Network vulnerability analysis method and shielding system based on bypass mirror image flow access

Abstract

The invention relates to the technical field of network security, and provides a bypass mirror image traffic access-based network vulnerability analysis method and shielding system, and the method comprises the steps: obtaining encrypted bit stream data of to-be-recognized bypass mirror image traffic; from the first bit of the bit stream data, window sliding and detection processing is carried out on the bit stream data at the same time, and the detection processing comprises the steps that randomness detection is carried out on the bit stream data in all windows through multiple randomness detection algorithms, and detection results of all the windows are obtained; based on the detection results of the preset number of continuous windows, determining a secret-clear boundary position and a clear-secret boundary position in the bit stream data until the window is slid to the end of the bit stream data; and identifying the plaintext-plaintext fields of the bit stream data based on the plaintext-plaintext junction position and the plaintext-plaintext junction position to obtain a network vulnerability analysis result of the bypass mirror traffic. According to the network vulnerability analysis method and shielding system based on bypass mirror image flow access provided by the invention, the accuracy of network vulnerability analysis can be improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a network vulnerability analysis method and shielding system based on bypass mirror traffic access. Background Art

[0002] In the application of network vulnerability analysis for bypass mirror traffic access, the basic work of identifying the clear and secret fields and locating the frames of the encrypted bit stream data of the bypass mirror traffic is of great significance for parsing unknown bypass mirror traffic to achieve network application monitoring and management.

[0003] In the related art, a random detection method is often used to determine the encrypted sample data of the initial bypass mirror traffic, and then certain features of the sample data are extracted to establish a template, and finally the plain and secret fields in the data are determined by template matching. The disadvantage of this type of solution is that the initial sample data only uses a random detection method to determine whether it is encrypted or not. Such a determination result deviates too much from the actual plain and secret fields, which will reduce the credibility of the template established subsequently, resulting in low accuracy in the analysis of unknown bypass mirror traffic. Summary of the invention

[0004] The present application provides a network vulnerability analysis method and shielding system based on bypass mirror traffic access, which is used to solve the defect of low accuracy of network vulnerability analysis of encrypted bit stream data of bypass mirror traffic in the prior art.

[0005] In a first aspect, the present application provides a network vulnerability analysis method based on bypass mirror traffic access, comprising:

[0006] Obtaining encrypted bit stream data of bypass mirror traffic to be identified;

[0007] Starting from the first bit of the bit stream data, performing a sliding window detection process on the bit stream data, wherein the detection process includes using a plurality of randomness detection algorithms to perform randomness detection on the bit stream data in each window to obtain a detection result of each window;

[0008] Based on the detection results of a preset number of continuous windows, determine the dense-light boundary position and the bright-dense boundary position in the bit stream data until the sliding window reaches the end of the bit stream data;

[0009] Based on the position of the dense-light boundary and the position of the light-dense boundary, the light-dense and light-encrypted fields of the bit stream data are identified to obtain a network vulnerability analysis result of the bypass mirror traffic.

[0010] According to the method provided by the present application, the randomness detection of the bit stream data in each window is performed using multiple randomness detection algorithms to obtain the detection results of each window, including:

[0011] For any window in the windows, use multiple randomness detection algorithms to perform randomness detection on the bit stream data in the window, and obtain single detection results corresponding to the multiple randomness detection algorithms respectively;

[0012] The single detection results corresponding to the multiple randomness detection algorithms are fused to obtain the detection result of any window.

[0013] According to the method provided in the present application, the single detection results corresponding to the multiple randomness detection algorithms are fused to obtain the detection result of any window, including:

[0014] If it is necessary to find the position of the dense-light boundary in the bit stream data, perform an OR fusion operation on the single detection result to obtain the detection result of any window;

[0015] If it is necessary to find the boundary position between bright and dense in the bit stream data, an AND fusion operation is performed on the single detection result to obtain the detection result of any window.

[0016] According to the method provided by the present application, the step of determining the dense-light boundary position and the bright-dense boundary position in the bit stream data based on the detection results of a preset number of continuous windows includes:

[0017] If the detection results of the continuous windows all indicate that the detection has been passed, searching for the boundary position of the light and dark areas in the bit stream data corresponding to the continuous windows based on a binary search algorithm;

[0018] If the detection results of the continuous windows all indicate that the detection has not been passed, then based on a binary search algorithm, the dense-light boundary position in the bit stream data corresponding to the continuous windows is searched.

[0019] According to the method provided by the present application, after the clear and secret fields of the bit stream data are identified based on the clear and secret boundary positions and the clear and secret boundary positions, and the network vulnerability analysis result of the bypass mirror traffic is obtained, it also includes:

[0020] Extracting plaintext bit stream data from the bit stream data;

[0021] Performing sliding window processing on the plaintext bit stream data to obtain multiple bit stream sequences, and determining a first candidate frame synchronization sequence from the multiple bit stream sequences;

[0022] clustering the first candidate frame synchronization sequences based on similarities between the first candidate frame synchronization sequences to obtain a plurality of first sequence clusters;

[0023] Determining a frame synchronization sequence from each of the first candidate frame synchronization sequences based on the frequency of occurrence of the longest common substring of each of the first sequence clusters;

[0024] Based on the frame synchronization sequence, frame alignment is performed on the plaintext bit stream data.

[0025] According to the method provided by the present application, the determining of a frame synchronization sequence from each of the first candidate frame synchronization sequences based on the frequency of occurrence of the longest common substring of each first sequence cluster includes:

[0026] Taking the longest common substring of each of the first sequence clusters as a second candidate frame synchronization sequence;

[0027] Clustering the second candidate frame synchronization sequences based on the similarities between the second candidate frame synchronization sequences to obtain a plurality of second sequence clusters;

[0028] The frame synchronization sequence is determined from each of the second candidate frame synchronization sequences based on the frequency of occurrence of the longest common substring of each second sequence cluster.

