gibberish recognition is performed.

[0062] As a possible implementation of this embodiment, in the process of judging and identifying gibberish elements in HTTP protocol elements, if a character combination cannot be understood or read by humans, it is judged as gibberish, that is, a value whose string is readable and understandable is defined as non-gibberish; a character combination whose meaning cannot be judged is defined as gibberish.

[0063] As a possible implementation of this embodiment, in the process of judging and identifying the gibberish element in the HTTP protocol element,

[0064] If the number of occurrences of high-frequency letters and low-frequency letters in a string conforms to the frequency distribution, it is considered readable and non-gibberish; if a readable string is encoded, hashed or encrypted, the frequency of its letters will most likely change and will not conform to the frequency distribution, then it is considered unreadable and gibberish.

[0065] As a possible implementation of this embodiment, the high-frequency letters are letters with a very high probability of appearing, and the low-frequency letters are letters with a very low probability of appearing.

[0066] Different business systems are distinguished in the statistical process, and the frequency of each letter in each message received in each business system is counted. The letters are sorted according to the number of times each frequency appears, and the top 5 letters of each frequency are selected to participate in the final frequency calculation process.

[0067] Select the top 5 values ​​of each letter frequency and calculate the final letter frequency:

[0068] ,

[0069] in, Represents the final frequency of each letter, The number ranking is The frequency of letters, Indicates the number of occurrences of high-frequency words;

[0070] If the total frequency of high-frequency letters in a string is greater than a threshold, the string is determined to be gibberish.

[0071] As a possible implementation of this embodiment, step S3, analyzing the gibberish elements by big data streaming analysis, filtering false positives, detecting threats and issuing alarms, includes:

[0072] Step S31, using the streaming analysis method (flink) of the big data analysis platform, an alarm is issued when a certain HTTP interface of nonsense language is continuously accessed within a period of time;

[0073] Step S32, performing refined alarm noise reduction by adding the gibberish parameters and gibberish type elements screened in the gibberish recognition process;

[0074] Step S33: output HTTP encrypted tunnel threat identification results.

[0075] like Figure 2 As shown, an embodiment of the present invention provides a device for detecting encrypted tunnel communication in a financial cloud data center, comprising:

[0076] A data collection module is used to collect the traffic of the financial cloud data center, decode the HTTP protocol, and obtain HTTP protocol elements, wherein the HTTP protocol elements include five-tuple information, a request header, a request body, a response header, and a response body;

[0077] A gibberish judgment module, used to judge and identify gibberish elements in HTTP protocol elements, and identify gibberish elements, wherein the gibberish is an encrypted / encoded string;

[0078] The gibberish analysis module is used to analyze gibberish elements through big data streaming analysis, filter false positives, detect threats and issue alarms.

[0079] The technical means adopted by the present invention are mainly divided into three parts: collecting and analyzing the traffic of the financial cloud data center; judging and identifying the gibberish elements; and detecting and alerting the traffic that conforms to the encrypted tunnel model.

[0080] 1. Traffic collection and protocol decoding.

[0081] 1) Traffic collection and decoding: The Financial Cloud Data Center uses Suricata to collect live network traffic and decode the HTTP protocol.

[0082] 2) Process the decoded version message, which contains five-tuple information, request header, request body, response header, response body and other HTTP protocol elements, and put the data into MQ in the form of JSON for consumption in subsequent links.

[0083] 2. Identification of gibberish elements.

[0084] Generally, the information exchanged in HTTP services is in plain text, using character strings that can be read by humans for data transmission.

[0085] Normal network traffic uses plain text strings to transmit information in various parts of the HTTP protocol. However, malicious HTTP tunnel applications will encode and encrypt the information to be transmitted in various ways in various parts of the HTTP protocol, making it impossible for humans to understand its meaning.

[0086] This type of encrypted / encoded string is called gibberish. Therefore, the core of HTTP tunnel detection is gibberish detection, and gibberish means that the message has been encoded or encrypted.

