Protocol identification method and device, equipment and storage medium

Abstract

The invention discloses a protocol identification method and device, equipment and a storage medium. The method comprises the following steps: dividing to-be-identified traffic into corresponding data streams; dividing the data stream according to different preset bit lengths to obtain target data; determining a frequency number group according to the target data; inputting the frequency number group into a preset protocol identification model for protocol identification to obtain a protocol identification result; and judging whether the to-be-identified traffic contains an encryption protocol or not according to the protocol identification result. According to the invention, the frequency number group corresponding to the to-be-identified flow is determined; and performing protocol identification on the frequency number group according to a preset protocol identification model, and judging whether the to-be-identified traffic contains an encryption protocol or not. Compared with an existing mode of identifying whether the to-be-identified flow adopts the encryption protocol only through a mode of matching with a public encryption protocol, the mode provided by the invention can accurately identify whether the to-be-identified flow contains the encryption protocol.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a protocol identification method, device, equipment and storage medium. Background Art

[0002] Cryptography plays an important role in the core and key applications of the Internet, and data related to security protocols accounts for an increasing proportion of network traffic. Analyzing the protocol user interaction behavior information in the network message payload data is the core of security protocol traffic analysis, which helps to monitor and manage various network applications and effectively reduce the security risks of the system. During the operation of security protocols, various cryptographic technologies are often used to encrypt and protect key information, such as data encryption, digital signatures, public key certificates, checksum verification, etc. As a result, there is very little plaintext information available, and it is difficult to meet the needs of security applications with limited plaintext information alone. In addition, attackers may also attack by replaying or forwarding ciphertext when users cannot decrypt the ciphertext. Therefore, how to identify whether the data stream contains unknown protocols has become a technical problem that needs to be solved urgently.

[0003] The above contents are only used to assist in understanding the technical solution of the present invention and do not constitute an admission that the above contents are prior art. Summary of the invention

[0004] The main purpose of the present invention is to provide a protocol identification method, device, equipment and storage medium, aiming to solve the technical problem that the prior art cannot accurately identify whether a data stream contains an unknown protocol.

[0005] To achieve the above object, the present invention provides a protocol identification method, which comprises the following steps:

[0006] Divide the traffic to be identified into corresponding data flows;

[0007] Dividing the data stream according to different preset bit lengths to obtain target data;

[0008] Determine a frequency array according to the target data;

[0009] Inputting the frequency array into a preset protocol identification model to perform protocol identification and obtain a protocol identification result;

[0010] Determine whether the traffic to be identified contains an encryption protocol according to the protocol identification result.

[0011] Optionally, the step of determining a frequency array according to the target data includes:

[0012] Determine the occurrence frequency of each type of the target data, and sort the occurrence frequencies to obtain a sorting result;

[0013] Selecting a preset number of frequency times from the sorting results;

[0014] A frequency array is formed according to the frequency numbers.

[0015] Optionally, the step of selecting a preset number of frequency times from the sorting results includes:

[0016] Determining the number of elements in the sorted result;

[0017] When the number of elements is greater than or equal to a preset number, selecting a preset number of frequency times from the sorting result;

[0018] Or, when the number of elements is less than the preset number, filling the sorting result according to a preset filling strategy;

[0019] Select a preset number of frequency times from the filled sorted results.

[0020] Optionally, before the step of dividing the traffic to be identified into corresponding data flows, the step includes:

[0021] Determining five-tuple information of the traffic to be identified;

[0022] Classify the traffic to be identified according to the five-tuple information to obtain a classification result;

[0023] According to the classification result, the traffic to be identified of the same category is taken as the corresponding data flow.

[0024] Optionally, before the step of dividing the traffic to be identified into corresponding data flows, the method further includes:

[0025] When receiving network traffic, the network traffic is parsed using a preset public protocol to obtain a parsing result;

[0026] Determine whether the network traffic is traffic to be identified according to the analysis result;

[0027] If so, the step of dividing the traffic to be identified into corresponding data flows is performed.

[0028] Optionally, when receiving the network traffic, the step of parsing the network traffic by using a preset public protocol to obtain the parsing result includes:

[0029] After receiving network traffic, traverse the preset public protocol;

[0030] The network traffic is parsed through the currently traversed target public protocol to obtain a parsing result.

[0031] Optionally, the step of judging whether the network traffic is traffic to be identified according to the analysis result includes:

[0032] When the analysis result is that the analysis is successful, determining that the network traffic is not traffic to be identified;

[0033] Or, when the analysis result is analysis failure, the network traffic is determined to be traffic to be identified.

[0034] Optionally, before the step of inputting the frequency array into a preset protocol identification model for protocol identification and obtaining a protocol identification result, the step further includes:

[0035] Obtaining sample traffic, and dividing the sample traffic into corresponding sample data flows;

[0036] Dividing the sample data stream according to different preset bit lengths to obtain target sample data;

[0037] Determine a sample frequency array according to the target sample data;

[0038] The initial protocol recognition model is trained according to the sample frequency array and the protocol information corresponding to the sample frequency array to obtain a preset protocol recognition model.

