Method and system for blocking HTTP (Hyper Text Transport Protocol) flow of TCP (Transmission Control Protocol) segment by network flow processing

Abstract

The invention belongs to but not limited to the technical field of network communication, and discloses a method and a system for blocking HTTP (Hyper Text Transport Protocol) flow of TCP (Transmission Control Protocol) segmentation by network flow processing, which are characterized in that after a network data packet is captured, an HTTP data packet is identified, whether an HTTP request header is segmented by a TCP is judged, if the HTTP request header is segmented, TCP segmentation data is recombined and cached, and after the HTTP request header is recombined, the TCP segmentation data is blocked by the network flow processing. According to the method, feature detection is carried out on HTTP head data including data information such as home, ur, host and user-agent, if malicious traffic is confirmed, blocking is carried out, and efficient and accurate blocking of TCP segmentation HTTP traffic is realized, so that network security is guaranteed, the security defense capability of a network boundary is effectively improved, hostile attacks carried out by utilizing an HTTP traffic TCP segmentation technology are prevented, and the network security is improved. And the integrity and confidentiality of network data are ensured.

Description

Technical Field

[0001] The present invention belongs to but is not limited to the field of network communication technology, and in particular relates to a method and system for blocking TCP segmented HTTP traffic through network traffic processing. Background Art

[0002] With the rapid development of the Internet, network traffic is increasing, and HTTP traffic has become the mainstream of network transmission. However, when HTTP traffic is transmitted at the TCP transport layer, it will be transmitted in segments due to reasons such as packet size limitations or network congestion. Due to its special transmission method, HTTP traffic is easily a carrier of network attacks. Network security issues are becoming increasingly prominent, and network security issues have become an important topic for maintaining network health. With the continuous development of network technology, network attack methods are becoming increasingly complex. As part of network communication, HTTP traffic is at risk of being maliciously exploited. HTTP traffic TCP segmentation is a common network attack method. Attackers bypass firewall detection by dividing malicious data into many small fragments, thereby penetrating and attacking the target system.

[0003] In order to ensure the security of network communications, blocking the HTTP traffic of TCP segments is an important means to ensure network security. A method for blocking the HTTP traffic of TCP segments by network traffic processing is needed. Summary of the invention

[0004] In view of the problems existing in the prior art, the present invention provides a method and system for blocking HTTP traffic of TCP segments by network traffic processing.

[0005] The present invention is implemented as follows: a method for blocking TCP segmented HTTP traffic by network traffic processing, comprising building a fragmented message feature recognition model, capturing network data packets, identifying HTTP data packets after capturing the network data packets, judging whether the HTTP request header is segmented by TCP, and if so, reassembling and caching the TCP segmented data. After the HTTP request header is reassembled, feature detection is performed on the HTTP header data, including data information such as method, uri, host, user-agent, etc. If it is confirmed to be malicious traffic, blocking is performed.

[0006] Furthermore, the method for blocking the HTTP traffic of TCP segment by the network traffic processing specifically includes:

[0007] Step 1: HTTP traffic identification;

[0008] Step 2: Extract TCP segment traffic features;

[0009] Step 3: TCP segmented traffic reassembly and verification;

[0010] Step 4: Block malicious HTTP traffic;

[0011] Step 5: Record the log.

[0012] Furthermore, in step one, the data packets in the network are captured and analyzed through the fragmented message feature recognition model to identify the data packets containing HTTP requests.

[0013] Furthermore, in step 2, for the identified HTTP traffic, key features are extracted, including but not limited to TCP segment size, segment number, segment interval, segment order, key character string, etc. These features will be used for TCP segment HTTP traffic analysis and identification to confirm that the HTTP traffic header data is incomplete and needs to be reassembled. Otherwise, malicious traffic cannot be accurately detected.

[0014] Furthermore, in step 3, for suspected malicious TCP segmented HTTP traffic, we attempt to reassemble its multiple TCP segments in order to restore it to a complete HTTP request header. Subsequently, we further verify the reassembled HTTP request, including content inspection, URL analysis, HOST analysis, request header verification, etc., to confirm whether it is a malicious request.