[0087] The specific detection process is as follows:

[0088] 1). Take the HTTP protocol element data in MQ in the first step and determine the request content length. If the length is less than 128 bytes, do not process it and skip the analysis, because low-byte samples will lower the overall recognition mean. At the same time, in actual production environment attack activities, the number of bytes transmitted using encrypted tunnels is usually much larger than 128 bytes;

[0089] 2). Determine whether it is an invisible character, take the first 64 bytes and the last 64 bytes of the message, and read the number of invisible characters. Invisible characters are defined as characters with an ascill code value less than 32 or an ascill code value greater than 126, and the ascii code is not equal to line feed, carriage return, space, or tab. If the proportion of invisible characters is greater than 30%, the message is directly defined as an encrypted message. If it is not an encrypted message, continue to determine;

[0090] 3). Delete the leading and trailing blank characters of the message, and check whether the message starts with { and ends with}. If so, try to parse it through json. If it can be parsed, perform key:value mapping. And traverse the element set. If the length of the value is less than 64, discard it directly;

[0091] 4). If JSON parsing cannot be completed, determine whether the message contains the character = (not at the end). If so, try to map the key-value pairs in the urlencode way, using & as the group separator and the character = as the variable separator;

[0092] 5). If the character = does not exist, try to group by [,:;], and the data is mapped to _no_key_n=value, where n is an increasing value. Determine whether the length of value is greater than 64. If it is less than 64, discard it and loop through it until a collection of all value key-value pairs with a length greater than 64 is obtained;

[0093] 6). Traverse all key:value elements in the collection, first convert the value to lowercase, determine the frequency of the characters [0-9a-f], if the percentage is above 95, then determine it as hexadecimal encoding, and the encoding label is hex, and output the key value at the same time, and determine that the value is gibberish. If the percentage is less than 95, further gibberish recognition is performed.

[0094] The definition of gibberish is a combination of characters that cannot be understood or read by humans. For example, "username=zhangsan&passwd=123456" is readable and can be understood as the value of the username and password, which is defined as non-gibberish; the string "6Z2e5Y+v6KeB5a2X56ym55qE55WM5a6a5piv" cannot be judged, and this type of character combination is defined as gibberish. Therefore, the core of gibberish recognition lies in how to distinguish the readability of the above two strings.

[0095] A large number of studies have shown that in vocabulary combinations, there are obvious differences in the frequency of occurrence of each of the 26 letters. For example, after counting 40,000 words, the Math Explorer's Project at Cornell University in the United States concluded that the probability of occurrence of the letter set "a", "e", "o", "i", and "t" is extremely high, and they are called high-frequency letters. The probability of occurrence of letters "j", "q", "x", and "z" is very low, and they are called low-frequency letters. In a text, if the number of times high-frequency and low-frequency letters appear conforms to the frequency distribution, then the text is considered readable and non-gibberish; if a string of readable text has been encoded, hashed, or encrypted, and its letter frequency is very likely to change and does not conform to the frequency distribution, then it is considered unreadable and belongs to gibberish. This is the core judgment logic of gibberish recognition.

[0096] In computer traffic language, vocabulary combinations are different from those in daily texts, resulting in discrepancies between letter frequencies and those in the above research. Therefore, 1 million sample messages from several application systems that do not use encryption technology are collected from the existing network traffic, and decoded and analyzed. The corresponding letter frequencies are counted according to the differences in each business system.

[0097] In order to eliminate the impact of abnormal data on the overall letter frequency, the frequency of each letter in each received message is counted, and these frequency data are plotted into a bubble chart to help identify the letters that appear more frequently in the message and their changing trends, providing a reliable basis for further data analysis and processing.

[0098] Although the high-frequency letters and frequencies are not exactly the same in each business system, they generally show the same pattern, that is, the letter set {e, a, c, t, i, n, o} appears very frequently, while the probability of {q, z, x, u} appearing is extremely low.

[0099] The final frequency of letters in each business system can be determined in the following way. That is, in order to eliminate the result deviation caused by abnormal data or different business systems and ensure the accuracy of the data. Different business systems are distinguished in the statistical process, the frequency of each letter in each message received in each business system is counted, and the frequencies are sorted according to the number of occurrences of each frequency, and the top 5 of each frequency are selected to participate in the calculation process of the final frequency.

[0100] The specific calculation method is shown in the formula. From the final frequency distribution diagram, select the top 5 values ​​of each letter frequency and calculate the final letter frequency:

[0101] ,

[0102] in, Represents the final frequency of each letter, The number ranking is The frequency of letters, Indicates the number of occurrences of high-frequency words.

[0103] Through statistics, it is found that in the process of constructing normal words or sentences in the current network traffic, the proportion of high-frequency letters {e, a, c, t, i, n, o} is much higher than that of other letters. For example, the proportion of e is more than 10%, but the proportion of Z is almost negligible. The proportion of high-frequency letters in different business systems is about 50%-60%, and the average is 52.4%. It can be concluded that the important basis for judging whether the sentence is disordered is whether the proportion of the above letters in the sentence conforms to the sentence construction rules.

