A method and system for identifying application behavior based on operator traffic fingerprint analysis

Abstract

The present invention relates to the field of application behavior identification technology, and is an application behavior identification method and system based on operator traffic fingerprint analysis. The specific method includes: recombining multiple TCP data frames into a complete TCP communication flow, and obtaining the behavior information and TLS fingerprint information of the application traffic transmitted through the operator network in real time; constructing an application behavior deviation identification model, and outputting the behavior deviation degree of the application in different behavior identification time periods; analyzing the behavior evolution trend of the application in the network, obtaining the behavior evolution coefficient, and customizing and allocating the application-adapted network monitoring strategy. The present invention solves the problem in the prior art that the application behavior monitoring is affected by the capabilities of the terminal equipment and the network environment, and it is difficult to meet the real-time monitoring requirements in high-concurrency and large-scale network environments, and the application traffic analysis is not in-depth enough.

Description

Technical Field

[0001] The present invention relates to the technical field of application behavior identification, and is an application behavior identification method and system based on operator traffic fingerprint analysis. Background Art

[0002] With the rapid development of mobile Internet and Internet of Things, the importance of application behavior recognition in network security, performance optimization and user experience management has become increasingly prominent. Traditional application behavior recognition methods mainly rely on data collection and analysis of terminal devices. Although this method can provide certain behavior monitoring capabilities, it has obvious limitations when facing large-scale and high-concurrency network environments. First, the data collection capabilities of terminal devices are limited by the computing resources and network environment of the device, making it difficult to capture the behavior characteristics of applications in real time and comprehensively. Especially in mobile network environments, the frequent switching of terminal devices and the instability of network bandwidth further increase the difficulty of data collection. Secondly, when processing complex application traffic, the existing methods based on packet analysis lack in-depth analysis of TLS (Transport Layer Security) encrypted traffic, resulting in low recognition accuracy and efficiency. Although TLS encryption technology improves the security of communication, it also brings new challenges to network monitoring and behavior recognition.

[0003] In addition, with the continuous enrichment of application functions and the diversification of user needs, application behavior has shown dynamic characteristics. Traditional static monitoring strategies are difficult to adapt to such rapid changes, resulting in poor monitoring results. Therefore, how to identify application behavior in real time and accurately in a large-scale, high-concurrency network environment has become a technical problem that needs to be solved urgently. Summary of the invention

[0004] The purpose of this section is to summarize some aspects of embodiments of the present invention and briefly introduce some preferred embodiments. Some simplifications or omissions may be made in this section and the specification abstract and the invention title of this application to avoid blurring the purpose of this section, the specification abstract and the invention title, and such simplifications or omissions cannot be used to limit the scope of the present invention.

[0005] The technical problem to be solved by the present invention is that in the prior art, application behavior monitoring is limited by the capabilities of terminal devices and the network environment, making it difficult to meet the real-time monitoring needs in high-concurrency and large-scale network environments, and the application traffic analysis is not in-depth enough. An application behavior identification method and system based on operator traffic fingerprint analysis are proposed.

[0006] In order to achieve the above object, the present invention provides a technical solution for an application behavior identification method based on operator traffic fingerprint analysis, comprising the following steps:

[0007] S1: obtain multiple TCP data frames of application traffic, and reassemble the captured multiple TCP data frames into a complete TCP communication flow;

[0008] S2: Obtains behavior information of application traffic transmitted through the operator network in real time, and extracts TLS fingerprint information from the application traffic;

[0009] S3: construct an application behavior deviation identification model, import the behavior information and TLS fingerprint information into the application behavior deviation identification model, and output the behavior deviation degree of the application in different behavior identification periods;

[0010] S4: Analyze the behavior evolution trend of the application in the network according to the output result of the application behavior deviation identification model, and obtain the behavior evolution coefficient;

[0011] S5: Customize and allocate a network monitoring strategy adapted to the application based on the behavior evolution coefficient of the application.

[0012] Specifically, S1 includes the following specific steps:

[0013] S11: Receive TCP data frames and record their timestamps and data values. TCP (Transmission Control Protocol) data frames refer to data units transmitted in the TCP protocol. TCP is a connection-oriented, reliable transport layer protocol widely used for data transmission in various applications on the Internet.

