Method, apparatus and device for blocking abnormal connection

Abstract

Embodiments of the present application provide a method, device and equipment for blocking abnormal connection. The method comprises: extracting a first source IP address and a first traffic fingerprint from a received encrypted data packet to be defended. Then, comparing the first traffic fingerprint with a traffic fingerprint in a preset self-learning fingerprint library to obtain a first comparison result; wherein the preset self-learning fingerprint library comprises a threat traffic fingerprint. Next, if the first comparison result is that the first traffic fingerprint exists in the preset self-learning fingerprint library, comparing the first source IP address with an IP address in a full-intelligence library to obtain a second comparison result; wherein the full-intelligence library comprises an abnormal and suspected abnormal IP address. If the second comparison result is that the first source IP address exists in the full-intelligence library, determining that the first source IP address is a first abnormal IP address. Further, blocking a connection request initiated by the first abnormal IP address. The method is used to achieve the effect of accurately blocking abnormal connection of the encrypted data packet.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method, apparatus and device for blocking abnormal connections. Background Technology

[0002] As cyberattack techniques continue to evolve, it becomes necessary to block abnormal connections.

[0003] In existing technologies, abnormal connections can be blocked by extracting the source IP address, destination IP address, attack payload, etc. from data packets.

[0004] However, since the encrypted attack payload cannot be extracted from the encrypted data packet, it is impossible to accurately block abnormal connections that send encrypted data packets. Summary of the Invention

[0005] This application provides a method, apparatus, and device for blocking abnormal connections, which can accurately block abnormal connections that send encrypted data packets.

[0006] In a first aspect, embodiments of this application provide a method for blocking abnormal connections, including:

[0007] The received encrypted data packet to be defended is subjected to source IP address and traffic fingerprint extraction to obtain a first source IP address and a first traffic fingerprint; wherein, the encrypted data packet to be defended includes information sent by the sender of the first source IP address based on network communication; the first traffic fingerprint is used to identify the sender device that sent the encrypted data packet to be defended;

[0008] The first traffic fingerprint is compared with the traffic fingerprints in the preset self-learning fingerprint database to obtain the first comparison result; wherein, the preset self-learning fingerprint database includes threatening traffic fingerprints.

[0009] If the first comparison result indicates that the first traffic fingerprint exists in the preset self-learning fingerprint database, then the full intelligence database is obtained, and the first source IP address is compared with the IP address in the full intelligence database to obtain the second comparison result; wherein, the full intelligence database includes abnormal IP addresses and suspected abnormal IP addresses.

[0010] If the second comparison result indicates that the first source IP address exists in the full intelligence database, then the first source IP address is determined to represent a first abnormal IP address; and the connection request initiated by the first abnormal IP address is blocked according to the encrypted data packet to be defended.

[0011] In one possible implementation, the method further includes:

[0012] The source IP address of the received encrypted data packet to be learned is extracted to obtain a second source IP address; wherein, the encrypted data packet to be learned includes information sent by the sender of the received second source IP address based on network communication; a precise intelligence database is obtained, and the second source IP address is compared with the IP addresses in the precise intelligence database to obtain a third comparison result; wherein, the precise intelligence database includes abnormal IP addresses in the full intelligence database;

[0013] If the third comparison result indicates that the second source IP address exists in the precise intelligence database, then an initial self-learning fingerprint database is obtained, and the initial self-learning fingerprint database is updated according to the encrypted data packet to be learned, to obtain the preset self-learning fingerprint database.

[0014] In one possible implementation, the initial self-learning fingerprint database is updated based on the encrypted data packet to be learned, to obtain the preset self-learning fingerprint database, including:

[0015] Traffic fingerprinting is performed on the encrypted data packets to be learned to obtain a second traffic fingerprint; wherein, the second traffic fingerprint is used to identify the sending device that sent the encrypted data packets to be learned;

[0016] If the second traffic fingerprint does not exist in the initial self-learning fingerprint database, then the second traffic fingerprint is stored in the initial self-learning fingerprint database to obtain the preset self-learning fingerprint database.