[0104] Therefore, the overall frequency of the top 7 letters {e, a, c, t, i, n, o} in the entire message is selected as the basis for judging the disorder, that is:

[0105] ,

[0106] in, , etc. represent the final frequency of each high-frequency letter. is the total frequency of high-frequency letters.

[0107] set up The threshold value is 52.4%. When it is less than 52.4%, the statement is judged to be out of order, otherwise it is a non-out of order statement.

[0108] 3. Detection of encrypted tunnel threats.

[0109] 1) Data access: The first and second steps complete the traffic collection and gibberish recognition, and store the HTTP elements recognized as gibberish and the recognition results in MQ.

[0110] 2) Model formulation: With the help of the streaming analysis method (flink) of the big data analysis platform, an alarm is issued when a certain HTTP interface with random language is continuously accessed within a period of time.

[0111] 3) Alarm noise reduction: Since a large number of businesses in the current network environment of the financial cloud data center use message encryption to improve security, such businesses will cause some alarm noise (false alarms). The traditional whitening method using HTTP path, HTTP domain name, quintuple and other elements is not precise enough and is prone to missed reports. This method achieves refined alarm noise reduction by adding gibberish parameters and gibberish type elements that are screened during gibberish recognition.

[0112] 4) Alarm output: Output HTTP encrypted tunnel threat identification results.

[0113] The present invention proposes a method for effectively identifying malicious encrypted traffic transmitted using HTTP tunneling technology, and its beneficial effects are embodied in the following aspects.

[0114] 1) Improved detection capabilities for unknown threats and attacks. Without relying on known features and content analysis, it is possible to detect various unknown threats using HTTP tunnels, thus filling the gap in the data center security defense system.

[0115] 2) Reduce the impact of normal business on detection. Relying on pure traffic statistics and behavior analysis without checking the content improves monitoring efficiency and effectively reduces recognition performance loss compared to machine learning.

[0116] 3) Reduced false alarm rate. The statistical algorithm can effectively distinguish the difference between normal traffic and tunnel traffic, reducing false alarms.

[0117] 4) Good scalability. The algorithm only relies on the protocol itself, and can maintain its effect even if the protocol implementation changes, and is adaptable to the future development of HTTP.

[0118] 5) Fights against variants of attacks. The core of the detection algorithm does not rely on a specific implementation, so it can fight against variants of tunneling technology.

[0119] The method for detecting gibberish in this technology can also be trained using a supervised machine learning model for identification. However, it relies on training samples of gibberish and non-gibberish, and the samples need to change with the environment, which is not universal. In addition, in actual practice, the machine learning method places high demands on computing performance in the presence of massive data, which is not conducive to implementation.

[0120] An embodiment of the present invention provides an electronic device, including a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor communicates with the memory through the bus, and the processor executes the machine-readable instructions to perform the steps of any of the above-mentioned methods for detecting encrypted tunnel communications in a financial cloud data center.

[0121] Specifically, the above-mentioned memory and processor can be general-purpose memory and processor, which are not specifically limited here. When the processor runs the computer program stored in the memory, it can execute the above-mentioned method for detecting encrypted tunnel communications in the financial cloud data center.

[0122] Those skilled in the art will appreciate that the structure of the computer device does not constitute a limitation on the computer device, and may include more or fewer components than shown in the figure, or combine certain components, or split certain components, or arrange the components differently.

[0123] In some embodiments, the computer device may also include a touch screen that can be used to display a graphical user interface (e.g., a startup interface of an application) and receive user operations on the graphical user interface (e.g., startup operations on an application). The specific touch screen may include a display panel and a touch panel. The display panel may be configured in the form of LCD (Liquid Crystal Display), OLED (Organic Light-Emitting Diode), etc. The touch panel may collect the user's contact or non-contact operations on or near it, and generate pre-set operation instructions, for example, the user uses any suitable object such as a finger, a stylus, or an accessory on or near the touch panel. In addition, the touch panel may include two parts: a touch detection device and a touch controller. The touch detection device detects the user's touch position and posture, detects the signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts it into information that the processor can process, and then sends it to the processor, and can receive and execute commands from the processor. In addition, the touch panel can be implemented by various types such as resistive, capacitive, infrared and surface acoustic wave, and any technology developed in the future can also be used to implement the touch panel. Further, the touch panel can cover the display panel, and the user can operate on or near the touch panel covered on the display panel according to the graphical user interface displayed on the display panel. After the touch panel detects the operation on or near it, it is transmitted to the processor to determine the user input, and then the processor provides corresponding visual output on the display panel in response to the user input. In addition, the touch panel and the display panel can be implemented as two independent components or integrated.