[0039] Optionally, before the step of training the initial protocol recognition model according to the sample frequency array and the protocol information corresponding to the sample frequency array to obtain a preset protocol recognition model, the step further includes:

[0040] Obtaining sample traffic and determining source information of the sample traffic;

[0041] Determine whether the sample traffic is encrypted traffic based on the source information, and generate protocol information of the sample traffic based on the determination result.

[0042] Optionally, the step of obtaining sample traffic and dividing the sample traffic into corresponding sample data flows includes:

[0043] Obtaining sample traffic and determining quintuple information of the sample traffic;

[0044] Classify the sample traffic according to the five-tuple information to obtain a classification result;

[0045] According to the classification result, sample traffic of the same category is used as sample data flow.

[0046] In addition, to achieve the above object, the present invention also provides a protocol identification device, the device comprising:

[0047] A division module, used for dividing the traffic to be identified into corresponding data flows;

[0048] The division module is used to divide the data stream according to different preset bit lengths to obtain target data;

[0049] A determination module, used for determining a frequency array according to the target data;

[0050] A protocol identification module, used for inputting the frequency array into a preset protocol identification model for protocol identification to obtain a protocol identification result;

[0051] The judgment module is used to judge whether the traffic to be identified contains an encryption protocol according to the protocol identification result.

[0052] In addition, to achieve the above-mentioned purpose, the present invention also proposes a protocol identification device, which includes: a memory, a processor, and a protocol identification program stored in the memory and executable on the processor, and the protocol identification program is configured to implement the steps of the protocol identification method described above.

[0053] In addition, to achieve the above-mentioned purpose, the present invention further proposes a storage medium, on which a protocol identification program is stored, and when the protocol identification program is executed by a processor, the steps of the protocol identification method described above are implemented.

[0054] The present invention divides the traffic to be identified into corresponding data streams; divides the data streams according to different preset bit lengths to obtain target data; determines a frequency array based on the target data; inputs the frequency array into a preset protocol identification model for protocol identification to obtain a protocol identification result; and determines whether the traffic to be identified contains an encryption protocol based on the protocol identification result. Since the present invention divides the traffic to be identified into corresponding data streams; divides the data streams according to different preset bit lengths to obtain a frequency array corresponding to the traffic to be identified; performs protocol identification on the frequency array based on a preset protocol identification model to determine whether the traffic to be identified contains an encryption protocol. Compared to the existing method of only being able to identify whether the traffic to be identified uses an encryption protocol by matching it with a public encryption protocol, the above method of the present invention can accurately identify whether the traffic to be identified contains an encryption protocol. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 It is a structural diagram of a protocol identification device in a hardware operating environment involved in an embodiment of the present invention;

[0056] Figure 2 A schematic diagram of a flow chart of a first embodiment of a protocol identification method of the present invention;

[0057] Figure 3 A schematic diagram of a flow chart of a second embodiment of a protocol identification method of the present invention;

[0058] Figure 4 A schematic diagram of a flow chart of a third embodiment of a protocol identification method of the present invention;

[0059] Figure 5 This is a structural block diagram of the first embodiment of the protocol identification device of the present invention.

[0060] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0061] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0062] Reference Figure 1 , Figure 1 The present invention is a schematic diagram of the structure of a protocol identification device in a hardware operating environment according to an embodiment of the present invention.

[0063] like Figure 1 As shown, the protocol identification device may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a wireless fidelity (Wireless-Fidelity, WI-FI) interface). The memory 1005 may be a high-speed random access memory (Random Access Memory, RAM), or a stable non-volatile memory (Non-Volatile Memory, NVM), such as a disk storage. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0064] Those skilled in the art will understand that Figure 1 The structure shown in the figure does not constitute a limitation on the protocol identification device, and may include more or less components than those shown in the figure, or combine certain components, or arrange the components differently.

[0065] like Figure 1 As shown, the memory 1005 as a storage medium may include an operating system, a network communication module, a user interface module, and a protocol identification program.

[0066] exist Figure 1 In the protocol identification device shown, the network interface 1004 is mainly used for data communication with the network server; the user interface 1003 is mainly used for data interaction with the user; the processor 1001 and the memory 1005 in the protocol identification device of the present invention can be set in the protocol identification device, and the protocol identification device calls the protocol identification program stored in the memory 1005 through the processor 1001, and executes the protocol identification method provided by the embodiment of the present invention.

[0067] Based on the above-mentioned protocol identification device, an embodiment of the present invention provides a protocol identification method, referring to Figure 2 , Figure 2 This is a flow chart of the first embodiment of the protocol identification method of the present invention.

[0068] In this embodiment, the protocol identification method includes the following steps:

[0069] Step S10: Divide the traffic to be identified into corresponding data flows.

[0070] It should be noted that the execution subject of this embodiment can be a computing service device with data processing, network communication and program running functions, such as a mobile phone, a tablet computer, a personal computer, etc., or an electronic device or a protocol identification device that can realize the above functions. The following takes the protocol identification device as an example to illustrate this embodiment and the following embodiments.