[0029] According to the method provided by the present application, the step of determining the longest common substring of the first sequence cluster includes:

[0030] According to the storage order of the first candidate frame synchronization sequence, starting from the first sequence, based on the current first candidate frame synchronization sequence and the previous longest common substring, determine the current second longest common substring, and use the next sequence of the current first candidate frame synchronization sequence as the current first candidate frame synchronization sequence, until the last sequence, to obtain the longest common substring of the first sequence cluster.

[0031] In a second aspect, the present application also provides a shielding system, comprising:

[0032] A data acquisition unit, used for acquiring encrypted bit stream data of bypass mirror traffic to be identified;

[0033] A sliding window detection unit, configured to perform sliding window detection processing on the bit stream data starting from the first bit of the bit stream data, wherein the detection processing includes performing randomness detection on the bit stream data in each window using a plurality of randomness detection algorithms to obtain detection results of each window;

[0034] A position determination unit, used to determine the position of the dense-light boundary and the position of the bright-dense boundary in the bit stream data based on the detection results of a preset number of continuous windows, until the sliding window reaches the end of the bit stream data;

[0035] The network vulnerability analysis unit is used to identify the plain and secret fields of the bit stream data based on the dense-plain boundary position and the plain-crypto boundary position, and obtain the network vulnerability analysis result of the bypass mirror traffic.

[0036] In a third aspect, the present application further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method of any one of the first aspects described above is implemented.

[0037] In a fourth aspect, the present application further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any of the methods described in the first aspect above.

[0038] In a fifth aspect, the present application also provides a computer program product, including a computer program, which implements any of the methods described in the first aspect above when the computer program is executed by a processor.

[0039] The network vulnerability analysis method and shielding system based on bypass mirror traffic access provided by the present application performs sliding window and detection processing on the bit stream data of the bypass mirror traffic. The detection processing includes using multiple randomness detection algorithms to perform randomness detection on the bit stream data in each window to obtain the detection results of each window; based on the detection results of a preset number of consecutive windows, the dense-light boundary position and the bright-dense boundary position in the bit stream data are determined, so as to realize the recognition of the bright and dense fields of the bit stream data of the bypass mirror traffic, and at the same time, the accuracy of network vulnerability analysis can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the technical solutions in the present application or the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0041] Figure 1 This is one of the flow diagrams of the network vulnerability analysis method based on bypass mirror traffic access provided by this application;

[0042] Figure 2 It is a schematic diagram of a sliding window provided by this application;

[0043] Figure 3 This is the second flow chart of the network vulnerability analysis method based on bypass mirror traffic access provided by this application;

[0044] Figure 4 It is a schematic diagram of the process of bit stream data frame positioning provided by this application;

[0045] Figure 5 This is the second flow chart of the network vulnerability analysis method based on bypass mirror traffic access provided by this application;

[0046] Figure 6 It is a structural schematic diagram of the shielding system provided by the present application;

[0047] Figure 7 It is a structural schematic diagram of the electronic device provided by this application. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solutions and advantages of this application clearer, the technical solutions in this application will be clearly and completely described below in conjunction with the drawings in this application. Obviously, the described embodiments are part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0049] In the context of the research on unknown bypass mirror traffic, how to accurately locate the frame of the bit stream data of the bypass mirror traffic is an important technical basis for obtaining the upper-layer protocol data and then parsing the upper-layer protocol. When facing encrypted bit stream data, the problem of frame positioning depends on the analysis results of its plaintext field frame characteristics, so before performing frame positioning, it is necessary to accurately identify and divide the plaintext and secret fields of the encrypted bit stream data. Therefore, completing the basic work of identifying the plaintext and secret fields and locating the frames of encrypted bit stream data is of great significance for the subsequent parsing of unknown bypass mirror traffic on this basis to achieve network application monitoring and management.

[0050] Related technologies often use a randomness detection method to determine the initial encrypted sample data, then extract certain features of the sample data to establish a template, and finally determine the plain and secret fields in the data through template matching. The disadvantage of this type of solution is that the initial sample data only uses a randomness detection method to determine whether it is encrypted or not. Such a determination result deviates too much from the actual plain and secret fields, which will reduce the credibility of the template established subsequently, resulting in low accuracy in the analysis of unknown bypass mirror traffic.

[0051] In view of the above problems, in order to improve the accuracy of plaintext and ciphertext identification of encrypted bit stream data, the inventive concept of the present application is to: perform sliding window and detection processing on the bit stream data of the bypass mirror traffic, the detection processing includes using multiple randomness detection algorithms to perform randomness detection on the bit stream data in each window to obtain the detection results of each window; based on the detection results of a preset number of consecutive windows, determine the boundary position between dense and light and the boundary position between plain and encrypted in the bit stream data, thereby realizing the identification of plain and encrypted fields.

[0052] Based on the above-mentioned inventive concept, the present application provides a network vulnerability analysis method and shielding system based on bypass mirror traffic access, which can be applied to the scenario of plaintext and ciphertext identification of encrypted bit stream data of unknown bypass mirror traffic in an open network, and provide basic data for subsequent bypass mirror traffic analysis work to improve the accuracy of bypass mirror traffic analysis.

[0053] In the description of the embodiments of the present application, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of the embodiments of the present application, "multiple" means two or more, unless otherwise clearly and specifically defined.