[0017] In one possible implementation, the method further includes:

[0018] If the third comparison result indicates that the second source IP address does not exist in the precise intelligence database, then the full intelligence database is obtained, and the second source IP address is compared with the IP address in the full intelligence database to obtain the fourth comparison result;

[0019] If the fourth comparison result indicates that the second source IP address exists in the full intelligence database, then the second source IP address is determined to represent a second abnormal IP address; and the connection initiated by the second abnormal IP address is blocked according to the encrypted data packet to be learned.

[0020] In one possible implementation, based on the encrypted data packet to be learned, the connection initiated by the second abnormal IP address is blocked, including:

[0021] Based on the encrypted data packet to be learned, a third closing data packet and a fourth closing data packet are generated; wherein, the third closing data packet is used to notify the sender of the second abnormal IP address to stop sending connection requests; the fourth closing data packet is used to notify to stop receiving connection requests sent by the sender of the second abnormal IP address;

[0022] The third close packet is sent to the sender of the second abnormal IP address to stop sending connection requests sent by the sender of the second abnormal IP address;

[0023] Simulate receiving the fourth close data packet sent by the sender of the second abnormal IP address, and stop receiving connection requests sent by the sender of the second abnormal IP address.

[0024] In one possible implementation, the method of blocking connection requests initiated by the first abnormal IP address based on the encrypted data packet to be defended includes:

[0025] Based on the encrypted data packet to be defended, a first shutdown data packet and a second shutdown data packet are generated; wherein, the first shutdown data packet is used to notify the sender of the first abnormal IP address to stop sending connection requests; the second shutdown data packet is used to notify to stop receiving connection requests sent by the sender of the first abnormal IP address;

[0026] Send the first close data packet to the sender of the first abnormal IP address, and stop sending connection requests sent by the sender of the first abnormal IP address;

[0027] Simulate receiving the second close data packet sent by the sender of the first abnormal IP address, and stop receiving connection requests sent by the sender of the first abnormal IP address.

[0028] Secondly, embodiments of this application provide an abnormal connection blocking device, comprising:

[0029] An extraction module is used to extract the source IP address and traffic fingerprint of the received encrypted data packet to be defended, to obtain a first source IP address and a first traffic fingerprint; wherein, the encrypted data packet to be defended includes information sent by the sender of the first source IP address based on network communication; the first traffic fingerprint is used to identify the sender device that sent the encrypted data packet to be defended;

[0030] The first comparison module is used to compare the first traffic fingerprint with the traffic fingerprint in a preset self-learning fingerprint database to obtain a first comparison result; wherein, the preset self-learning fingerprint database includes threatening traffic fingerprints.

[0031] The second comparison module is used to obtain the full intelligence database if the first comparison result indicates that the first traffic fingerprint exists in the preset self-learning fingerprint database, and compare the first source IP address with the IP address in the full intelligence database to obtain the second comparison result; wherein, the full intelligence database includes abnormal IP addresses and suspected abnormal IP addresses.

[0032] The determination module is used to determine that the first source IP address represents a first abnormal IP address if the second comparison result indicates that the first source IP address exists in the full intelligence database.

[0033] The blocking module is used to block connection requests initiated by the first abnormal IP address based on the encrypted data packet to be defended.

[0034] In one possible implementation, the device is further configured to:

[0035] The source IP address of the received encrypted data packet to be learned is extracted to obtain a second source IP address; wherein, the encrypted data packet to be learned includes information sent by the sender of the received second source IP address based on network communication; a precise intelligence database is obtained, and the second source IP address is compared with the IP addresses in the precise intelligence database to obtain a third comparison result; wherein, the precise intelligence database includes abnormal IP addresses in the full intelligence database;

[0036] If the third comparison result indicates that the second source IP address exists in the precise intelligence database, then an initial self-learning fingerprint database is obtained, and the initial self-learning fingerprint database is updated according to the encrypted data packet to be learned, to obtain the preset self-learning fingerprint database.