[0015] Furthermore, once a certain HTTP traffic is confirmed to be malicious in step 4, blocking measures are immediately initiated. The specific blocking method can be configured according to actual needs, including but not limited to sending REST messages, FIN messages, HTTP302 redirection, discarding the message, etc. At the same time, the feature library of malicious traffic can also be updated according to the blocking results to improve the accuracy of subsequent detection.

[0016] Furthermore, in step five, blocking logs, notification messages, etc. are output.

[0017] Another object of the present invention is to provide a method for network traffic processing to block HTTP traffic of TCP segments, and a system for network traffic processing to block HTTP traffic of TCP segments, comprising:

[0018] Traffic identification module, used for HTTP traffic identification; it captures and analyzes data packets in the network through the fragmented message feature identification model, and identifies data packets containing HTTP requests;

[0019] The feature extraction module is used for extracting TCP segment traffic features; for the identified HTTP traffic, its key features are extracted, including but not limited to TCP segment size, number of segments, segment interval, segment order, and key character strings;

[0020] Traffic reassembly and verification module, used for TCP segmented traffic reassembly and verification; for suspected malicious TCP segmented HTTP traffic, multiple TCP segments are reassembled in sequence to restore the complete HTTP request header; the reassembled HTTP request is further verified, including content inspection, URL analysis, HOST analysis, request header verification, etc., to confirm whether it is a malicious request;

[0021] Traffic blocking module, used to block malicious HTTP traffic; blocking methods include but are not limited to sending REST messages, FIN messages, HTTP302 redirection, discarding the message, etc.; at the same time, the feature library of malicious traffic can be updated according to the blocking results to improve the accuracy of subsequent detection;

[0022] The recording module is used to record logs, output blocking logs, and notification messages.

[0023] Another object of the present invention is to provide a computer device, the computer device includes a memory and a processor, the memory stores a computer program, when the computer program is executed by the processor, the processor executes the steps of the method for blocking TCP segmented HTTP traffic by network traffic processing.

[0024] Another object of the present invention is to provide a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the processor executes the steps of the method for blocking TCP segmented HTTP traffic by network traffic processing.

[0025] Another object of the present invention is to provide an information data processing terminal, which includes the network traffic processing system for blocking TCP segmented HTTP traffic.

[0026] In combination with the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solutions to be protected by the present invention are as follows:

[0027] First, the present invention provides a method for blocking TCP segmented HTTP traffic by network traffic processing, which realizes efficient and accurate blocking of TCP segmented HTTP traffic by building a fragmented message feature recognition model, capturing and analyzing network data packets, identifying HTTP segmented messages, message reassembly and blocking, etc. It solves the problem that existing network security equipment is insufficient in recognizing HTTP traffic, effectively improves the security defense capability of the network boundary, prevents malicious attacks using HTTP traffic TCP segmentation technology, and ensures the integrity and confidentiality of network data.

[0028] Second, the expected benefits and commercial value of the technical solution of the present invention after transformation are: reducing losses. This network security device or software can effectively block HTTP traffic in TCP segments, thereby reducing network security risks, such as DDoS attacks, etc. This can reduce the losses of enterprises, thereby indirectly generating commercial value.

[0029] (1) The technical solution of the present invention solves a technical problem that people have long been eager to solve but have never been able to solve: this technical problem lies in how to accurately distinguish and process normal TCP segment flows from potential malicious segment flows, which is a recognized challenge in previous network traffic management systems.

[0030] Traditional network security protection systems often have difficulty efficiently processing and identifying complex TCP segmented HTTP traffic. This type of traffic is often used by malware to perform attacks, such as creating denial of service attacks (DDoS) or performing data exfiltration. Such attacks take advantage of the TCP protocol's segmentation mechanism to evade traditional security detection systems.