[0124] Corresponding to the startup method of the above-mentioned application, an embodiment of the present invention also provides a storage medium, on which a computer program is stored. When the computer program is run by a processor, the steps of the method for detecting encrypted tunnel communications in any financial cloud data center are executed.

[0125] The application startup device provided in the embodiment of the present application can be specific hardware on the device or software or firmware installed on the device. The device provided in the embodiment of the present application, its implementation principle and the technical effect produced are the same as those in the aforementioned method embodiment. For the sake of brief description, the parts not mentioned in the device embodiment can refer to the corresponding contents in the aforementioned method embodiment. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, devices and units described above can all refer to the corresponding processes in the aforementioned method embodiment, and will not be repeated here.

[0126] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0127] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of modules is only a logical function division. There may be other division methods in actual implementation. For example, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0128] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical modules, that is, they may be located in one place or distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0129] In addition, each functional module in the embodiments provided in the present application may be integrated into one processing module, or each module may exist physically separately, or two or more modules may be integrated into one module.

[0130] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0131] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0132] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0133] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A method for detecting encrypted tunnel communication in a financial cloud data center, characterized in that: The steps include: Step S1, collecting traffic from the financial cloud data center, decoding the HTTP protocol, and obtaining HTTP protocol elements, wherein the HTTP protocol elements include five-tuple information, a request header, a request body, a response header, and a response body; Step S2, judging and identifying the gibberish element in the HTTP protocol element, identifying the gibberish element, wherein the gibberish is an encrypted / encoded character string; Step S3, analyzing the gibberish elements by means of big data streaming analysis, filtering out false positives, detecting threats and issuing alarms; The step S2, judging and identifying the gibberish elements in the HTTP protocol elements, and identifying the gibberish elements, includes: Step S21, determining the request content length of the HTTP protocol element, if the length is greater than 128 bytes, proceeding to the next step, otherwise the HTTP protocol element is not processed and the analysis is skipped; Step S22, determine whether the HTTP protocol element is a non-visible character, take the first 64 bytes and the last 64 bytes of the message, read the number of non-visible characters, the definition of non-visible characters is that the ascill code value is less than 32 or the ascill code value is greater than 126, and the ascii code is not equal to the line feed, carriage return, space, tab character, if the proportion of non-visible characters is greater than 30%, then directly define the message as an encrypted message, if not an encrypted message, then enter the next step to continue to determine; Step S23, delete the leading and trailing blank characters of the message, determine whether the message starts with { and ends with}, if yes, parse it through json, if it can be parsed, perform key:value mapping; and traverse the element set, if the length of the value is less than 64, directly discard it; Step S24, if the parsing cannot be performed through json, determine whether the non-end of the message contains an = character, and if so, map the key-value pairs in a urlencode manner, using & as a group separator and = as a variable separator; Step S25, if there is no = character at the non-end of the message, group it according to [,:;], and map the data to _no_key_n=value, where n is an increasing value; determine whether the length of value is greater than 64, if it is less than 64, discard it, and loop through until a set of all value key-value pairs with a length greater than 64 is obtained; Step S26, traverse all key:value elements in the set, first convert the value to lowercase, determine the frequency of the [0-9, af] characters, if the proportion is above 95%, it is determined to be hexadecimal encoding, and the encoding label is hex, and the key value is output at the same time, and it is determined that the value is gibberish; if the proportion is less than 95%, further gibberish recognition is performed.

2. The method for detecting encrypted tunnel communication in a financial cloud data center according to claim 1, characterized in that: The step S1 collects the traffic of the financial cloud data center and decodes the HTTP protocol, including: Use the Suricata network traffic capture tool to obtain all traffic in the encrypted tunnel of the financial cloud data center; Parse all traffic to obtain HTTP protocol elements; Decode the HTTP protocol elements and put the data into MQ in the form of JSON.

3. The method for detecting encrypted tunnel communication in a financial cloud data center according to claim 1, characterized in that: In the process of judging and identifying gibberish elements in HTTP protocol elements, character combinations that cannot be understood or read by humans are judged as gibberish, that is, values ​​whose strings are readable and understandable are defined as non-gibberish; character combinations whose meanings cannot be judged are defined as gibberish.