[0071] It should be noted that the traffic to be identified may be a data flow that needs to be identified by protocol. The division of the traffic to be identified into corresponding data flows may be to identify the traffic originating from the same IP address and port as the same type of data flow. This improves the efficiency of protocol identification. Alternatively, the traffic to be identified originating from the same IP address and with the same target IP address may be identified as the same type of data flow.

[0072] Further, in order to improve the efficiency of protocol identification of data flows and avoid repeated identification of to-be-identified traffic with the same quintuple information, the step S10 may include:

[0073] Determining five-tuple information of the traffic to be identified;

[0074] Classify the traffic to be identified according to the five-tuple information to obtain a classification result;

[0075] According to the classification result, the traffic to be identified of the same category is taken as the corresponding data flow.

[0076] It should be noted that the five-tuple information may be the source IP, destination IP, source port, destination port, and protocol number of the traffic to be identified. The classification of the traffic to be identified according to the five-tuple information may be to classify the traffic to be identified with the same source IP, destination IP, source port, destination port, and protocol number in the five-tuple information as the same type of data flow. Repeated identification of the traffic to be identified with the same five-tuple information is avoided.

[0077] Step S20: Divide the data stream according to different preset bit lengths to obtain target data.

[0078] It should be noted that the dividing of the data stream according to different preset bit lengths may be dividing the data stream according to lengths of 4 bits, 8 bits, 16 bits, or 24 bits to obtain target data divided according to different bit lengths. For example, if the data stream is [0x00, 0x00, 0x00, 0x01, 0x01, 0x02], the data stream is divided according to 4 bits, and the target data obtained may be [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x2], the data stream is divided according to 8 bits, and the target data obtained may be [0x00, 0x00, 0x00, 0x01, 0x01, 0x02], the data stream is divided according to 16 bits, and the target data obtained may be [0x0000, 0x0001, 0x0102], the data stream is divided according to 24 bits, and the target data obtained may be [0x000000, 0x010102].

[0079] Step S30: determining a frequency array according to the target data.

[0080] It should be noted that the frequency array determined according to the target data may be determined by determining the frequencies of occurrence of various types of data in the target data, and forming a frequency array according to the frequencies of occurrence of various types of data. For example, the data stream is divided according to 4 bits, and the target data is [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x2], then in the target data corresponding to the 4 bits, the frequency of occurrence of 0x0 is 9, the frequency of occurrence of 0x1 is 2, and the frequency of occurrence of 0x2 is 1. Then the frequency of occurrence of the target data corresponding to the 4 bits may be {0x0:9, 0x1:2, 0x2:1}, arranged in order from large to small as: [9, 2, 1]. Similarly, assume that the frequency of occurrence of the target data corresponding to 8 bits is {0x00:3, 0x01:2, 0x02:1}, arranged in descending order as [3, 2, 1], and the frequency of occurrence of the target data corresponding to 16 bits is {0x0000:1, 0x0001:1, 0x0102:1}, arranged in descending order as [1, 1, 1]. Then the frequency array can be an array obtained by combining the frequencies corresponding to the target data corresponding to the above bits, or by merging [9, 2, 1], [3, 2, 1], and [1, 1, 1] into one array, and the resulting frequency array can be [9, 2, 1, 3, 2, 1, 1,

[0081] Step S40: inputting the frequency array into a preset protocol identification model to perform protocol identification and obtain a protocol identification result.

[0082] It should be noted that the preset protocol identification model can be a model pre-trained with sample data that can identify whether the data stream corresponding to the frequency array contains an encryption protocol based on the frequency array. The protocol identification result can be the result of whether the data stream corresponding to the frequency array contains an encryption protocol.

[0083] Step S50: judging whether the traffic to be identified contains an encryption protocol according to the protocol identification result.

[0084] It should be noted that the encryption protocol may be a private protocol. When the protocol identification result is that the encryption protocol is included, it is determined that the data stream corresponding to the frequency array includes the private encryption protocol.

[0085] Furthermore, in order to determine the encryption protocol type in the traffic to be identified and improve the efficiency of protocol identification, before step S10, it also includes: when receiving the network traffic, parsing the network traffic through a preset public protocol to obtain a parsing result;

[0086] Determine whether the network traffic is traffic to be identified according to the analysis result;

[0087] If so, the step of dividing the traffic to be identified into corresponding data flows is performed.

[0088] It should be noted that the network traffic may be traffic that may contain attack traffic and needs to be identified by protocol. The preset public protocol may be a public protocol that can be currently identified according to the protocol format of the traffic to be identified. The parsing of the network traffic by the preset public protocol may be to determine whether the network traffic is encrypted using the preset public protocol. The judging whether the network traffic is the traffic to be identified based on the parsing result may be to judge that the network traffic is not the traffic to be identified when the parsing result is a successful parsing; or to judge that the network traffic is the traffic to be identified when the parsing result is a failed parsing.