[0031] The present invention develops a method for blocking HTTP traffic of TCP segments by developing a network traffic processing method, which can analyze and identify malicious TCP segment flows in real time and analyze the behavior pattern of data flows, thus greatly improving the accuracy and efficiency of detection.

[0032] (2) The technical solution of the present invention overcomes technical prejudice: In traditional network traffic processing methods, a blocking method based on IP addresses or port numbers is usually used. This method cannot accurately block HTTP traffic because HTTP traffic is usually transmitted through TCP connections, and TCP connections are transmitted through IP data packets. Therefore, traditional blocking methods based on IP addresses or port numbers will lead to incorrect blocking and affect normal network communications. When blocking HTTP traffic, it is also a matter of course that key information will not be segmented by TCP, and host, url and other information can be normally identified for blocking. In fact, this is not the case. When maliciously exploited, network attack methods can specifically split key information and bypass detection and identification, thereby achieving penetration and attack on the target system. The present invention provides an HTTP traffic blocking method based on TCP segmentation. The method reorganizes the key data in the HTTP header to identify malicious requests and block them. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 It is a flow chart of a method for blocking TCP segmented HTTP traffic by network traffic processing provided by an embodiment of the present invention;

[0034] Figure 2It is a system structure diagram of the network traffic processing provided by an embodiment of the present invention for blocking HTTP traffic of TCP segments. DETAILED DESCRIPTION

[0035] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0036] The following are two specific examples of blocking HTTP traffic in TCP segments:

[0037] Example 1: Blocking method for defending against SQL injection attacks

[0038] A company's website was hit by a continuous SQL injection attack. Attackers used parameters in HTTP requests to inject malicious SQL code, destroy the database or steal data. To deal with such attacks, the company deployed a network security system based on TCP segment reassembly and HTTP traffic blocking.

[0039] 1) HTTP traffic identification

[0040] The system first identifies all incoming network traffic and marks it as belonging to the HTTP protocol. In one attack, the system detected an HTTP POST request transmitted via the TCP protocol, and its data was divided into multiple TCP packets for transmission.

[0041] 2) TCP segment traffic feature extraction

[0042] The system analyzes the TCP segments of the HTTP traffic, extracts the sequence number, acknowledgment number, and flag information of each segment, and ensures that all TCP segments are captured. The system marks these segments as target traffic that needs to be reassembled.

[0043] 3) TCP segmented traffic reassembly and verification

[0044] The system reassembles these TCP segments in the correct order based on the extracted sequence number information to restore the complete HTTP POST request data. After the reassembly is completed, the system verifies that the data has not been tampered with through CRC check and other integrity checks.

[0045] 4) Blocking malicious HTTP traffic

[0046] When analyzing the content of the reorganized HTTP request, the system found that the request parameters contained typical SQL injection statements (such as "OR" 1" = "1"). The system immediately triggered the blocking mechanism, interrupting the connection by sending a RST (reset) packet to the source end and discarding the HTTP request packet, preventing the SQL injection attack from succeeding.

[0047] 5) Record logs

[0048] The system records a detailed log of the blocking action, including the attacker's IP address, the target server's IP address and port number, timestamp, blocking reason (SQL injection detection), and the reorganized complete HTTP request content. The log is securely stored for subsequent security audits and analysis.

[0049] Through this embodiment, the company successfully prevented a SQL injection attack, protected the security of its database, and provided effective data support for subsequent optimization of security protection strategies.

[0050] Example 2: Blocking method for preventing cross-site scripting (XSS) attacks

[0051] An e-commerce platform discovered a cross-site scripting (XSS) attack in the comment area submitted by its users. The attacker attempted to steal other users' cookie information or conduct phishing attacks by injecting malicious scripts. To prevent such attacks, the platform deployed a protection system based on TCP segmentation and HTTP traffic blocking.