[0037] In one possible implementation, the function of the device to "update the initial self-learning fingerprint database according to the encrypted data packet to be learned, and obtain the preset self-learning fingerprint database" is specifically used for:

[0038] Traffic fingerprinting is performed on the encrypted data packets to be learned to obtain a second traffic fingerprint; wherein, the second traffic fingerprint is used to identify the sending device that sent the encrypted data packets to be learned;

[0039] If the second traffic fingerprint does not exist in the initial self-learning fingerprint database, then the second traffic fingerprint is stored in the initial self-learning fingerprint database to obtain the preset self-learning fingerprint database.

[0040] In one possible implementation, the device is further configured to:

[0041] If the third comparison result indicates that the second source IP address does not exist in the precise intelligence database, then the full intelligence database is obtained, and the second source IP address is compared with the IP address in the full intelligence database to obtain the fourth comparison result;

[0042] If the fourth comparison result indicates that the second source IP address exists in the full intelligence database, then the second source IP address is determined to represent a second abnormal IP address; and the connection initiated by the second abnormal IP address is blocked according to the encrypted data packet to be learned.

[0043] In one possible implementation, the function of "blocking connections initiated by the second abnormal IP address based on the encrypted data packet to be learned" in the device is specifically used for:

[0044] Based on the encrypted data packet to be learned, a third closing data packet and a fourth closing data packet are generated; wherein, the third closing data packet is used to notify the sender of the second abnormal IP address to stop sending connection requests; the fourth closing data packet is used to notify to stop receiving connection requests sent by the sender of the second abnormal IP address;

[0045] The third close packet is sent to the sender of the second abnormal IP address to stop sending connection requests sent by the sender of the second abnormal IP address;

[0046] Simulate receiving the fourth close data packet sent by the sender of the second abnormal IP address, and stop receiving connection requests sent by the sender of the second abnormal IP address.

[0047] In one possible implementation, the blocking module is specifically used for:

[0048] Based on the encrypted data packet to be defended, a first shutdown data packet and a second shutdown data packet are generated; wherein, the first shutdown data packet is used to notify the sender of the first abnormal IP address to stop sending connection requests; the second shutdown data packet is used to notify to stop receiving connection requests sent by the sender of the first abnormal IP address;

[0049] Send the first close data packet to the sender of the first abnormal IP address, and stop sending connection requests sent by the sender of the first abnormal IP address;

[0050] Simulate receiving the second close data packet sent by the sender of the first abnormal IP address, and stop receiving connection requests sent by the sender of the first abnormal IP address.

[0051] Thirdly, embodiments of this application provide an electronic device, including: a memory and a processor;

[0052] The memory stores computer-executed instructions;

[0053] The processor executes computer execution instructions stored in the memory, causing the processor to perform the first aspect and / or various possible implementations of the first aspect as described above.

[0054] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the first aspect and / or various possible implementations of the first aspect.

[0055] Fifthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the first aspect and / or various possible implementations of the first aspect.

[0056] The abnormal connection blocking method, apparatus, and device provided in this application extract a first source IP address and a first traffic fingerprint from a received encrypted data packet to be defended. The encrypted data packet to be defended includes information sent by the sender of the first source IP address based on network communication; the first traffic fingerprint is used to identify the sending device of the encrypted data packet to be defended. Then, the first traffic fingerprint is compared with traffic fingerprints in a preset self-learning fingerprint database to obtain a first comparison result; the preset self-learning fingerprint database includes threatening traffic fingerprints. Next, if the first comparison result indicates that the first traffic fingerprint exists in the preset self-learning fingerprint database, a full intelligence database is obtained, and the first source IP address is compared with IP addresses in the full intelligence database to obtain a second comparison result; the full intelligence database includes abnormal IP addresses and suspected abnormal IP addresses. If the second comparison result indicates that the first source IP address exists in the full intelligence database, the first source IP address is determined to be a first abnormal IP address. Furthermore, based on the encrypted data packet to be defended, connection requests initiated by the first abnormal IP address are blocked.