[0054] The technical solution of the present application will be described in detail below with reference to the accompanying drawings. Figure 1 This is one of the flow charts of the network vulnerability analysis method based on bypass mirror traffic access provided by the present application. The executor of each step in the method can be a shielding system. The device can be implemented by software and / or hardware. The device can be integrated in an electronic device. The electronic device can be a terminal device (such as a smart phone, a personal computer, etc.), or a server (such as a local server or a cloud server, or a server cluster, etc.), or a processor, or a chip, etc.

[0055] like Figure 1 As shown, the method comprises the following steps:

[0056] Step 110, obtaining encrypted bit stream data of bypass mirror traffic to be identified;

[0057] Step 120, starting from the first bit of the bit stream data, performing a sliding window detection process on the bit stream data of the bypass mirror traffic, the detection process includes using multiple randomness detection algorithms to perform randomness detection on the bit stream data in each window to obtain a detection result of each window;

[0058] Step 130, based on the detection results of a preset number of continuous windows, determine the dense-light boundary position and the bright-dense boundary position in the bit stream data until the window is slid to the end of the bit stream data;

[0059] Step 140, based on the position of the boundary between the dense and the light and the position of the boundary between the light and the dense, the plain and the plain fields of the bit stream data are identified to obtain a network vulnerability analysis result of the bypass mirror traffic.

[0060] Specifically, a bit stream is a data stream composed of two binary digits, 0 and 1, and is the most basic form of data processing and transmission in a computer. This data stream can represent data, instructions, or control information. Encrypted bit stream data refers to bit stream data that has been encrypted. The encrypted bit stream data to be identified is the bit stream data that needs to be identified for clear and cipher fields. Clear and cipher field identification refers to distinguishing which are plain text fields and which are cipher fields in the bit stream data.

[0061] Figure 2 It is a schematic diagram of a sliding window provided by this application, such as Figure 2 As shown, a sliding window is used to shift backward from the first bit of the bit stream, one bit at a time, and the window size of the sliding window is preset, for example, it can be 200 bits (bit) or 150 bits, etc., and there is no specific limitation on the window size.

[0062] Figure 3 This is the second flow chart of the network vulnerability analysis method based on bypass mirror traffic access provided by this application, such as Figure 3 As shown, in the embodiment of the present application, a sliding and detecting mechanism is adopted, and the bit stream data in each window needs to be tested for its randomness through multiple randomness detection algorithms, where multiple can be two or more.

[0063] In some embodiments, the multiple randomness detection algorithms may specifically be at least two of the six detection methods in GM / T0005-2021 "Randomness Detection Specification". The six detection methods are single-bit frequency detection, total run detection, binary derivation detection, poker detection, overlapping subsequence detection, and autocorrelation detection.

[0064] A variety of randomness detection algorithms are used to perform randomness detection on the bit stream data in each window to obtain the detection results of each window, including:

[0065] Step 121, for any window in each window, use multiple randomness detection algorithms to perform randomness detection on the bit stream data in any window, and obtain single detection results corresponding to the multiple randomness detection algorithms respectively;

[0066] Step 122, the single detection results corresponding to the multiple randomness detection algorithms are merged to obtain the detection result of any window.

[0067] Specifically, for randomness detection of bit stream data in any window, multi-thread processing can be used, and each thread corresponds to a randomness detection algorithm. The encrypted bit stream data is scanned by a sliding window to form a job queue. One job is one window. The job is passed to the thread pool. Multiple threads will synchronously perform multiple randomness detections on it to obtain single detection results corresponding to multiple randomness detection algorithms. Here, a single detection result refers to the detection result of any randomness detection algorithm for any window.

[0068] In order to improve the accuracy of identifying the plaintext and ciphertext fields, the single test results corresponding to the various randomness detection algorithms can be combined to obtain the test results of any window. Considering the characteristics of the encryption algorithm, the encrypted data stream will show good random distribution characteristics in the randomness test, that is, the test result is passed; while the plaintext generally has a certain meaning, which also makes its randomness performance poor, that is, the test result is not passed. Therefore, whether the randomness test can be passed can be used as a basis to preliminarily judge the plaintext and ciphertext status of the encrypted bit stream.

[0069] If multiple single detection results are consistent and all pass the detection, the bit stream data of the window can be considered to be in a pure ciphertext state; if multiple single detection results are consistent and all fail the detection, the bit stream data of the window can be considered to be pure plaintext; if multiple single detection results are inconsistent, the bit stream data of the window can be considered to be in a mixed state of plaintext and ciphertext.

[0070] Based on any of the above embodiments, the single detection results corresponding to the multiple randomness detection algorithms are fused to obtain the detection result of any window, that is, step 122 specifically includes:

[0071] If it is necessary to find the position of the dense-light boundary in the bit stream data, the single detection result is subjected to an OR fusion operation to obtain the detection result of the window;

[0072] If it is necessary to find the boundary position between bright and dense data in the bit stream data, the single detection result is subjected to an AND fusion operation to obtain the detection result of the window.

[0073] Specifically, the phase-OR operation is a type of binary operation, also known as bitwise OR. Its operation rule is: when one of the binary digits corresponding to the two numbers is 1, the result bit is 1, otherwise it is 0. The operation rule of the phase-AND operation is: when one of the binary digits corresponding to the two numbers is 0, the result bit is 0, otherwise it is 1.

[0074] The position of the boundary between ciphertext and plaintext in the bitstream data can be understood as the position that can be used as the boundary value from ciphertext to plaintext, with the position as the boundary, the left half is ciphertext and the right half is plaintext. The position of the boundary between ciphertext and plaintext in the bitstream data can be understood as the position that can be used as the boundary value from plaintext to ciphertext, with the position as the boundary, the left half is plaintext and the right half is ciphertext.