[0014] S12: sorting the TCP data frames according to the timestamps, and performing missing frame determination processing on the sorted TCP data frames;

[0015] S13: performing interpolation processing on the missing data frames according to the missing frame determination processing result;

[0016] S14: Input the interpolated data stream into the Kalman filter to obtain a smoothed data stream, and output a reassembled and smoothed TCP data stream.

[0017] Specifically, in S12, the missing frame determination process specifically includes:

[0018] S121: Calculate the timestamp intervals of all adjacent data frames to form a timestamp interval set A. , where a is the subscript, indicating the ath timestamp interval, and I is the subscript, indicating the total number of TCP data frames that have been obtained;

[0019] S122: Calculate the average timestamp interval and the standard deviation of the timestamp interval, wherein the average timestamp interval The calculation strategy is: ; The standard deviation of the timestamp interval The calculation strategy is: ;

[0020] S123: Preset time stamp interval tolerance interval , screening the timestamp intervals in the timestamp interval set A that are outside the interval tolerance interval, marking the two TCP data frames corresponding to the screened timestamp intervals as missing frames, traversing the timestamp interval set A, and obtaining a first missing frame set;

[0021] S124: Extract the first missing frame set, and find the current time position of each missing frame in the first missing frame set , calculate the number of forward data frames for each missing frame and the backward dataframe data , where the number of forward data frames is The calculation strategy is: , the backward data frame data The calculation strategy is: ;

[0022] S125: Perform adaptive complement condition screening of missing frames. or or When the missing frame does not meet the adaptive completion conditions, mark the missing frame as not meeting the adaptive completion conditions, make all missing frames that do not meet the adaptive completion conditions into retransmission data packets, and request the sender to resend the data frames in the data packet through the retransmission mechanism of the TCP protocol; otherwise, execute step S13.

[0023] Specifically, in S13, the interpolation processing specifically includes:

[0024] ;

[0025] Where i and k are subscripts, indicating the index of the obtained TCP data frame;

[0026] j is a subscript, indicating the index of the data frame that needs to be interpolated;

[0027] They are the data values ​​of the obtained TCP data frames and the missing frames that need to be interpolated respectively;

[0028] is the time position of the missing frame that needs to be interpolated; The obtained TCP data frames are indexed as i and k respectively;

[0029] is the time decay factor, , is the attenuation amplitude constant, , c is the decay interval proportional constant.

[0030] Specifically, S3 includes the following specific steps:

[0031] S31: constructing an application behavior deviation identification model, wherein the application behavior deviation degree identification model includes: a behavior information identification sub-model and a TLS fingerprint information identification sub-model;

[0032] S32: importing the behavior information into the behavior information recognition sub-model, outputting the behavior deviation value, the behavior deviation value The calculation strategy is:

[0033] ;

[0034] in, They are the contribution ratio coefficients of abnormal request frequency and abnormal request duration respectively;

[0035] is the request frequency anomaly coefficient of the u-th request behavior of the application;

[0036] , u is the subscript, indicating the u-th request behavior, represents the time interval between the u-th request behavior and the u-1-th request behavior, represents the mean time interval of all request behaviors before the u-th request behavior occurs, are the maximum and minimum time intervals among all request behaviors before the u-th request behavior occurs, respectively;

[0037] is the request duration abnormality coefficient of the u-th request behavior of the application,

[0038] , Indicates the duration of the u-th request behavior, represents the average duration of all request behaviors before the u-th request behavior occurs; Indicates the maximum and minimum durations of all request behaviors before the u-th request behavior occurs; The length in bytes of the data group representing the u-th request behavior; Indicates the closest byte length of the data group of all request behaviors before the uth request behavior occurs The length of the data group in bytes.

[0039] Specifically, S3 also includes the following specific steps:

[0040] S33: Importing the TLS fingerprint information into the TLS fingerprint information identification sub-model, and outputting the TLS fingerprint deviation value, wherein the TLS fingerprint deviation value The calculation strategy is:

[0041] ;

[0042] in, They are the contribution ratio coefficients of the cipher suite type and the extension field length respectively;

[0043] f is a subscript, indicating the index of TLS fingerprint; U is the total number of TLS fingerprints of U request behaviors in the complete TCP communication flow;

[0044] The number of cipher suites representing the TLS fingerprint of the u-th request behavior; Indicates the number of cipher suites of the TLS fingerprint when index is f;

[0045] The length of the extended field of the TLS fingerprint representing the u-th request behavior;

[0046] Indicates the length of the extended field of the TLS fingerprint when the index is f;

[0047] S34: According to S31-S33, the behavior deviation degree py is calculated by applying the behavior deviation degree recognition model to output the behavior deviation degree applied to different monitoring nodes. The calculation strategy of the behavior deviation degree py is:

[0048] ;

[0049] Among them, exp is the exponential operator.