[0089] Furthermore, the step of parsing the network traffic through a preset public protocol to obtain a parsing result when the network traffic is received includes: after receiving the network traffic, traversing the preset public protocol; parsing the network traffic through the currently traversed target public protocol to obtain a parsing result.

[0090] It should be noted that the preset public protocol may include at least one currently known public protocol. By parsing the network traffic using the currently traversed target public protocol, it can be determined in turn whether the network traffic uses the encryption protocol in the preset public protocol. If so, the step of dividing the traffic to be identified into corresponding data flows is no longer performed.

[0091] This embodiment divides the traffic to be identified into corresponding data streams; divides the data streams according to different preset bit lengths to obtain target data; determines a frequency array based on the target data; inputs the frequency array into a preset protocol identification model for protocol identification to obtain a protocol identification result; and determines whether the traffic to be identified contains an encryption protocol based on the protocol identification result. Since this embodiment divides the traffic to be identified into corresponding data streams; divides the data streams according to different preset bit lengths to obtain a frequency array corresponding to the traffic to be identified; performs protocol identification on the frequency array based on a preset protocol identification model to determine whether the traffic to be identified contains an encryption protocol. Compared to the existing method of only being able to identify whether the traffic to be identified uses an encryption protocol by matching it with a public encryption protocol, the above method of this embodiment can accurately identify whether the traffic to be identified contains an encryption protocol.

[0092] refer to Figure 3 , Figure 3 Schematic diagram of the flow chart of the second embodiment of the protocol identification method of the present invention.

[0093] Based on the first embodiment above, in this embodiment, before step S30, the following steps are further included:

[0094] Step S001: Obtain sample traffic, and divide the sample traffic into corresponding sample data flows.

[0095] It should be noted that the sample traffic may be traffic collected in advance for training the initial protocol recognition model. Dividing the sample traffic into corresponding sample data flows may include determining five-tuple information of the sample traffic; classifying the sample traffic according to the five-tuple information to obtain a classification result; and using the sample traffic of the same category as the sample data flow according to the classification result. For details, please refer to the above-mentioned step of dividing the traffic to be identified into corresponding data flows, and this embodiment is not limited here.

[0096] Step S002: Divide the sample data stream according to different preset bit lengths to obtain target sample data.

[0097] It should be noted that the preset bit length may be a plurality of pre-set bit lengths for dividing the data stream. The dividing of the sample data stream according to different preset bit lengths may be dividing the data stream according to bit lengths such as 4 bits, 8 bits, 16 bits, 24 bits, etc., to obtain target data divided according to different bit lengths. For details, reference may be made to the steps of dividing the data stream according to different preset bit lengths to obtain target data in the above embodiment, which is not limited in this embodiment.

[0098] Step S003: Determine a sample frequency array according to the target sample data.

[0099] It should be noted that determining the sample frequency array according to the target sample data may be determining the occurrence frequencies of various types of data in the target sample data, and forming a frequency array according to the occurrence frequencies of various types of data. For example, the preset bit length includes 4 bits, 8 bits, 16 bits, and 24 bits.

[0100] Sort the frequencies of occurrence of each type of data in the target sample data of these four bit lengths from high to low, select the first four frequencies with the highest frequencies, fill in 0s for those less than 4, and combine them into an array in the order of 4-bit, 8-bit, 16-bit, and 24-bit lengths. Assuming that the frequencies corresponding to the 4-bit length are [16, 15, 14, 13, 1] from high to low, the frequencies corresponding to the 8-bit length are [12, 11, 10, 9, 1] from high to low, the frequencies corresponding to the 16-bit length are [8, 7, 6, 5] from high to low, and the frequencies corresponding to the 24-bit length are [4, 3, 2] from high to low, then the combined sample frequency array is [16, 15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 0].

[0101] Step S004: training an initial protocol recognition model according to the sample frequency array and the protocol information corresponding to the sample frequency array to obtain a preset protocol recognition model.

[0102] It should be noted that the initial protocol identification model may be an LSTM-FCN classification network model. The protocol information may be an encryption protocol used in the target sample data corresponding to the sample frequency array.

[0103] Furthermore, in order to improve the efficiency of model training, before step S004, it also includes: obtaining sample traffic and determining source information of the sample traffic;

[0104] Determine whether the sample traffic is encrypted traffic based on the source information, and generate protocol information of the sample traffic based on the determination result.

[0105] It should be noted that the source information may be information such as the source IP, port, and software of the sample traffic source. The step of judging whether the sample traffic is encrypted traffic based on the source information may be judging whether the sample traffic is encrypted traffic based on the encryption protocol used by the software generating the sample traffic in the source information. If so, the protocol information of the sample traffic is the encryption protocol used by the software.