[0052] 1) HTTP traffic identification

[0053] The system detects an HTTP GET request from a user's browser, which contains the comment content submitted by the user. Since the comment content is long, the data is transmitted in segments via the TCP protocol. The system identifies the traffic as HTTP traffic and prepares for in-depth analysis.

[0054] 2) TCP segment traffic feature extraction

[0055] The system extracts the TCP segment features of the HTTP traffic, including the sequence number and confirmation number of each segment and its position in the entire request. Due to the large amount of data, the system recognizes that multiple TCP segments need to be reassembled.

[0056] 3) TCP segmented traffic reassembly and verification

[0057] The system reassembles these TCP segments based on the extracted feature information and restores the complete HTTP GET request data. After the reassembly is completed, the system verifies that all segments are correctly spliced ​​and the data is complete and correct.

[0058] 4) Blocking malicious HTTP traffic

[0059] The system analyzes the reorganized request content and finds that it contains typical XSS attack codes (such as ` <script>alert('XSS')< / script> `). The system immediately blocks the request, discards all related data packets, and terminates the connection by sending an RST packet to prevent malicious scripts from being executed on the platform.

[0060] 5) Record logs

[0061] After the blocking operation is completed, the system generates a detailed log, including the attacker's IP address, the target server's IP address, the blocking time, the reason (XSS attack code was detected), and the reorganized complete HTTP request content. The log records are stored in the platform's security log system for further security analysis and improved protection measures.

[0062] Through this embodiment, the e-commerce platform successfully prevented an XSS attack, protected the privacy of users and the security of the platform, and prevented malicious scripts from being executed in the user's browser. The blocking log provides valuable reference data for subsequent security monitoring.

[0063] After capturing network data packets, the present invention identifies HTTP data packets and determines whether the HTTP request header is segmented by TCP. If so, the TCP segmented data is reassembled and cached. After the HTTP request header is reassembled, feature detection is performed on the HTTP header data, including method, uri, host, user-agent and other data information. If it is confirmed to be malicious traffic, it is blocked to ensure network security.

[0064] like Figure 1 As shown, a method for blocking HTTP traffic of TCP segmentation by network traffic processing provided by an embodiment of the present invention includes the following steps:

[0065] (1) HTTP traffic identification

[0066] First, by capturing and analyzing the data packets in the network, the data packets containing HTTP requests are identified.

[0067] (2) TCP segment traffic feature extraction

[0068] For the identified HTTP traffic, extract its key features, including but not limited to TCP segment size, segment number, segment interval, segment order, key string, etc. These features will be used for TCP segment HTTP traffic analysis and identification to confirm that the HTTP traffic header data is incomplete and needs to be reassembled. Otherwise, malicious traffic cannot be accurately detected.

[0069] (3) TCP segmented traffic reassembly and verification

[0070] For suspected malicious TCP segmented HTTP traffic, we try to reassemble its multiple TCP segments in order to restore it to a complete HTTP request header. Then, we further verify the reassembled HTTP request, including content inspection, URL analysis, HOST analysis, request header verification, etc., to confirm whether it is a malicious request.

[0071] (4) Blocking malicious HTTP traffic

[0072] Once a certain HTTP traffic is confirmed to be malicious, blocking measures are initiated immediately. The specific blocking method can be configured according to actual needs, including but not limited to sending REST messages, FIN messages, HTTP302 redirection, discarding the message, etc. At the same time, the feature library of malicious traffic can be updated according to the blocking results to improve the accuracy of subsequent detection.

[0073] (5) Record logs

[0074] Finally, the blocking log, notification message, etc. are output.