[0075] Reference Figure 3 , the symbol value can be 1 or 0. The initial value is set to 1. 1 indicates that the bright-dense junction needs to be found, and 0 indicates that the dense-bright junction needs to be found. When the symbol value is 1, it indicates that the bright-dense junction needs to be found, and the single detection result is ANDed. After finding the bright-dense junction, the symbol value can be changed to 0; when the symbol value is 0, it indicates that the dense-bright junction needs to be found, and the single detection result is ORed. After finding the dense-bright junction, the symbol value can be changed to 1.

[0076] Based on any of the above embodiments, in step 130, based on the detection results of a preset number of continuous windows, determining the dense-light boundary position and the bright-dense boundary position in the bit stream data includes:

[0077] Step 131, if the detection results of the continuous windows all indicate that the detection has been passed, then based on a binary search algorithm, the position of the boundary between the bright and the dense bits in the bit stream data corresponding to the continuous windows is searched;

[0078] Step 132: If the detection results of the continuous windows all indicate that the detection has not been passed, then based on a binary search algorithm, the dense-light boundary position in the bit stream data corresponding to the continuous windows is searched.

[0079] Specifically, after obtaining the detection results of each window through multiple randomness detection algorithms, the dense-light boundary position and the bright-dense boundary position in the bit stream data can be determined based on the detection results of a preset number of consecutive windows. The preset number here can be 13 or other positive integers.

[0080] The binary search algorithm, also known as the binary search algorithm, is an efficient search algorithm. Its basic idea is to continuously reduce the search range to half of the original range until the target value is found or it is determined that the target value does not exist. This search method is for an ordered data set. Each time, the interval to be searched is reduced to half of the previous one by comparing it with the middle element of the interval, until the element to be searched is found or the interval is reduced to 0.

[0081] In some embodiments, the steps of using the binary search method to find the bright-dense boundary position are as follows:

[0082] 1) The bit stream in each window is tested by "ANDing" multiple randomness detection algorithms. If it passes, it is recorded as 1, and if it fails, it is recorded as 0. When p consecutive 1s (the value of p is 13 in this embodiment) appear, the sliding is stopped, and the position where the first 1 appears is recorded. This position is used as the left boundary, and a window size of data is taken as input to execute step 2);

[0083] 2) Divide the input data into two parts, copy the left half several times to expand it to the window value size, and do randomness detection. If it is ciphertext, use the half data before copying as input and repeat step 2). If it is plaintext, execute step 3.

[0084] 3) Copy the right half of the data several times to expand it to the window value size for randomness test. If it is plaintext, use the half of the data before copying as input and re-execute step 2). If it is ciphertext, output the left boundary of this half of the data as the boundary value from plaintext to ciphertext.

[0085] In some other embodiments, the steps of using the binary search method to find the position of the dense-bright boundary are as follows:

[0086] 4) The sliding window continues to slide, so that the data in each window is subjected to the "phase-OR" test of the six randomness detection algorithms. If p consecutive 0s appear, the sliding is stopped, and the position where the first 0 appears is recorded. This position is used as the left boundary, and data of a window size is taken as input to execute step 5);

[0087] 5) Divide the input data into two parts, copy the left half several times to expand it to the window value size, and do randomness test. If it is plain text, use the half data before copying as input and repeat step 5). If it is ciphertext, execute step 6.

[0088] 6) Copy the right half of the data several times to expand it to the window value size for randomness test. If it is ciphertext, use the half of the data before copying as input and re-execute step 6). If it is plaintext, output the left boundary of this half of the data as the boundary value from ciphertext to plaintext.

[0089] On this basis, steps 120-130 can be repeatedly performed until the sliding window reaches the end of the bit stream data, that is, all bit stream data are fully detected, and all clear and secret and secret-clear boundary positions are output. Then, based on the secret-clear boundary position and the clear-secret boundary position, the clear and secret fields of the encrypted bit stream data can be segmented and marked to realize the clear and secret field identification of the bit stream data of the bypass mirror traffic, and obtain the network vulnerability analysis results of the bypass mirror traffic.

[0090] The method provided in the embodiment of the present application performs sliding window and detection processing on the bit stream data of the bypass mirror traffic. The detection processing includes using multiple randomness detection algorithms to perform randomness detection on the bit stream data in each window to obtain the detection results of each window; based on the detection results of a preset number of consecutive windows, the dense-light boundary position and the bright-dense boundary position in the bit stream data are determined, so as to realize the recognition of the bright and dense fields of the bit stream data of the bypass mirror traffic and improve the accuracy of network vulnerability analysis.

[0091] How to accurately locate the frame of the bit stream data of the bypass mirror traffic is an important technical basis for obtaining upper-layer protocol data and then parsing the upper-layer protocol. After accurately identifying and dividing the plain and secret fields of the encrypted bit stream data, the bit stream data of the bypass mirror traffic can be accurately located.

[0092] For frame positioning, related technologies usually identify frame synchronization sequences based on frequent pattern mining and association rule mining. This method has the following problems: ① When the length of the candidate pattern m is large, the dictionary tree generated by enumeration requires a huge space and cannot mine long frequent patterns; ② For the method of statistics and pruning, if pruning is too early, it is easy to cause frequent sequences to be lost, and pruning too late will not significantly improve efficiency. Although long frequent patterns can be obtained by splicing the short frequent patterns mined, these methods all rely on the accuracy of short frequent pattern mining, and the number of sequence combinations generated during splicing cannot be ignored.