[0050] Specifically, in S4, the calculation strategy of the behavior evolution coefficient is as follows:

[0051] ;

[0052] in, is the behavior evolution coefficient of the g-th behavior recognition period;

[0053] represents the behavior deviation degree of the g-th behavior recognition period;

[0054] W is the total number of behavior recognition periods after the user starts using the application.

[0055] Specifically, S5 includes the following specific steps:

[0056] S51: extracting the behavior evolution coefficient of the application, and setting the network environment bandwidth baseline difference and the application usage time baseline difference;

[0057] S52: intercepting the first five behavior recognition periods before the current behavior recognition period, and screening out clients whose network environment bandwidth difference with the behavior of the current application in the current behavior recognition period and the first five behavior recognition periods is lower than the network environment bandwidth baseline difference, and whose application usage time difference is also lower than the application usage time baseline difference;

[0058] S53: extracting the clients obtained by screening and the clients that have completed the application behavior identification to form a suspected application behavior set;

[0059] S54: At the end of each behavior identification period, the number of clients in the application behavior suspicion set is updated in real time, and a network monitoring strategy adapted to the application is customized and allocated for the application according to the number of clients.

[0060] Specifically, in S54, the network monitoring strategy includes: at the end of each behavior recognition period, dynamically shortening the interval time of the behavior recognition processing of the application according to the number of clients, and when the interval time of the behavior recognition processing of the application reaches the minimum interval threshold, reporting the historical recognition log of the application behavior and issuing a warning to the user; wherein the dynamic shortening includes: , They are all different quantity values ​​for the client; The number of clients is time interval, and D is the unit decreasing time.

[0061] In addition, the application behavior identification system based on operator traffic fingerprint analysis of the present invention includes the following modules:

[0062] TCP reassembly module, traffic data extraction module, behavior deviation identification module, behavior evolution trend assessment module and network monitoring strategy allocation module;

[0063] The TCP reassembly module is used to obtain multiple TCP data frames of application traffic, and reassemble the captured multiple TCP data frames into a complete TCP communication flow;

[0064] The traffic data extraction module is used to obtain the behavior information of the application traffic transmitted through the operator network in real time, and extract TLS fingerprint information from the application traffic;

[0065] The behavior deviation identification module is used to build an application behavior deviation identification model, import the behavior information and TLS fingerprint information into the application behavior deviation identification model, and output the behavior deviation degree of the application in different behavior identification periods;

[0066] The behavior evolution trend assessment module analyzes the behavior evolution trend of the application in the network according to the output result of the application behavior deviation identification model to obtain the behavior evolution coefficient;

[0067] The network monitoring strategy allocation module customizes and allocates a network monitoring strategy adapted to the application according to the behavior evolution coefficient of the application.

[0068] A storage medium stores instructions. When a computer reads the instructions, the computer executes the application behavior identification method based on operator traffic fingerprint analysis.

[0069] An electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the above-mentioned application behavior identification method based on operator traffic fingerprint analysis is implemented.

[0070] Compared with the prior art, the technical effects of the present invention are as follows:

[0071] 1. The present invention can overcome the limitations of the data collection capabilities of terminal devices and achieve efficient and real-time monitoring of application behavior by acquiring multiple TCP data frames of application traffic in real time on the operator network side and recombining them into a complete TCP communication flow.

[0072] 2. The present invention extracts TLS fingerprint information from application traffic and combines it with a behavioral information recognition model to deeply analyze TLS encrypted traffic, thereby improving the accuracy and efficiency of application behavior recognition and addressing the shortcomings of traditional data packet analysis methods in processing complex application traffic.

[0073] 3. The present invention constructs an application behavior deviation identification model, analyzes the behavior deviation of the application in different behavior identification periods in real time, and dynamically adjusts the monitoring strategy according to the behavior evolution trend. The present invention effectively adapts to the dynamic changes of application behavior, overcomes the shortcomings of traditional static monitoring strategies, and improves the monitoring effect.