[0106] This embodiment obtains sample traffic and divides the sample traffic into corresponding sample data streams; divides the sample data streams according to different preset bit lengths to obtain target sample data; determines a sample frequency array according to the target sample data; trains an initial protocol identification model according to the sample frequency array and the protocol information corresponding to the sample frequency array to obtain a preset protocol identification model. This embodiment trains the initial protocol identification model through the sample frequency array of the sample traffic and the protocol information corresponding to the sample frequency array to obtain a preset protocol identification model. Furthermore, the preset protocol identification model can be used to identify whether the traffic to be identified contains an encryption protocol, which can improve the efficiency of protocol identification.

[0107] refer to Figure 4 , Figure 4 Schematic diagram of the flow chart of the third embodiment of the protocol identification method of the present invention.

[0108] Based on the above embodiments, in this embodiment, step S30 includes:

[0109] Step S301: Determine the occurrence frequency of each type of the target data, and sort the occurrence frequency to obtain a sorting result.

[0110] It should be noted that the determination of the occurrence frequency of each type of the target data may be to determine the occurrence frequency of each type of data in the target data. For example, the data stream is divided according to 4 bits, and the target data obtained may be [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x2], where 0x0 appears 9 times. In the target data corresponding to the 4-bit length, the occurrence frequency of 0x0 is 9 times. Similarly, the occurrence frequency of 0x1 is 2 times, and the occurrence frequency of 0x2 is 1 time. The occurrence frequencies are sorted, and the sorting result may be: [9, 2, 1]. In a specific implementation, the occurrence frequencies of each type of data in the target data divided according to other bit lengths must also be counted separately.

[0111] Step S302: Select a preset number of frequency times from the sorting results.

[0112] It should be noted that the preset number may be a preset number of occurrence frequencies that need to be selected from the sorting results. For example, 4, 5, 6 or 7 occurrence frequencies need to be selected from the sorting results. For example, if the preset number is 5 and the sorting results are [9, 7, 5, 3, 2, 1], the selected frequency counts may be [9, 7, 5, 3, 2]. The preset number of frequency counts selected from the sorting results is selected in descending order.

[0113] Step S303: forming a frequency array according to the frequency numbers.

[0114] It should be noted that the frequency array formed according to the frequency number can be formed according to the frequency number of the target data corresponding to each preset bit length. For example, the preset bit length includes 8 bits and 16 bits. The frequency number corresponding to the 8-bit target data is [3, 2, 1], and the frequency number corresponding to the 16-bit target data is [1, 1, 1]. Then the frequency array can be an array obtained by combining the frequency numbers corresponding to the target data corresponding to the above two bit lengths, which can be [3, 2, 1, 1, 1, 1].

[0115] Further, in order to improve the accuracy of protocol identification by the preset protocol identification model, the step S302 may include: determining the number of elements in the sorting result;

[0116] When the number of elements is greater than or equal to a preset number, selecting a preset number of frequency times from the sorting result;

[0117] Or, when the number of elements is less than the preset number, filling the sorting result according to a preset filling strategy;

[0118] Select a preset number of frequency times from the filled sorted results.

[0119] It should be noted that, for example, the sorting result corresponding to the 8-bit target data is [3, 2, 1], and the number of elements in the sorting result is 3. The sorting result corresponding to the 16-bit target data is [4, 1, 1, 1], and the number of elements in the sorting result is 4. The preset number can be a preset number that needs to be selected. It can be a value such as 4, 6, 8, etc. When the number of elements is greater than or equal to the preset number, selecting a preset number of frequency times from the sorting result can be when the number of elements is greater than or equal to the preset number, selecting a preset number of frequency times from the sorting result in order from large to small, for example, the sorting result is [8, 6, 5, 4, 3, 2, 1], the preset number is 4, and the selected frequency times can be [8, 6, 5, 4]. The preset filling strategy can be when the number of elements is less than the preset number, padding the sorting result with 0 until the number of elements in the sorting result is equal to the preset number. For example, if the sorting result is [8, 6] and the preset number is 4, the sorting result is filled according to the preset filling strategy, and the filled sorting result can be [8, 6, 0, 0]. At this time, the number of elements in the sorting result is equal to the preset number, and the selected preset number of frequencies can be [8, 6, 0, 0].

[0120] This embodiment determines the occurrence frequency of each type of the target data, and sorts the occurrence frequency to obtain a sorting result; selects a preset number of frequency counts from the sorting result; and forms a frequency array according to the frequency counts. This embodiment counts the occurrence frequency of each type of the target data, determines the frequency array according to the occurrence frequency, and then enables the preset protocol identification model to perform protocol identification according to the frequency array, and can accurately determine whether the traffic to be identified contains an encryption protocol.

[0121] Reference Figure 5 , Figure 5 This is a structural block diagram of the first embodiment of the protocol identification device of the present invention.

[0122] like Figure 5 As shown, the protocol identification device proposed in the embodiment of the present invention includes:

[0123] A division module 10, used to divide the traffic to be identified into corresponding data flows;

[0124] The division module 10 is used to divide the data stream according to different preset bit lengths to obtain target data;

[0125] A determination module 20, configured to determine a frequency array according to the target data;

[0126] The protocol identification module 30 is used to input the frequency array into a preset protocol identification model to perform protocol identification and obtain a protocol identification result;

[0127] The judgment module 40 is used to judge whether the traffic to be identified contains an encryption protocol according to the protocol identification result.