[0075] The following is a detailed description of the working principle of the method for blocking TCP segmented HTTP traffic by network traffic processing:

[0076] Step 1: HTTP traffic identification

[0077] In the initial stage of network traffic processing, the system monitors and classifies incoming network traffic in real time. By analyzing the protocol header of the data packet, the system identifies traffic belonging to the HTTP protocol. This process involves parsing the data fields in the TCP / IP protocol stack, especially matching the characteristic fields of HTTP requests and responses, such as port numbers (usually 80 or 443), HTTP methods (such as GET, POST), and HTTP header fields. The identified HTTP traffic will be marked as target traffic for further analysis and processing. Step 2: TCP segmented traffic feature extraction

[0078] After identifying HTTP traffic, the system further checks whether the traffic has been segmented by TCP. Since most HTTP traffic transmits a large amount of data, it is often transmitted in segments. The system extracts the characteristics of TCP segmented traffic by analyzing the sequence number, confirmation number, and flag bits (such as SYN, FIN, ACK, etc.) in the TCP header. These characteristics include the sequence number range of each data packet, the size of the segment, and the order of the segment. This information is used for subsequent traffic reassembly and verification.

[0079] Step 3: TCP segmented traffic reassembly and verification

[0080] After extracting the TCP segmentation features, the system reassembles the segmented traffic to restore the complete HTTP data stream. During the reassembly process, the system splices different data packets in the correct order based on the extracted sequence number and confirmation number information, and checks whether there are any data packets lost or duplicated. In order to ensure the integrity and accuracy of the data, the system verifies the reassembled traffic and uses a checksum algorithm (such as CRC check) to confirm that the data has not been tampered with or damaged. After successful verification, the system submits the reassembled HTTP traffic to the next step for security analysis.

[0081] Step 4: Block malicious HTTP traffic

[0082] After reassembling and verifying HTTP traffic, the system conducts in-depth analysis of its content to detect potential malicious activities. The analysis includes but is not limited to threat features such as SQL injection, cross-site scripting (XSS), and malicious file download links. If the system detects malicious behavior or abnormal patterns in the traffic, it will immediately trigger the blocking mechanism. The blocking method can be to directly discard the corresponding TCP connection, or to send a RST (reset) packet to the source to interrupt the communication, thereby effectively preventing the malicious HTTP traffic from continuing to spread. At the same time, the system records relevant logs for subsequent security audits and analysis.

[0083] Step 5: Record logs

[0084] After the malicious HTTP traffic is blocked, the system will record the log information of the entire process in detail. The log content includes the source IP address, target IP address, port number, timestamp, blocking reason, and reorganized HTTP request or response content of the blocked traffic. These log data will be stored in the security log system and can be further reviewed by security analysts or used as a supplementary data source for intrusion detection systems to optimize subsequent security policies. By recording each blocking action in detail, the system can continuously improve its detection and protection capabilities and provide more efficient network security protection.

[0085] like Figure 2 As shown, a method for network traffic processing to block HTTP traffic of TCP segments provided by an embodiment of the present invention includes:

[0086] Traffic identification module, used for HTTP traffic identification; it captures and analyzes data packets in the network through the fragmented message feature identification model, and identifies data packets containing HTTP requests;

[0087] The feature extraction module is used for extracting TCP segment traffic features; for the identified HTTP traffic, its key features are extracted, including but not limited to TCP segment size, number of segments, segment interval, segment order, and key character strings;

[0088] Traffic reassembly and verification module, used for TCP segmented traffic reassembly and verification; for suspected malicious TCP segmented HTTP traffic, multiple TCP segments are reassembled in sequence to restore the complete HTTP request header; the reassembled HTTP request is further verified, including content inspection, URL analysis, HOST analysis, request header verification, etc., to confirm whether it is a malicious request;

[0089] Traffic blocking module, used to block malicious HTTP traffic; blocking methods include but are not limited to sending REST messages, FIN messages, HTTP302 redirection, discarding the message, etc.; at the same time, the feature library of malicious traffic can be updated according to the blocking results to improve the accuracy of subsequent detection;

[0090] The recording module is used to record logs, output blocking logs, and notification messages.

[0091] The specific application fields or related products of the present invention.

[0092] The specific application areas of this technical solution include network security, flow control, etc. The related products are some network security equipment, such as firewalls, IDS / IPS, etc., or some network security software, such as flow control software, firewall software, etc.