[0093] In view of the above problems, in the embodiment of the present application, after identifying the clear and secret fields of the bit stream data of the bypass mirror traffic based on the clear and secret boundary position and the clear and secret boundary position, the method further includes:

[0094] Step 210, extracting plaintext bit stream data from the bit stream data;

[0095] Step 220, performing sliding window processing on the plaintext bit stream data to obtain multiple bit stream sequences, and determining a first candidate frame synchronization sequence from the multiple bit stream sequences;

[0096] Step 230, clustering the first candidate frame synchronization sequences based on the similarities between the first candidate frame synchronization sequences to obtain a plurality of first sequence clusters;

[0097] Step 240, determining a frame synchronization sequence from each first candidate frame synchronization sequence based on the frequency of occurrence of the longest common substring of each first sequence cluster;

[0098] Step 250: perform frame alignment on the plaintext bit stream data based on the frame synchronization sequence.

[0099] Specifically, the frame header in the frame format usually contains common fields such as the frame synchronization sequence, address field, and control field. The frame synchronization sequence is a special pattern sequence that enables the receiver to distinguish the start and end of the frame from the received bit stream. The frame synchronization sequence of a link protocol remains unchanged during the communication process. Therefore, in the face of continuous bit stream data, in the absence of any prior knowledge, in order to achieve the goal of dividing it into frames and then analyzing the protocol format, the key is to accurately identify the frame synchronization sequence and then divide it according to its starting position.

[0100] Figure 4 This is a schematic diagram of the process of bit stream data frame positioning provided by this application, specifically:

[0101] 1) Extract the plaintext bit stream data, and use a sliding window to shift the plaintext bit stream from the first bit to the back in sequence, shifting 1 bit each time, and the window size is n (the value of n is 16 bits in this embodiment);

[0102] 2) Perform sliding window processing on the plaintext bit stream data to obtain multiple bit stream sequences. Every time a new sequence is found, it is added to the sequence set T, and the size of the set Tn is increased by 1. If the sequence already exists in T, that is, it is not a new sequence, the size Tn of the set T remains unchanged;

[0103] 3) When the number of consecutive unchanged Tn exceeds a threshold value τ (τ value is 17 in this embodiment), the corresponding original bit stream sequence is put into a frame synchronization sequence candidate set file, where the frame synchronization sequence candidate set includes the first candidate frame synchronization sequence.

[0104] Then, the Levenshtein distance in the edit distance is used to calculate the similarity between the strings. The distance refers to the minimum number of editing operations required to convert one string into another. The allowed editing operations include replacing one character with another, inserting a character, and deleting a character. The formula for calculating the similarity through the edit distance is: similarity = 1-edit distance / max (length of string 1, length of string 2). Finally, similar sequences in the frame synchronization sequence candidate set are clustered into one category according to the similarity results to form multiple first sequence clusters.

[0105] Then calculate the longest common substring of the first sequence cluster. The longest common substring here means that no other common substring contains the common substring, that is, in the set composed of the longest common substring, there is no inclusion relationship between any two elements. To find the longest common substring set of multiple sequences in the cluster, you need to first select two sequences from the cluster for comparison, find their longest common substring set, and delete these two sequences from the cluster. Then select another sequence in the updated cluster and compare it one by one with all the substrings in the longest common substring set obtained previously, update the longest common substring set, and repeat the operation until all sequences in the original cluster are compared.

[0106] In one embodiment, the frequency of occurrence of the longest common substring of each first sequence cluster can be obtained by the following steps:

[0107] 4) Use the data structure of array + linked list to store the grouped candidate sequences, first read the first line of data in the frame synchronization sequence candidate set file and store it in the array;

[0108] 5) Continue to read the frame synchronization sequence candidate set file, and calculate the similarity between each line read and the sequence in the array. If the similarity is greater than or equal to the threshold λ (λ value is 0.8 in this embodiment), it is added to the linked list with the array node as the head node, otherwise it is placed in the next array node, and this step is repeated until all frame synchronization sequence candidate set files are read;

[0109] 6) A linked list with each array node as the head node is a group, and the longest common substring set is found within each group.

[0110] To determine the longest common substring, we can start from the first sequence in the storage order of the first candidate frame synchronization sequence, determine the current second longest common substring based on the current first candidate frame synchronization sequence and the previous longest common substring, and use the next sequence of the current first candidate frame synchronization sequence as the current first candidate frame synchronization sequence, until the last sequence, to obtain the longest common substring of the first sequence cluster.

[0111] The specific steps to find the longest common substring set in a group are as follows: ① If the next of the head node of the linked list is empty, that is, the group has only one node, then output the sequence directly; if the next of the head node of the linked list is not empty, that is, the group has at least two sequences, find the longest common substring of the first two node sequences of the linked list to form the initial longest common substring set; ② If the linked list has not reached the end, find the longest common substring of the substring in the longest common substring set and the next node sequence in the linked list, and update the longest common substring set; ③ Repeat the previous step until the linked list reaches the end.

[0112] 7) Count the frequencies. The frequency of each substring in the longest common substring set finally obtained by a single group is equal to the sum of the frequencies of the original candidate sequences in the group. Based on the frequency of occurrence of the longest common substring of each first sequence cluster, the sequence with the highest frequency in each first candidate frame synchronization sequence is used as the frame synchronization sequence.

[0113] In some embodiments, in order to further improve the accuracy of the frame synchronization sequence, based on the above embodiment, based on the frequency of occurrence of the longest common substring of each first sequence cluster, determining the frame synchronization sequence from each first candidate frame synchronization sequence includes:

[0114] Taking the longest common substring of each first sequence cluster as the second candidate frame synchronization sequence;

[0115] Clustering the second candidate frame synchronization sequences based on the similarities between the second candidate frame synchronization sequences to obtain a plurality of second sequence clusters;

[0116] Based on the frequency of occurrence of the longest common substring of each second sequence cluster, a frame synchronization sequence is determined from each second candidate frame synchronization sequence.