[0074] 4. According to the behavior evolution coefficient of the application, the technical solution can customize and allocate an adaptive network monitoring strategy for the application to achieve optimal configuration of monitoring resources. By dynamically shortening the interval time for behavior recognition processing of the application and issuing a warning when the minimum interval threshold is reached, for large-scale, high-concurrency network environments, while ensuring the monitoring effect, the flexibility and response speed of monitoring are improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0075] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor. Among them:

[0076] Figure 1 A schematic diagram of a flow chart of an application behavior identification method based on operator traffic fingerprint analysis of the present invention;

[0077] Figure 2 It is a structural schematic diagram of an application behavior identification system based on operator traffic fingerprint analysis of the present invention;

[0078] Figure 3 A schematic diagram of an application request behavior process of the present invention. DETAILED DESCRIPTION

[0079] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the accompanying drawings.

[0080] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0081] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0082] Embodiment 1:

[0083] like Figure 1 , 3 As shown, an application behavior identification method based on operator traffic fingerprint analysis in an embodiment of the present invention is as follows: Figure 1 As shown, the specific steps are as follows:

[0084] S1: obtain multiple TCP data frames of application traffic, and reassemble the captured multiple TCP data frames into a complete TCP communication flow;

[0085] S1 includes the following specific steps:

[0086] S11: Receive TCP data frames and record their timestamps and data values;

[0087] S12: sorting the TCP data frames according to the timestamps, and performing missing frame determination processing on the sorted TCP data frames;

[0088] In S12, the missing frame determination process specifically includes:

[0089] S121: Calculate the timestamp intervals of all adjacent data frames to form a timestamp interval set A. , where a is the subscript, indicating the ath timestamp interval, and I is the subscript, indicating the total number of TCP data frames that have been obtained;

[0090] S122: Calculate the average timestamp interval and the standard deviation of the timestamp interval, wherein the average timestamp interval The calculation strategy is: ; The standard deviation of the timestamp interval The calculation strategy is: ;

[0091] S123: Preset time stamp interval tolerance interval , screening the timestamp intervals in the timestamp interval set A that are outside the interval tolerance interval, marking the two TCP data frames corresponding to the screened timestamp intervals as missing frames, traversing the timestamp interval set A, and obtaining a first missing frame set;

[0092] S124: Extract the first missing frame set, and find the current time position of each missing frame in the first missing frame set , calculate the number of forward data frames for each missing frame and the backward dataframe data , where the number of forward data frames is The calculation strategy is: , the backward data frame data The calculation strategy is: ;

[0093] S125: Perform adaptive complement condition screening of missing frames. or or When the missing frame does not meet the adaptive completion conditions, mark the missing frame as not meeting the adaptive completion conditions, make all missing frames that do not meet the adaptive completion conditions into retransmission data packets, and request the sender to resend the data frames in the data packet through the retransmission mechanism of the TCP protocol; otherwise, execute step S13.

[0094] S13: performing interpolation processing on the missing data frames according to the missing frame determination processing result;

[0095] In S13, the interpolation process specifically includes:

[0096] ;

[0097] Where i and k are subscripts, indicating the index of the obtained TCP data frame;

[0098] j is a subscript, indicating the index of the data frame that needs to be interpolated;

[0099] They are the data values ​​of the obtained TCP data frames and the missing frames that need to be interpolated respectively;

[0100] is the time position of the missing frame that needs to be interpolated; The obtained TCP data frames are indexed as i and k respectively;

[0101] is the time decay factor, , is the attenuation amplitude constant, , c is the decay interval proportional constant.

[0102] S14: Input the interpolated data stream into the Kalman filter to obtain a smoothed data stream, and output a reassembled and smoothed TCP data stream.