[0057] Since the preset self-learning fingerprint database includes threatening traffic fingerprints, and the full intelligence database includes abnormal IP addresses and suspected abnormal IP addresses, when both the first traffic fingerprint extracted from the encrypted data packet to be defended is in the preset self-learning fingerprint database and the first source IP address extracted from the encrypted data packet to be defended is in the full intelligence database, blocking the connection initiated by the sender of the first source IP address can more accurately block abnormal connections sending encrypted data packets to be defended. Attached Figure Description

[0058] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0059] Figure 1 A flowchart illustrating a method for blocking abnormal connections provided in this application;

[0060] Figure 2 A flowchart illustrating another method for blocking abnormal connections provided in this application;

[0061] Figure 3 A schematic diagram of the structural device for blocking abnormal connections provided in this application;

[0062] Figure 4 A schematic diagram of the structure of the electronic device provided in this application.

[0063] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0064] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0065] In recent years, many sophisticated network attack methods have emerged (such as HTTPS instant dialing attacks), so it is necessary to block abnormal connections to ensure security.

[0066] In one example, an abnormal connection can be blocked by identifying the source IP address, destination IP address, and attack payload in the data packet.

[0067] However, in the above method, since the attack payload in the encrypted data packet is encrypted, it is impossible to identify the attack payload from the encrypted data packet, and therefore, it is impossible to accurately block the abnormal connection of the encrypted data packet.

[0068] This application provides a method, apparatus, and device for blocking abnormal connections to solve the above-mentioned technical problems.

[0069] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0070] Figure 1 A flowchart illustrating a method for blocking abnormal connections provided in this application is shown below. Figure 1 As shown, the method includes:

[0071] S101. Extract the source IP address and traffic fingerprint of the received encrypted data packet to be defended to obtain the first source IP address and the first traffic fingerprint; wherein, the encrypted data packet to be defended includes information sent by the sender of the first source IP address based on network communication; the first traffic fingerprint is used to identify the sender device that sent the encrypted data packet to be defended.

[0072] For example, the executing entity of this embodiment can be any device among servers, distributed systems, terminal devices, other electronic devices / computer devices, and other apparatuses or devices that can implement the solution of this application, without limitation. The server can be a standalone server or a server cluster, such as, but not limited to, any form including cloud servers, distributed servers, blockchain servers, etc.

[0073] This embodiment uses the server as the executing entity for description.

[0074] For example, the encrypted data packet to be defended can be understood as an encrypted data packet sent by a client or other sender and received by the server. This encrypted data packet may be abnormal or legitimate. There may be one or more encrypted data packets to be defended. In this embodiment, there is no limitation on the sender of the encrypted data packet to be defended or the number of encrypted data packets to be defended. If several encrypted data packets to be defended are received, then based on the order of receipt, each encrypted data packet to be defended can be processed according to steps S101-S105.

[0075] In the encrypted data packet to be defended, although the actual data to be transmitted (such as file content, message content, etc.) is encrypted, the header information (such as source IP address, etc.) is not encrypted. Therefore, the server can extract the first source IP address from the received encrypted data packet to be defended. The first source IP address can be understood as the IP address of the sender of the encrypted data packet to be defended.

[0076] The server can also extract the first traffic fingerprint by analyzing the size, sending frequency, protocol type, port number, and other characteristics of the encrypted data packets to be defended. The first traffic fingerprint can uniquely identify the device that sent the encrypted data packets to be defended, and the first traffic fingerprint will not change even if the IP address of the sending device changes.

[0077] S102. The first traffic fingerprint is compared with the traffic fingerprint in the preset self-learning fingerprint database to obtain the first comparison result; wherein, the preset self-learning fingerprint database includes threatening traffic fingerprints.

[0078] For example, the preset self-learning fingerprint database can be understood as a database that can continuously collect threatening traffic fingerprints through continuous learning. The threatening traffic fingerprint can be understood as a connection request from a sender with that traffic fingerprint to send an encrypted data packet to be defended, which may be an abnormal connection request.