[0117] Specifically, after obtaining the longest common substring set of all groups for the first time, the longest common substring of each first sequence cluster can be used as the second candidate frame synchronization sequence, and the second candidate frame synchronization sequences are clustered again according to similarity to obtain the longest common substring. Finally, based on the frequency of occurrence of the longest common substring of each second sequence cluster, the second candidate frame synchronization sequence with the highest frequency in the longest common substring set is used as the final synchronization sequence.

[0118] After obtaining the frame synchronization sequence, the plaintext bit stream data can be frame aligned.

[0119] Based on any of the above embodiments, Figure 5 This is the second flow chart of the network vulnerability analysis method based on bypass mirror traffic access provided by this application, such as Figure 5 As shown, a network vulnerability analysis method based on bypass mirror traffic access is provided, including:

[0120] S1, obtaining encrypted bit stream data of bypass mirror traffic to be identified.

[0121] S2, identifying the plain and secret fields of the encrypted bit stream data, specifically including:

[0122] Starting from the first bit of the bit stream data, the bit stream data of the bypass mirror traffic is subjected to a sliding window and detection process until the window is slid to the last bit of the bit stream data, and the dense-light boundary position and the bright-dense boundary position in the bit stream data are obtained.

[0123] For any window in each window, a plurality of randomness detection algorithms are used to perform randomness detection on the bit stream data in any window, and a single detection result corresponding to each of the plurality of randomness detection algorithms is obtained. Specific parameters of the plurality of randomness detection algorithms are shown in Table 1.

[0124] Table 1

[0125] Randomness test items Detection parameters Single bit frequency detection Confidence Alpha = 0.01 Total number of runs test Confidence level Alpha = 0.01 Poker Detection Alpha = 0.01, m = 3 Autocorrelation Detection Confidence Alpha = 0.01, d = 1 Binary Derivation Detection Alpha = 0.01, k = 3 Overlapping subsequence detection Confidence level Alpha = 0.01, m = 2

[0126] If it is necessary to find the dense-light boundary position in the bit stream data, the single detection result is phase-OR-fused to obtain the detection result of any window; if the detection results of a preset number of consecutive windows all indicate that the detection has failed, the dense-light boundary position in the bit stream data corresponding to the consecutive windows is found based on the binary search algorithm.

[0127] If it is necessary to find the boundary between light and dense in the bit stream data, the single detection result is ANDed and fused to obtain the detection result of any window; if the detection results of a preset number of consecutive windows all indicate that the detection has passed, the boundary between light and dense in the bit stream data corresponding to the consecutive windows is found based on the binary search algorithm.

[0128] Based on the position of the boundary between the dense and the light and the position of the boundary between the light and the dense, the light and the dense fields of the bit stream data of the bypass mirror traffic are identified.

[0129] S3, extracting the plaintext bit stream data from the bit stream data, and performing frame alignment on the plaintext bit stream data. Specifically including:

[0130] The plaintext bit stream data is subjected to sliding window processing to obtain multiple bit stream sequences, and a first candidate frame synchronization sequence is determined from the multiple bit stream sequences; based on the similarity between the first candidate frame synchronization sequences, the first candidate frame synchronization sequences are clustered to obtain multiple first sequence clusters; based on the frequency of occurrence of the longest common substring of each first sequence cluster, a frame synchronization sequence is determined from the first candidate frame synchronization sequences; based on the position of the frame synchronization sequence, the plaintext bit stream data is frame positioned.

[0131] The method provided in the embodiment of the present application can realize the identification of the plaintext and ciphertext boundary position and frame positioning of the encrypted bit stream data without the need to know the protocol format and encryption algorithm type in advance and without giving a certain frame starting position. It has a wider range of applications and greater universality.

[0132] In addition, the frame positioning method based on pattern recognition mines candidate pattern sequences from the target bit stream. Compared with the existing frequent pattern mining method that generates candidate dictionary trees by enumeration, it greatly reduces the space complexity and improves the recognition efficiency while ensuring the accuracy.

[0133] The shielding system provided by the present application is described below. The shielding system described below and the network vulnerability analysis method based on bypass mirror traffic access described above can be referenced to each other. Based on any of the above embodiments, Figure 6 It is a schematic diagram of the structure of the shielding system provided by this application, such as Figure 6 As shown, the shielding system includes a data acquisition unit 610, a sliding window detection unit 620, a position determination unit 630 and a network vulnerability analysis unit 640, wherein:

[0134] The data acquisition unit 610 is used to acquire the encrypted bit stream data of the bypass mirror traffic to be identified;

[0135] A sliding window detection unit 620, configured to perform sliding window detection processing on the bit stream data starting from the first bit of the bit stream data, wherein the detection processing includes performing randomness detection on the bit stream data in each window using a plurality of randomness detection algorithms to obtain a detection result of each window;

[0136] A position determination unit 630, configured to determine a position of a dense-light boundary and a bright-dense boundary in the bit stream data based on detection results of a preset number of consecutive windows until the window is slid to the end of the bit stream data;

[0137] The network vulnerability analysis unit 640 is used to identify the plain and secret fields of the bit stream data based on the dense-plain boundary position and the plain-crypto boundary position to obtain a network vulnerability analysis result of the bypass mirror traffic.