[0103] S2: Obtains behavior information of application traffic transmitted through the operator network in real time, and extracts TLS fingerprint information from the application traffic;

[0104] S3: construct an application behavior deviation identification model, import the behavior information and TLS fingerprint information into the application behavior deviation identification model, and output the behavior deviation degree of the application in different behavior identification periods;

[0105] like Figure 3 As shown, in the embodiment, the request behavior process includes: a process from the client to the network device, a process from the network device to the server, a process from the server to the network device, and a process from the network device to the client;

[0106] S3 includes the following specific steps:

[0107] S31: constructing an application behavior deviation identification model, wherein the application behavior deviation degree identification model includes: a behavior information identification sub-model and a TLS fingerprint information identification sub-model;

[0108] S32: importing the behavior information into the behavior information recognition sub-model, outputting the behavior deviation value, the behavior deviation value The calculation strategy is:

[0109] ;

[0110] in, They are the contribution ratio coefficients of abnormal request frequency and abnormal request duration respectively;

[0111] is the request frequency anomaly coefficient of the u-th request behavior of the application;

[0112] , u is the subscript, indicating the u-th request behavior, represents the time interval between the u-th request behavior and the u-1-th request behavior, represents the mean time interval of all request behaviors before the u-th request behavior occurs, are the maximum and minimum time intervals among all request behaviors before the u-th request behavior occurs, respectively;

[0113] is the request duration abnormality coefficient of the u-th request behavior of the application,

[0114] , Indicates the duration of the u-th request behavior, represents the average duration of all request behaviors before the u-th request behavior occurs; Indicates the maximum and minimum durations of all request behaviors before the u-th request behavior occurs; The byte length of the data group representing the u-th request behavior; Indicates the closest byte length of the data group of all request behaviors before the uth request behavior occurs The length of the data group in bytes.

[0115] S3 also includes the following specific steps:

[0116] S33: Importing the TLS fingerprint information into the TLS fingerprint information identification sub-model, and outputting the TLS fingerprint deviation value, wherein the TLS fingerprint deviation value The calculation strategy is:

[0117] ;

[0118] in, They are the contribution ratio coefficients of the cipher suite type and the extension field length respectively;

[0119] f is a subscript, indicating the index of TLS fingerprint; U is the total number of TLS fingerprints of U request behaviors in the complete TCP communication flow;

[0120] The number of cipher suites representing the TLS fingerprint of the u-th request behavior; Indicates the number of cipher suites of the TLS fingerprint when index is f;

[0121] The length of the extended field of the TLS fingerprint representing the u-th request behavior;

[0122] Indicates the length of the extended field of the TLS fingerprint when the index is f;

[0123] S34: According to S31-S33, the behavior deviation degree py is calculated by applying the behavior deviation degree recognition model to output the behavior deviation degree applied to different monitoring nodes. The calculation strategy of the behavior deviation degree py is:

[0124] ;

[0125] Among them, exp is the exponential operator.

[0126] S4: Analyze the behavior evolution trend of the application in the network according to the output result of the application behavior deviation identification model, and obtain the behavior evolution coefficient;

[0127] In S4, the calculation strategy of the behavior evolution coefficient is specifically as follows:

[0128] ;

[0129] in, is the behavior evolution coefficient of the g-th behavior recognition period;

[0130] represents the behavior deviation degree of the g-th behavior recognition period;

[0131] W is the total number of behavior recognition periods after the user starts using the application.

[0132] S5: Customize and allocate a network monitoring strategy adapted to the application based on the behavior evolution coefficient of the application.

[0133] S5 includes the following specific steps:

[0134] S51: extracting the behavior evolution coefficient of the application, and setting the network environment bandwidth baseline difference and the application usage time baseline difference;

[0135] Exemplarily, in this embodiment, at the beginning of each behavior recognition period, the network environment bandwidth baseline difference and the application usage time baseline difference are updated by those skilled in the art according to actual needs;

[0136] S52: intercepting the first five behavior recognition periods before the current behavior recognition period, and screening out clients whose network environment bandwidth difference with the behavior of the current application in the current behavior recognition period and the first five behavior recognition periods is lower than the network environment bandwidth baseline difference, and whose application usage time difference is also lower than the application usage time baseline difference;

[0137] S53: extracting the clients obtained by screening and the clients that have completed the application behavior identification to form a suspected application behavior set;

[0138] S54: At the end of each behavior identification period, the number of clients in the application behavior suspicion set is updated in real time, and a network monitoring strategy adapted to the application is customized and allocated for the application according to the number of clients.