[0128] This embodiment divides the traffic to be identified into corresponding data streams; divides the data streams according to different preset bit lengths to obtain target data; determines a frequency array based on the target data; inputs the frequency array into a preset protocol identification model for protocol identification to obtain a protocol identification result; and determines whether the traffic to be identified contains an encryption protocol based on the protocol identification result. Since this embodiment divides the traffic to be identified into corresponding data streams; divides the data streams according to different preset bit lengths to obtain a frequency array corresponding to the traffic to be identified; performs protocol identification on the frequency array based on a preset protocol identification model to determine whether the traffic to be identified contains an encryption protocol. Compared to the existing method of only being able to identify whether the traffic to be identified uses an encryption protocol by matching it with a public encryption protocol, the above method of this embodiment can accurately identify whether the traffic to be identified contains an encryption protocol.

[0129] It should be noted that the workflow described above is merely illustrative and does not limit the scope of protection of the present invention. In practical applications, technicians in this field can select part or all of them according to actual needs to achieve the purpose of the present embodiment, and no limitation is made here.

[0130] In addition, for technical details not fully described in this embodiment, reference can be made to the protocol identification method provided in any embodiment of the present invention, and will not be repeated here.

[0131] Based on the above-mentioned first embodiment of the protocol identification device of the present invention, a second embodiment of the protocol identification device of the present invention is proposed.

[0132] In this embodiment, the determination module 20 is further used to determine the occurrence frequency of each type of the target data, and sort the occurrence frequency to obtain a sorting result;

[0133] Selecting a preset number of frequency times from the sorting results;

[0134] A frequency array is formed according to the frequency numbers.

[0135] Furthermore, the determination module 20 is also used to determine the number of elements in the sorting result;

[0136] When the number of elements is greater than or equal to a preset number, selecting a preset number of frequency times from the sorting result;

[0137] Or, when the number of elements is less than the preset number, filling the sorting result according to a preset filling strategy;

[0138] Select a preset number of frequency times from the filled sorted results.

[0139] Furthermore, the division module 10 is also used to determine the five-tuple information of the traffic to be identified;

[0140] Classify the traffic to be identified according to the five-tuple information to obtain a classification result;

[0141] According to the classification result, the traffic to be identified of the same category is taken as the corresponding data flow.

[0142] Furthermore, the division module 10 is also used to parse the network traffic through a preset public protocol when receiving the network traffic to obtain a parsing result;

[0143] Determine whether the network traffic is traffic to be identified according to the analysis result;

[0144] If so, the step of dividing the traffic to be identified into corresponding data flows is performed.

[0145] Furthermore, the division module 10 is also used to traverse the preset public protocol after receiving the network traffic;

[0146] The network traffic is parsed through the currently traversed target public protocol to obtain a parsing result.

[0147] Furthermore, the classification module 10 is further configured to determine that the network traffic is not traffic to be identified when the analysis result is that the analysis is successful;

[0148] Or, when the analysis result is analysis failure, the network traffic is determined to be traffic to be identified.

[0149] Furthermore, the protocol identification module 30 is also used to obtain sample traffic and divide the sample traffic into corresponding sample data flows;

[0150] Dividing the sample data stream according to different preset bit lengths to obtain target sample data;

[0151] Determine a sample frequency array according to the target sample data;

[0152] The initial protocol recognition model is trained according to the sample frequency array and the protocol information corresponding to the sample frequency array to obtain a preset protocol recognition model.

[0153] Furthermore, the protocol identification module 30 is also used to obtain sample traffic and determine source information of the sample traffic;

[0154] Determine whether the sample traffic is encrypted traffic based on the source information, and generate protocol information of the sample traffic based on the determination result.

[0155] Furthermore, the protocol identification module 30 is also used to obtain sample traffic and determine quintuple information of the sample traffic;

[0156] Classify the sample traffic according to the five-tuple information to obtain a classification result;

[0157] According to the classification result, sample traffic of the same category is used as sample data flow.

[0158] Other embodiments or specific implementations of the protocol identification device of the present invention can refer to the above-mentioned method embodiments and will not be described in detail here.

[0159] In addition, an embodiment of the present invention further provides a storage medium, on which a protocol identification program is stored. When the protocol identification program is executed by a processor, the steps of the protocol identification method described above are implemented.

[0160] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0161] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0162] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as a read-only memory / random access memory, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0163] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

[0164] The present invention discloses A1, a protocol identification method, the protocol identification method comprising the following steps:

[0165] Divide the traffic to be identified into corresponding data flows;

[0166] Dividing the data stream according to different preset bit lengths to obtain target data;

[0167] Determine a frequency array according to the target data;

[0168] Inputting the frequency array into a preset protocol identification model to perform protocol identification and obtain a protocol identification result;

[0169] Determine whether the traffic to be identified contains an encryption protocol according to the protocol identification result.