[0138] The shielding system provided in the embodiment of the present application performs sliding window and detection processing on the bit stream data of the bypass mirror traffic. The detection processing includes using multiple randomness detection algorithms to perform randomness detection on the bit stream data in each window to obtain the detection results of each window; based on the detection results of a preset number of consecutive windows, the dense-light boundary position and the bright-dense boundary position in the bit stream data are determined, so as to realize the recognition of the bright and dense fields of the bit stream data of the bypass mirror traffic and improve the accuracy of network vulnerability analysis.

[0139] Based on any of the foregoing embodiments, the sliding window detection unit 620 is specifically configured to:

[0140] For any window in the windows, use multiple randomness detection algorithms to perform randomness detection on the bit stream data in the window, and obtain single detection results corresponding to the multiple randomness detection algorithms respectively;

[0141] The single detection results corresponding to the multiple randomness detection algorithms are fused to obtain the detection result of any window.

[0142] Based on any of the foregoing embodiments, the sliding window detection unit 620 is further specifically configured to:

[0143] If it is necessary to find the position of the dense-light boundary in the bit stream data, perform an OR fusion operation on the single detection result to obtain the detection result of any window;

[0144] If it is necessary to find the boundary position between bright and dense in the bit stream data, an AND fusion operation is performed on the single detection result to obtain the detection result of any window.

[0145] Based on any of the above embodiments, the location determination unit 630 is specifically configured to:

[0146] If the detection results of the continuous windows all indicate that the detection has been passed, searching for the boundary position of the light and dark areas in the bit stream data corresponding to the continuous windows based on a binary search algorithm;

[0147] If the detection results of the continuous windows all indicate that the detection has not been passed, then based on a binary search algorithm, the dense-light boundary position in the bit stream data corresponding to the continuous windows is searched.

[0148] Based on any of the above embodiments, the shielding system further includes a frame alignment unit, configured to:

[0149] Extracting plaintext bit stream data from the bit stream data;

[0150] Performing sliding window processing on the plaintext bit stream data to obtain multiple bit stream sequences, and determining a first candidate frame synchronization sequence from the multiple bit stream sequences;

[0151] clustering the first candidate frame synchronization sequences based on similarities between the first candidate frame synchronization sequences to obtain a plurality of first sequence clusters;

[0152] Determining a frame synchronization sequence from each of the first candidate frame synchronization sequences based on the frequency of occurrence of the longest common substring of each of the first sequence clusters;

[0153] Based on the frame synchronization sequence, frame alignment is performed on the plaintext bit stream data.

[0154] Based on any of the above embodiments, the frame alignment unit is further specifically configured to:

[0155] Taking the longest common substring of each of the first sequence clusters as a second candidate frame synchronization sequence;

[0156] Clustering the second candidate frame synchronization sequences based on the similarities between the second candidate frame synchronization sequences to obtain a plurality of second sequence clusters;

[0157] The frame synchronization sequence is determined from each of the second candidate frame synchronization sequences based on the frequency of occurrence of the longest common substring of each second sequence cluster.

[0158] Based on any of the above embodiments, the frame alignment unit is further specifically configured to:

[0159] According to the storage order of the first candidate frame synchronization sequence, starting from the first sequence, based on the current first candidate frame synchronization sequence and the previous longest common substring, determine the current second longest common substring, and use the next sequence of the current first candidate frame synchronization sequence as the current first candidate frame synchronization sequence, until the last sequence, to obtain the longest common substring of the first sequence cluster.

[0160] Figure 7 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 7 As shown, the electronic device may include: a processor 710, a communication interface 720, a memory 730 and a communication bus 740, wherein the processor 710, the communication interface 720, and the memory 730 communicate with each other through the communication bus 740. The processor 710 may call the logic instructions in the memory 730 to execute a network vulnerability analysis method based on bypass mirror traffic access, the method comprising:

[0161] Obtaining encrypted bit stream data of bypass mirror traffic to be identified;

[0162] Starting from the first bit of the bit stream data, performing a sliding window detection process on the bit stream data, wherein the detection process includes using a plurality of randomness detection algorithms to perform randomness detection on the bit stream data in each window to obtain a detection result of each window;

[0163] Based on the detection results of a preset number of continuous windows, determine the dense-light boundary position and the bright-dense boundary position in the bit stream data until the sliding window reaches the end of the bit stream data;

[0164] Based on the position of the dense-light boundary and the position of the light-crypto boundary, the light-light and light-light fields of the bit stream data are identified to obtain a network vulnerability analysis result of the bypass mirror traffic.

[0165] In addition, the logic instructions in the above-mentioned memory 730 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art, and the computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a disk or an optical disk.

[0166] On the other hand, the present application also provides a computer program product, the computer program product includes a computer program, the computer program can be stored on a non-transitory computer-readable storage medium, and when the computer program is executed by a processor, the computer can execute the network vulnerability analysis method based on bypass mirror traffic access provided by the above methods, the method including:

[0167] Obtaining encrypted bit stream data of bypass mirror traffic to be identified;

[0168] Starting from the first bit of the bit stream data, performing a sliding window detection process on the bit stream data, wherein the detection process includes using a plurality of randomness detection algorithms to perform randomness detection on the bit stream data in each window to obtain a detection result of each window;

[0169] Based on the detection results of a preset number of continuous windows, determine the dense-light boundary position and the bright-dense boundary position in the bit stream data until the sliding window reaches the end of the bit stream data;

[0170] Based on the position of the dense-light boundary and the position of the light-crypto boundary, the light-light and light-light fields of the bit stream data are identified to obtain a network vulnerability analysis result of the bypass mirror traffic.