[0139] In S54, the network monitoring strategy includes: at the end of each behavior recognition period, dynamically shortening the interval time of the behavior recognition processing of the application according to the number of clients, and when the interval time of the behavior recognition processing of the application reaches the minimum interval threshold, reporting the historical recognition log of the application behavior and issuing a warning to the user; wherein the dynamic shortening includes: , They are all different quantity values ​​for the client; The number of clients is time interval, and D is the unit decreasing time.

[0140] Embodiment 2:

[0141] like Figure 2 As shown, an application behavior identification system based on operator traffic fingerprint analysis according to an embodiment of the present invention is as follows: Figure 2 As shown, it includes the following modules:

[0142] TCP reassembly module, traffic data extraction module, behavior deviation identification module, behavior evolution trend assessment module and network monitoring strategy allocation module;

[0143] The TCP reassembly module is used to obtain multiple TCP data frames of application traffic, and reassemble the captured multiple TCP data frames into a complete TCP communication flow;

[0144] The traffic data extraction module is used to obtain the behavior information of the application traffic transmitted through the operator network in real time, and extract TLS fingerprint information from the application traffic;

[0145] The behavior deviation identification module is used to build an application behavior deviation identification model, import the behavior information and TLS fingerprint information into the application behavior deviation identification model, and output the behavior deviation degree of the application in different behavior identification periods;

[0146] The behavior evolution trend assessment module analyzes the behavior evolution trend of the application in the network according to the output result of the application behavior deviation identification model to obtain the behavior evolution coefficient;

[0147] The network monitoring strategy allocation module customizes and allocates a network monitoring strategy adapted to the application according to the behavior evolution coefficient of the application.

[0148] Embodiment three:

[0149] This embodiment provides an electronic device, including: a processor and a memory, wherein the memory stores a computer program that can be called by the processor;

[0150] The processor executes the above-mentioned application behavior identification method based on operator traffic fingerprint analysis by calling the computer program stored in the memory.

[0151] The electronic device may have relatively large differences due to different configurations or performances, and may include one or more processors (Central Processing Units, CPU) and one or more memories, wherein the memory stores at least one computer program, and the computer program is loaded and executed by the processor to implement an application behavior identification method based on operator traffic fingerprint analysis provided by the above method embodiment. The electronic device may also include other components for realizing device functions, for example, the electronic device may also have components such as wired or wireless network interfaces and input and output interfaces for data input and output. This embodiment will not be described in detail here.

[0152] Embodiment 4:

[0153] This embodiment provides a computer-readable storage medium having a rewritable computer program stored thereon;

[0154] When the computer program runs on a computer device, the computer device executes the above-mentioned application behavior identification method based on operator traffic fingerprint analysis.

[0155] For example, the computer readable storage medium can be a read-only memory (ROM), a random access memory (RAM), a compact disc (CD-ROM), a magnetic tape, a floppy disk, an optical data storage device, etc.

[0156] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0157] It should be understood that determining B based on A does not mean determining B only based on A. B can also be determined based on A and / or other information.

[0158] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented by software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When a computer instruction or computer program is loaded or executed on a computer, a process or function according to an embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. Computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, computer instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center through a wired network or / and a wireless network. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0159] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed in the present invention can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0160] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0161] In the several embodiments provided by the present invention, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of units is only one, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0162] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0163] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0164] In the description of this specification, the description with reference to the terms "one embodiment", "example", "specific example", etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0165] In summary, compared with the prior art, the technical effects of the present invention are as follows:

[0166] 1. The present invention can overcome the limitations of the data collection capabilities of terminal devices and achieve efficient and real-time monitoring of application behavior by acquiring multiple TCP data frames of application traffic in real time on the operator network side and recombining them into a complete TCP communication flow.

[0167] 2. The present invention extracts TLS fingerprint information from application traffic and combines it with a behavioral information recognition model to deeply analyze TLS encrypted traffic, thereby improving the accuracy and efficiency of application behavior recognition and addressing the shortcomings of traditional data packet analysis methods in processing complex application traffic.

[0168] 3. The present invention constructs an application behavior deviation identification model, analyzes the behavior deviation of the application in different behavior identification periods in real time, and dynamically adjusts the monitoring strategy according to the behavior evolution trend. The present invention effectively adapts to the dynamic changes of application behavior, overcomes the shortcomings of traditional static monitoring strategies, and improves the monitoring effect.