[0093] The purpose of this technical solution is to block TCP segmented HTTP traffic. HTTP traffic is a type of application layer protocol traffic, commonly used for web browsing, HTTP servers, etc. TCP segmentation means that TCP packets are divided into multiple small blocks for transmission. This transmission method can cause some security issues, such as DDoS attacks. Therefore, the method of blocking TCP segmented HTTP traffic has high practical value in the field of network security.

[0094] Application areas:

[0095] Network Security and Firewalls: This method can be integrated into network security systems, especially enterprise-level or telecommunications-level firewalls and intrusion detection systems, to enhance control and security monitoring of network traffic.

[0096] Data Center: In data centers, especially in cloud service provider networks, blocking HTTP traffic over TCP segments can optimize resource usage and prevent malicious traffic and service abuse.

[0097] Content Delivery Network (CDN): CDN providers use this method to improve the distribution efficiency of network content by blocking unnecessary segmented traffic, reducing bandwidth waste and increasing user access speed.

[0098] ISP Services: Internet service providers can implement this technology at their network boundaries to more efficiently manage network traffic and provide a smoother service experience to users.

[0099] Related Products:

[0100] Next Generation Firewall (NGFW): These advanced firewall devices can integrate multiple security functions, including application layer filtering, intrusion prevention and behavioral analysis. The present invention can be added as one of the features.

[0101] Traffic shaping and quality management devices: These products are specifically designed to manage and optimize network traffic, ensuring that critical business traffic is prioritized and limiting or blocking less important traffic.

[0102] Intrusion Detection and Prevention Systems (IDS / IPS): The present invention can become a part of these systems, helping network administrators identify and respond to potential network threats.

[0103] Load balancer: Especially in high-traffic websites or online services, load balancers can use this technology to block TCP segmented HTTP requests in DDoS attacks and protect backend servers from excessive load.

[0104] Security Information and Event Management (SIEM) systems: This type of log management and analysis software can utilize the methods of the present invention to record and analyze blocked traffic and provide insights to security teams.

[0105] Network monitoring and management tools: These include network performance monitoring and diagnostic tools, which can use this technology to provide more precise traffic analysis and reporting.

[0106] By integrating into existing network security and traffic management products, the technical solution of the present invention can help organizations more effectively control their network environment and improve security and efficiency.

[0107] Relevant evidence of the technical effects achieved by the embodiments of the present invention.

[0108] Efficiency improvement: Through comparative tests, it is shown that after blocking the HTTP traffic of TCP segmentation, the efficiency of network traffic processing is improved. The time required to process the same amount of traffic is reduced, and more traffic can be processed in the same amount of time.

[0109] Blocking success rate: Improves the ratio or number of successful blocking of HTTP traffic in TCP segments, especially in high-traffic stress tests, and can effectively identify and block HTTP traffic in TCP segments.

[0110] Security enhancement: Improve network security and effectively block potential attacks and malicious traffic. Through simulated attacks and tests, it is proven that this method can effectively block or reduce the security risks brought by TCP segmented HTTP traffic, such as DDoS attacks.

[0111] Improved user experience: For end users, it can reduce web page loading time, provide more stable services, and improve user experience.

[0112] It should be noted that the embodiments of the present invention can be implemented by hardware, software, or a combination of software and hardware. The hardware part can be implemented using dedicated logic; the software part can be stored in a memory and executed by an appropriate instruction execution system, such as a microprocessor or dedicated design hardware. It can be understood by a person of ordinary skill in the art that the above-mentioned devices and methods can be implemented using computer executable instructions and / or contained in a processor control code, such as a carrier medium such as a disk, CD or DVD-ROM, a programmable memory such as a read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. Such code is provided on the carrier medium. The device and its modules of the present invention can be implemented by hardware circuits such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, etc., or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc., can also be implemented by software executed by various types of processors, and can also be implemented by a combination of the above-mentioned hardware circuits and software, such as firmware.