[0171] On the other hand, the present application also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which is implemented when the computer program is executed by a processor to execute the network vulnerability analysis method based on bypass mirror traffic access provided by the above methods, the method comprising:

[0172] Obtaining encrypted bit stream data of bypass mirror traffic to be identified;

[0173] Starting from the first bit of the bit stream data, performing a sliding window detection process on the bit stream data, wherein the detection process includes using a plurality of randomness detection algorithms to perform randomness detection on the bit stream data in each window to obtain a detection result of each window;

[0174] Based on the detection results of a preset number of continuous windows, determine the dense-light boundary position and the bright-dense boundary position in the bit stream data until the sliding window reaches the end of the bit stream data;

[0175] Based on the position of the dense-light boundary and the position of the light-crypto boundary, the light-light and light-light fields of the bit stream data are identified to obtain a network vulnerability analysis result of the bypass mirror traffic.

[0176] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0177] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0178] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A network vulnerability analysis method based on bypass mirror traffic access, characterized in that: include: Obtaining encrypted bit stream data of bypass mirror traffic to be identified; Starting from the first bit of the bit stream data, performing a sliding window detection process on the bit stream data, wherein the detection process includes using a plurality of randomness detection algorithms to perform randomness detection on the bit stream data in each window to obtain a detection result of each window; Based on the detection results of a preset number of continuous windows, determine the dense-light boundary position and the bright-dense boundary position in the bit stream data until the sliding window reaches the end of the bit stream data; Based on the position of the dense-light boundary and the position of the light-crypto boundary, the light-light and light-light fields of the bit stream data are identified to obtain a network vulnerability analysis result of the bypass mirror traffic.

2. The method according to claim 1, characterized in that The randomness detection of the bit stream data in each window is performed by using a plurality of randomness detection algorithms to obtain the detection results of each window, including: For any window in the windows, use multiple randomness detection algorithms to perform randomness detection on the bit stream data in the window, and obtain single detection results corresponding to the multiple randomness detection algorithms respectively; The single detection results corresponding to the multiple randomness detection algorithms are fused to obtain the detection result of any window.

3. The method according to claim 2, characterized in that The fusion of the single detection results corresponding to the multiple randomness detection algorithms to obtain the detection result of any window includes: If it is necessary to find the position of the dense-light boundary in the bit stream data, perform an OR fusion operation on the single detection result to obtain the detection result of any window; If it is necessary to find the boundary position between bright and dense in the bit stream data, an AND fusion operation is performed on the single detection result to obtain the detection result of any window.

4. The method according to claim 1, characterized in that The step of determining the dense-light boundary position and the bright-dense boundary position in the bit stream data based on the detection results of a preset number of continuous windows includes: If the detection results of the continuous windows all indicate that the detection has been passed, searching for the boundary position of the light and dark areas in the bit stream data corresponding to the continuous windows based on a binary search algorithm; If the detection results of the continuous windows all indicate that the detection has not been passed, then based on a binary search algorithm, the dense-light boundary position in the bit stream data corresponding to the continuous windows is searched.

5. The method according to any one of claims 1 to 4, characterized in that After the clear and secret fields of the bit stream data are identified based on the clear and secret boundary positions and the clear and secret boundary positions, and the network vulnerability analysis result of the bypass mirror traffic is obtained, the method further includes: Extracting plaintext bit stream data from the bit stream data; Performing sliding window processing on the plaintext bit stream data to obtain multiple bit stream sequences, and determining a first candidate frame synchronization sequence from the multiple bit stream sequences; clustering the first candidate frame synchronization sequences based on similarities between the first candidate frame synchronization sequences to obtain a plurality of first sequence clusters; Determining a frame synchronization sequence from each of the first candidate frame synchronization sequences based on the frequency of occurrence of the longest common substring of each of the first sequence clusters; Based on the frame synchronization sequence, frame alignment is performed on the plaintext bit stream data.

6. The method according to claim 5, characterized in that The step of determining a frame synchronization sequence from each of the first candidate frame synchronization sequences based on the frequency of occurrence of the longest common substring of each of the first sequence clusters includes: Taking the longest common substring of each of the first sequence clusters as a second candidate frame synchronization sequence; Clustering the second candidate frame synchronization sequences based on the similarities between the second candidate frame synchronization sequences to obtain a plurality of second sequence clusters; The frame synchronization sequence is determined from each of the second candidate frame synchronization sequences based on the frequency of occurrence of the longest common substring of each second sequence cluster.

7. The method according to claim 5, characterized in that The step of determining the longest common substring of the first sequence cluster comprises: According to the storage order of the first candidate frame synchronization sequence, starting from the first sequence, based on the current first candidate frame synchronization sequence and the previous longest common substring, determine the current second longest common substring, and use the next sequence of the current first candidate frame synchronization sequence as the current first candidate frame synchronization sequence, until the last sequence, to obtain the longest common substring of the first sequence cluster.

8. A shielding system, characterized in that: include: A data acquisition unit, used for acquiring encrypted bit stream data of bypass mirror traffic to be identified; A sliding window detection unit, configured to perform sliding window detection processing on the bit stream data starting from the first bit of the bit stream data, wherein the detection processing includes performing randomness detection on the bit stream data in each window using a plurality of randomness detection algorithms to obtain detection results of each window; A position determination unit, used to determine the position of the dense-light boundary and the position of the bright-dense boundary in the bit stream data based on the detection results of a preset number of continuous windows, until the sliding window reaches the end of the bit stream data; The network vulnerability analysis unit is used to identify the plain and secret fields of the bit stream data based on the dense-plain boundary position and the plain-crypto boundary position, and obtain the network vulnerability analysis result of the bypass mirror traffic.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the network vulnerability analysis method based on bypass mirror traffic access as described in any one of claims 1 to 7 is implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the network vulnerability analysis method based on bypass mirror traffic access as described in any one of claims 1 to 7 is implemented.

Images