[0170] A2. The protocol identification method as described in A1, wherein the step of determining the frequency array according to the target data comprises:

[0171] Determine the occurrence frequency of each type of the target data, and sort the occurrence frequencies to obtain a sorting result;

[0172] Selecting a preset number of frequency times from the sorting results;

[0173] A frequency array is formed according to the frequency numbers.

[0174] A3. In the protocol identification method described in A2, the step of selecting a preset number of frequency times from the sorting results comprises:

[0175] Determining the number of elements in the sorted result;

[0176] When the number of elements is greater than or equal to a preset number, selecting a preset number of frequency times from the sorting result;

[0177] Or, when the number of elements is less than the preset number, filling the sorting result according to a preset filling strategy;

[0178] Select a preset number of frequency times from the filled sorted results.

[0179] A4. The protocol identification method as described in A1, before the step of dividing the traffic to be identified into corresponding data flows, comprises:

[0180] Determining five-tuple information of the traffic to be identified;

[0181] Classify the traffic to be identified according to the five-tuple information to obtain a classification result;

[0182] According to the classification result, the traffic to be identified of the same category is taken as the corresponding data flow.

[0183] A5. The protocol identification method as described in A1, before the step of dividing the traffic to be identified into corresponding data flows, further comprising:

[0184] When receiving network traffic, the network traffic is parsed using a preset public protocol to obtain a parsing result;

[0185] Determine whether the network traffic is traffic to be identified according to the analysis result;

[0186] If so, the step of dividing the traffic to be identified into corresponding data flows is performed.

[0187] A6. The protocol identification method as described in A5, wherein when receiving network traffic, the network traffic is parsed by a preset public protocol to obtain a parsing result, comprising:

[0188] After receiving network traffic, traverse the preset public protocol;

[0189] The network traffic is parsed through the currently traversed target public protocol to obtain a parsing result.

[0190] A7. In the protocol identification method described in A5, the step of determining whether the network traffic is traffic to be identified based on the analysis result comprises:

[0191] When the analysis result is that the analysis is successful, determining that the network traffic is not traffic to be identified;

[0192] Or, when the analysis result is analysis failure, the network traffic is determined to be traffic to be identified.

[0193] A8. The protocol identification method according to any one of A1 to A7, wherein before the step of inputting the frequency array into a preset protocol identification model for protocol identification and obtaining a protocol identification result, the method further comprises:

[0194] Obtaining sample traffic, and dividing the sample traffic into corresponding sample data flows;

[0195] Dividing the sample data stream according to different preset bit lengths to obtain target sample data;

[0196] Determine a sample frequency array according to the target sample data;

[0197] The initial protocol recognition model is trained according to the sample frequency array and the protocol information corresponding to the sample frequency array to obtain a preset protocol recognition model.

[0198] A9. The protocol identification method as described in A8, before the step of training the initial protocol identification model according to the sample frequency array and the protocol information corresponding to the sample frequency array to obtain the preset protocol identification model, further includes:

[0199] Obtaining sample traffic and determining source information of the sample traffic;

[0200] Determine whether the sample traffic is encrypted traffic based on the source information, and generate protocol information of the sample traffic based on the determination result.

[0201] A10. In the protocol identification method described in A8, the step of obtaining sample traffic and dividing the sample traffic into corresponding sample data flows comprises:

[0202] Obtaining sample traffic and determining quintuple information of the sample traffic;

[0203] Classify the sample traffic according to the five-tuple information to obtain a classification result;

[0204] According to the classification result, sample traffic of the same category is used as sample data flow.

[0205] The present invention discloses B11, a protocol identification device, the protocol identification device comprising:

[0206] A division module, used for dividing the traffic to be identified into corresponding data flows;

[0207] The division module is used to divide the data stream according to different preset bit lengths to obtain target data;

[0208] A determination module, used for determining a frequency array according to the target data;

[0209] A protocol identification module, used for inputting the frequency array into a preset protocol identification model for protocol identification to obtain a protocol identification result;

[0210] The judgment module is used to judge whether the traffic to be identified contains an encryption protocol according to the protocol identification result.

[0211] B12. The protocol identification device as described in B11, wherein the determination module is further used to determine the occurrence frequency of each type of the target data, and sort the occurrence frequency to obtain a sorting result;

[0212] Selecting a preset number of frequency times from the sorting results;

[0213] A frequency array is formed according to the frequency numbers.

[0214] B13. The protocol identification device as described in B12, wherein the determination module is further used to determine the number of elements in the sorting result;

[0215] When the number of elements is greater than or equal to a preset number, selecting a preset number of frequency times from the sorting result;

[0216] Or, when the number of elements is less than the preset number, filling the sorting result according to a preset filling strategy;

[0217] Select a preset number of frequency times from the filled sorted results.

[0218] B14, as described in B11, the protocol identification device, the division module is also used to determine the five-tuple information of the traffic to be identified;

[0219] Classify the traffic to be identified according to the five-tuple information to obtain a classification result;

[0220] According to the classification result, the traffic to be identified of the same category is taken as the corresponding data flow.