[0113] The above description is only a specific implementation mode of the present invention, but the protection scope of the present invention is not limited thereto. Any modifications, equivalent substitutions and improvements made by any technician familiar with the technical field within the technical scope disclosed by the present invention and within the spirit and principle of the present invention should be covered by the protection scope of the present invention.

Claims

1. A method for blocking TCP segmented HTTP traffic by network traffic processing, characterized in that: The following steps are involved: Step 1: HTTP traffic identification; Step 2: Extract TCP segment traffic features; Step 3: TCP segmented traffic reassembly and verification; Step 4: Block malicious HTTP traffic; Step 5: Record the log.

2. The method for blocking HTTP traffic of TCP segmentation by network traffic processing according to claim 1, characterized in that: In step 1, the data packets in the network are captured and analyzed through the fragmented message feature recognition model to identify the data packets containing HTTP requests.

3. The method for blocking HTTP traffic of TCP segmentation by network traffic processing according to claim 1, characterized in that: In step 2, the key features of the identified HTTP traffic are extracted. Including but not limited to TCP segment size, number of segments, segment interval, segment order, key string; These features are used for TCP segmentation HTTP traffic analysis and identification. If the HTTP traffic header data is confirmed to be incomplete, the HTTP header data is reassembled. Otherwise, malicious traffic cannot be accurately detected.

4. The method for blocking HTTP traffic of TCP segmentation by network traffic processing according to claim 1, characterized in that: In step 3, for suspected malicious TCP segmented HTTP traffic, its multiple TCP segments are reassembled in sequence and restored to a complete HTTP request header; then, the reassembled HTTP request is further verified, including content inspection, URL analysis, HOST analysis, and request header verification, to confirm whether it is a malicious request.

5. The method for blocking HTTP traffic of TCP segmentation by network traffic processing according to claim 1, characterized in that: In step 4, once a certain HTTP traffic is confirmed to be malicious, blocking measures are immediately initiated; the blocking method is configured according to actual needs, including but not limited to sending REST messages, FIN messages, HTTP302 jumps, and discarding the message; the feature library of malicious traffic is also updated according to the blocking results to improve the accuracy of subsequent detection.

6. The method for blocking HTTP traffic of TCP segmentation by network traffic processing according to claim 1, characterized in that: In step 5, the blocking log and notification message are output.

7. A method for blocking HTTP traffic of TCP segment by network traffic processing according to any one of claims 1 to 6, a system for blocking HTTP traffic of TCP segment by network traffic processing, characterized in that: include: Traffic identification module, used for HTTP traffic identification; The fragmented message feature recognition model is used to capture and analyze data packets in the network and identify data packets containing HTTP requests. The feature extraction module is used for extracting TCP segment traffic features; for the identified HTTP traffic, its key features are extracted, including but not limited to TCP segment size, number of segments, segment interval, segment order, and key character strings; Traffic reassembly and verification module, used for TCP segmented traffic reassembly and verification; for suspected malicious TCP segmented HTTP traffic, multiple TCP segments are reassembled in sequence to restore the complete HTTP request header; the reassembled HTTP request is further verified, including content inspection, URL analysis, HOST analysis, and request header verification, to confirm whether it is a malicious request; Traffic blocking module, used to block malicious HTTP traffic; blocking methods include but are not limited to sending REST messages, FIN messages, HTTP302 redirection, and discarding the message; the malicious traffic feature library is also updated according to the blocking results to improve the accuracy of subsequent detection; The recording module is used to record logs, output blocking logs, and notification messages.

8. A computer device, characterized in that: The computer device includes a memory and a processor, the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the method for blocking TCP segmented HTTP traffic by network traffic processing as described in any one of claims 1 to 6.

9. A computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to execute the steps of the method for blocking TCP segmented HTTP traffic by network traffic processing as described in any one of claims 1 to 6.

10. An information data processing terminal, characterized in that: The information data processing terminal includes the network traffic processing system described in claim 7 for blocking the HTTP traffic of TCP segments.

Images