4. The method for detecting encrypted tunnel communication in a financial cloud data center according to claim 3, characterized in that: In the process of judging and identifying the gibberish elements in the HTTP protocol elements, If the number of occurrences of high-frequency letters and low-frequency letters in a string conforms to the frequency distribution, the string is considered readable and non-gibberish; if a readable string is encoded, hashed or encrypted and its letter frequency does not conform to the frequency distribution, it is considered unreadable and gibberish.

5. The method for detecting encrypted tunnel communication in a financial cloud data center according to claim 4, characterized in that: Different business systems are distinguished in the statistical process, and the frequency of each letter in each message received in each business system is counted. The letters are sorted according to the number of times each frequency appears, and the top 5 letters of each frequency are selected to participate in the final frequency calculation process. Select the top 5 values ​​of each letter frequency and calculate the final letter frequency: ， in, Represents the final frequency of each letter, The number ranking is The frequency of letters, Indicates the number of occurrences of high-frequency words; If the total frequency of high-frequency letters in a string is greater than a threshold, the string is determined to be gibberish.

6. The method for detecting encrypted tunnel communication in a financial cloud data center according to any one of claims 1 to 5, characterized in that: The step S3, analyzing the gibberish elements by means of big data streaming analysis, filtering false positives, detecting threats and issuing alarms, includes: Step S31, using the streaming analysis method flink of the big data analysis platform, an alarm is issued when a certain HTTP interface of nonsense language is continuously accessed within a period of time; Step S32, performing refined alarm noise reduction by adding the gibberish parameters and gibberish type elements screened in the gibberish recognition process; Step S33: output HTTP encrypted tunnel threat identification results.

7. A device for detecting encrypted tunnel communication in a financial cloud data center, characterized in that: include: A data collection module is used to collect the traffic of the financial cloud data center, decode the HTTP protocol, and obtain HTTP protocol elements, wherein the HTTP protocol elements include five-tuple information, a request header, a request body, a response header, and a response body; A gibberish judgment module, used to judge and identify gibberish elements in HTTP protocol elements, and identify gibberish elements, wherein the gibberish is an encrypted / encoded string; The gibberish analysis module is used to analyze gibberish elements through big data streaming analysis, filter false positives, detect threats and issue alarms; The gibberish judgment module is used to judge and identify the gibberish elements in the HTTP protocol elements. The process of identifying the gibberish elements includes the following steps: Step S21, determining the request content length of the HTTP protocol element, if the length is greater than 128 bytes, proceeding to the next step, otherwise the HTTP protocol element is not processed and the analysis is skipped; Step S22, determine whether the HTTP protocol element is a non-visible character, take the first 64 bytes and the last 64 bytes of the message, read the number of non-visible characters, the definition of non-visible characters is that the ascill code value is less than 32 or the ascill code value is greater than 126, and the ascii code is not equal to the line feed, carriage return, space, tab character, if the proportion of non-visible characters is greater than 30%, then directly define the message as an encrypted message, if not an encrypted message, then enter the next step to continue to determine; Step S23, delete the leading and trailing blank characters of the message, determine whether the message starts with { and ends with}, if yes, parse it through json, if it can be parsed, perform key:value mapping; and traverse the element set, if the length of the value is less than 64, directly discard it; Step S24, if the parsing cannot be performed through json, determine whether the non-end of the message contains an = character, and if so, map the key-value pairs in a urlencode manner, using & as a group separator and = as a variable separator; Step S25, if there is no = character at the non-end of the message, group it according to [,:;], and map the data to _no_key_n=value, where n is an increasing value; determine whether the length of value is greater than 64, if it is less than 64, discard it, and loop through until a set of all value key-value pairs with a length greater than 64 is obtained; Step S26, traverse all key:value elements in the set, first convert the value to lowercase, determine the frequency of the [0-9, af] characters, if the proportion is above 95%, it is determined to be hexadecimal encoding, and the encoding label is hex, and the key value is output at the same time, and it is determined that the value is gibberish; if the proportion is less than 95%, further gibberish recognition is performed.

8. An electronic device, characterized in that: It includes a processor, a memory and a bus, the memory stores machine-readable instructions executable by the processor, when the electronic device is running, the processor and the memory communicate through the bus, and the processor executes the machine-readable instructions to perform the steps of the method for detecting encrypted tunnel communications in a financial cloud data center as described in any one of claims 1-6.

9. A storage medium, characterized in that: The storage medium stores a computer program, which, when executed by a processor, executes the steps of the method for detecting encrypted tunnel communications in a financial cloud data center as described in any one of claims 1 to 6.

Images