[0221] B15. The protocol identification device as described in B11, wherein the division module is further used to parse the network traffic by using a preset public protocol to obtain a parsing result when receiving the network traffic;

[0222] Determine whether the network traffic is traffic to be identified according to the analysis result;

[0223] If so, the step of dividing the traffic to be identified into corresponding data flows is performed.

[0224] B16. The protocol identification device as described in B15, wherein the division module is further used to traverse the preset public protocol after receiving the network traffic;

[0225] The network traffic is parsed through the currently traversed target public protocol to obtain a parsing result.

[0226] B17, as described in B11-B16, the protocol identification device, the protocol identification module is further used to obtain sample traffic and divide the sample traffic into corresponding sample data flows;

[0227] Dividing the sample data stream according to different preset bit lengths to obtain target sample data;

[0228] Determine a sample frequency array according to the target sample data;

[0229] The initial protocol recognition model is trained according to the sample frequency array and the protocol information corresponding to the sample frequency array to obtain a preset protocol recognition model.

[0230] B18. The protocol identification device as described in B17, wherein the protocol identification module is further used to obtain sample traffic and determine source information of the sample traffic;

[0231] Determine whether the sample traffic is encrypted traffic based on the source information, and generate protocol information of the sample traffic based on the determination result.

[0232] The present invention discloses C19, a protocol identification device, which includes: a memory, a processor, and a protocol identification program stored in the memory and executable on the processor, wherein the protocol identification program is configured to implement the steps of the protocol identification method described in any one of A1 to A10.

[0233] The present invention discloses D20, a storage medium, on which a protocol identification program is stored, and when the protocol identification program is executed by a processor, the steps of the protocol identification method described in any one of A1 to A10 are implemented.

Claims

1. A protocol identification method, characterized in that: The protocol identification method comprises the following steps: Divide the traffic to be identified into corresponding data flows; Dividing the data stream according to different preset bit lengths to obtain target data; Determine a frequency array according to the target data; Inputting the frequency array into a preset protocol identification model to perform protocol identification and obtain a protocol identification result; Determine whether the traffic to be identified contains an encryption protocol according to the protocol identification result.

2. The protocol identification method according to claim 1, characterized in that: The step of determining a frequency array according to the target data comprises: Determine the occurrence frequency of each type of the target data, and sort the occurrence frequencies to obtain a sorting result; Selecting a preset number of frequency times from the sorting results; A frequency array is formed according to the frequency numbers.

3. The protocol identification method according to claim 2, characterized in that: The step of selecting a preset number of frequency times from the sorting results includes: Determining the number of elements in the sorted result; When the number of elements is greater than or equal to a preset number, selecting a preset number of frequency times from the sorting result; Or, when the number of elements is less than the preset number, filling the sorting result according to a preset filling strategy; Select a preset number of frequency times from the filled sorted results.

4. The protocol identification method according to claim 1, characterized in that: Before the step of dividing the traffic to be identified into corresponding data flows, the method includes: Determining five-tuple information of the traffic to be identified; Classify the traffic to be identified according to the five-tuple information to obtain a classification result; According to the classification result, the traffic to be identified of the same category is taken as the corresponding data flow.

5. The protocol identification method according to claim 1, characterized in that: Before the step of dividing the traffic to be identified into corresponding data flows, the method further includes: When receiving network traffic, the network traffic is parsed using a preset public protocol to obtain a parsing result; Determine whether the network traffic is traffic to be identified according to the analysis result; If so, the step of dividing the traffic to be identified into corresponding data flows is performed.

6. The protocol identification method according to claim 5, characterized in that: The step of parsing the network traffic by using a preset public protocol to obtain a parsing result when receiving the network traffic comprises: After receiving network traffic, traverse the preset public protocol; The network traffic is parsed through the currently traversed target public protocol to obtain a parsing result.

7. The protocol identification method according to claim 5, characterized in that: The step of judging whether the network traffic is traffic to be identified according to the analysis result includes: When the analysis result is that the analysis is successful, determining that the network traffic is not traffic to be identified; Or, when the analysis result is analysis failure, the network traffic is determined to be traffic to be identified.

8. A protocol identification device, characterized in that: The protocol identification device comprises: A division module, used for dividing the traffic to be identified into corresponding data flows; The division module is used to divide the data stream according to different preset bit lengths to obtain target data; A determination module, used for determining a frequency array according to the target data; A protocol identification module, used for inputting the frequency array into a preset protocol identification model for protocol identification to obtain a protocol identification result; The judgment module is used to judge whether the traffic to be identified contains an encryption protocol according to the protocol identification result.

9. A protocol identification device, characterized in that: The device comprises: a memory, a processor, and a protocol identification program stored in the memory and executable on the processor, wherein the protocol identification program is configured to implement the steps of the protocol identification method according to any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium stores a protocol identification program, and when the protocol identification program is executed by the processor, the steps of the protocol identification method according to any one of claims 1 to 7 are implemented.

Images