[0169] 4. According to the behavior evolution coefficient of the application, the technical solution can customize and allocate an adaptive network monitoring strategy for the application to achieve optimal configuration of monitoring resources. By dynamically shortening the interval time for behavior recognition processing of the application and issuing a warning when the minimum interval threshold is reached, for large-scale, high-concurrency network environments, while ensuring the monitoring effect, the flexibility and response speed of monitoring are improved.

[0170] The above shows and describes the basic principles and main features of the present invention and the advantages of the present invention. It should be understood by those skilled in the art that the present invention is not limited to the above embodiments. The above embodiments and descriptions are only for explaining the principles of the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, which fall within the scope of the present invention to be protected. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims

1. An application behavior identification method based on operator traffic fingerprint analysis, characterized in that: The method comprises the following specific steps: S1: obtain multiple TCP data frames of application traffic, and reassemble the captured multiple TCP data frames into a complete TCP communication flow; S2: Obtains behavior information of application traffic transmitted through the operator network in real time, and extracts TLS fingerprint information from the application traffic; S3: construct an application behavior deviation identification model, import the behavior information and TLS fingerprint information into the application behavior deviation identification model, and output the behavior deviation degree of the application in different behavior identification periods; S31: constructing an application behavior deviation identification model, wherein the application behavior deviation degree identification model includes: a behavior information identification sub-model and a TLS fingerprint information identification sub-model; S32: importing the behavior information into the behavior information recognition sub-model, outputting the behavior deviation value, the behavior deviation value The calculation strategy is: ； in, They are the contribution ratio coefficients of abnormal request frequency and abnormal request duration respectively; is the request frequency anomaly coefficient of the u-th request behavior of the application; , u is the subscript, indicating the u-th request behavior, represents the time interval between the u-th request behavior and the u-1-th request behavior, represents the mean time interval of all request behaviors before the u-th request behavior occurs, are the maximum and minimum time intervals among all request behaviors before the u-th request behavior occurs, respectively; is the request duration abnormality coefficient of the u-th request behavior of the application, , Indicates the duration of the u-th request behavior, represents the average duration of all request behaviors before the u-th request behavior occurs; Indicates the maximum and minimum durations of all request behaviors before the u-th request behavior occurs; The length in bytes of the data group representing the u-th request behavior; Indicates the closest byte length of the data group of all request behaviors before the uth request behavior occurs The length of the data group in bytes; S33: Importing the TLS fingerprint information into the TLS fingerprint information identification sub-model, and outputting the TLS fingerprint deviation value, wherein the TLS fingerprint deviation value The calculation strategy is: ； in, They are the contribution ratio coefficients of the cipher suite type and the extension field length respectively; f is a subscript, indicating the index of TLS fingerprint; U is the total number of TLS fingerprints of U request behaviors in the complete TCP communication flow; The number of cipher suites representing the TLS fingerprint of the u-th request behavior; Indicates the number of cipher suites of the TLS fingerprint when index is f; The length of the extended field of the TLS fingerprint representing the u-th request behavior; Indicates the length of the extended field of the TLS fingerprint when the index is f; S34: According to S31-S33, the behavior deviation degree py is calculated by applying the behavior deviation degree recognition model to output the behavior deviation degree applied to different monitoring nodes. The calculation strategy of the behavior deviation degree py is: ； Among them, exp is the exponential operator; S4: Analyze the behavior evolution trend of the application in the network according to the output result of the application behavior deviation identification model, and obtain the behavior evolution coefficient; In S4, the calculation strategy of the behavior evolution coefficient is specifically as follows: ； in, is the behavior evolution coefficient of the g-th behavior recognition period; represents the behavior deviation degree of the g-th behavior recognition period; W is the total number of behavior recognition periods after the user starts using the application; S5: Customize and allocate a network monitoring strategy adapted to the application based on the behavior evolution coefficient of the application; S51: extracting the behavior evolution coefficient of the application, and setting the network environment bandwidth baseline difference and the application usage time baseline difference; S52: intercepting the first five behavior recognition periods before the current behavior recognition period, and screening out clients whose network environment bandwidth difference with the behavior of the current application in the current behavior recognition period and the first five behavior recognition periods is lower than the network environment bandwidth baseline difference, and whose application usage time difference is also lower than the application usage time baseline difference; S53: extracting the clients obtained by screening and the clients that have completed the application behavior identification to form a suspected application behavior set; S54: at the end of each behavior recognition period, the number of clients in the application behavior suspicion set is updated in real time, and a network monitoring strategy adapted to the application is customized and allocated according to the number of clients; In S54, the network monitoring strategy includes: at the end of each behavior recognition period, dynamically shortening the interval time of the behavior recognition processing of the application according to the number of clients, and when the interval time of the behavior recognition processing of the application reaches the minimum interval threshold, reporting the historical recognition log of the application behavior and issuing a warning to the user; wherein the dynamic shortening includes: , They are all different quantity values ​​for the client; The number of clients is time interval, and D is the unit decreasing time.

2. According to claim 1, the method for identifying application behavior based on operator traffic fingerprint analysis is characterized in that: S1 includes the following specific steps: S11: Receive TCP data frames and record their timestamps and data values; S12: sorting the TCP data frames according to the timestamps, and performing missing frame determination processing on the sorted TCP data frames; S13: performing interpolation processing on the missing data frames according to the missing frame determination processing result; S14: Input the interpolated data stream into the Kalman filter to obtain a smoothed data stream, and output a reassembled and smoothed TCP data stream.

3. The method for identifying application behavior based on operator traffic fingerprint analysis according to claim 2 is characterized in that: In S12, the missing frame determination process specifically includes: S121: Calculate the timestamp intervals of all adjacent data frames to form a timestamp interval set A. , where a is the subscript, indicating the ath timestamp interval, and I is the subscript, indicating the total number of TCP data frames that have been obtained; S122: Calculate the average timestamp interval and the standard deviation of the timestamp interval, wherein the average timestamp interval The calculation strategy is: ; The standard deviation of the timestamp interval The calculation strategy is: ; S123: Preset time stamp interval tolerance interval , screening the timestamp intervals in the timestamp interval set A that are outside the interval tolerance interval, marking the two TCP data frames corresponding to the screened timestamp intervals as missing frames, traversing the timestamp interval set A, and obtaining a first missing frame set; S124: Extract the first missing frame set, and find the current time position of each missing frame in the first missing frame set , calculate the number of forward data frames for each missing frame and the backward dataframe data , where the number of forward data frames is The calculation strategy is: , the backward data frame data The calculation strategy is: ; S125: Perform adaptive complement condition screening of missing frames. or or When the missing frame does not meet the adaptive completion conditions, mark the missing frame as not meeting the adaptive completion conditions, make all missing frames that do not meet the adaptive completion conditions into retransmission data packets, and request the sender to resend the data frames in the data packet through the retransmission mechanism of the TCP protocol; otherwise, execute step S13.

4. The method for identifying application behavior based on operator traffic fingerprint analysis according to claim 3 is characterized in that: In S13, the interpolation process specifically includes: ； Where i and k are subscripts, indicating the index of the obtained TCP data frame; j is a subscript, indicating the index of the data frame that needs to be interpolated; They are the data values ​​of the obtained TCP data frames and the missing frames that need to be interpolated respectively; is the time position of the missing frame that needs to be interpolated; The obtained TCP data frames are indexed as i and k respectively; is the time decay factor, , is the attenuation amplitude constant, , c is the decay interval proportional constant.

5. An application behavior identification system based on operator traffic fingerprint analysis, used to implement an application behavior identification method based on operator traffic fingerprint analysis as described in any one of claims 1 to 4, characterized in that: The system includes the following modules: TCP reassembly module, traffic data extraction module, behavior deviation identification module, behavior evolution trend assessment module and network monitoring strategy allocation module; The TCP reassembly module is used to obtain multiple TCP data frames of application traffic, and reassemble the captured multiple TCP data frames into a complete TCP communication flow; The traffic data extraction module is used to obtain the behavior information of the application traffic transmitted through the operator network in real time, and extract TLS fingerprint information from the application traffic; The behavior deviation identification module is used to build an application behavior deviation identification model, import the behavior information and TLS fingerprint information into the application behavior deviation identification model, and output the behavior deviation degree of the application in different behavior identification periods; The behavior evolution trend assessment module analyzes the behavior evolution trend of the application in the network according to the output result of the application behavior deviation identification model to obtain the behavior evolution coefficient; The network monitoring strategy allocation module customizes and allocates a network monitoring strategy adapted to the application according to the behavior evolution coefficient of the application.

Images