[0079] The first comparison result could be, for example, that the first traffic fingerprint exists in the preset self-learning fingerprint database, or that the first traffic fingerprint does not exist in the preset self-learning fingerprint database.

[0080] S103. If the first comparison result indicates that the first traffic fingerprint exists in the preset self-learning fingerprint database, then the full intelligence database is obtained, and the first source IP address is compared with the IP address in the full intelligence database to obtain the second comparison result; wherein, the full intelligence database includes abnormal IP addresses and suspected abnormal IP addresses.

[0081] For example, a full intelligence database can download abnormal IP addresses and suspected abnormal IP addresses from a public threat intelligence platform, or identify abnormal activity and extract abnormal IP addresses and suspected abnormal IP addresses by analyzing network logs, security logs, etc. Among them, abnormal IP addresses have high credibility, and connection requests initiated by abnormal IP addresses are likely to be abnormal connections; suspected abnormal IP addresses have low credibility, and connection requests initiated by suspected abnormal IP addresses may be abnormal connections or legitimate connections.

[0082] If the first comparison result indicates that the first traffic fingerprint exists in the preset self-learning fingerprint database, it means that the connection request from the sender with the first traffic fingerprint to send the encrypted data packet to be defended may be an abnormal connection request. However, to avoid false positives, the server can also compare the first source IP address with the IP addresses in the obtained full intelligence database to obtain a second comparison result. The second comparison result could be, for example, that the first source IP address exists in the full intelligence database, or that the first source IP address does not exist in the full intelligence database.

[0083] If the first comparison result indicates that the first traffic fingerprint does not exist in the preset self-learning fingerprint database, it means that the connection request sent by the sender with the first traffic fingerprint to send the encrypted data packet to be defended is legitimate and can be allowed.

[0084] S104. If the second comparison result indicates that the first source IP address exists in the full intelligence database, then the first source IP address is determined to represent the first abnormal IP address.

[0085] For example, if the first comparison result is that the first traffic fingerprint exists in the preset self-learning fingerprint database, and the second comparison result is that the first source IP address exists in the full intelligence database, it means that the first traffic fingerprint of the sender of the encrypted data packet to be defended is threatening, and the first source IP address of the sender of the encrypted data packet to be defended is also an abnormal or suspected abnormal IP address. In this case, the first source IP address is determined as the first abnormal IP address. The first abnormal IP address can be understood, for example, as the IP address that sends an abnormal connection to the server.

[0086] If the second comparison result shows that the first source IP address does not exist in the full intelligence database, it means that although the first traffic fingerprint of the sender of the encrypted data packet to be defended is threatening, the first source IP address of the sender of the encrypted data packet to be defended is legitimate. Therefore, the connection request of the sender of the first source IP address to send the encrypted data packet to be defended is legitimate and can be allowed.

[0087] S105. Based on the encrypted data packet to be defended, block the connection request initiated by the first abnormal IP address.

[0088] For example, after determining that the first source IP address represents the first abnormal IP address, the connection request initiated by the first abnormal IP address can be blocked based on the encrypted data packet to be defended through the Intrusion Prevention System (IPS).

[0089] The abnormal connection blocking method provided in this application extracts a first source IP address and a first traffic fingerprint from the received encrypted data packet to be defended. The encrypted data packet includes information sent by the sender of the first source IP address via network communication; the first traffic fingerprint is used to identify the sending device of the encrypted data packet. Then, the first traffic fingerprint is compared with traffic fingerprints in a preset self-learning fingerprint database to obtain a first comparison result; the preset self-learning fingerprint database includes threatening traffic fingerprints. Next, if the first comparison result indicates that the first traffic fingerprint exists in the preset self-learning fingerprint database, a full intelligence database is obtained, and the first source IP address is compared with IP addresses in the full intelligence database to obtain a second comparison result; the full intelligence database includes abnormal IP addresses and suspected abnormal IP addresses. If the second comparison result indicates that the first source IP address exists in the full intelligence database, the first source IP address is determined to be a first abnormal IP address. Furthermore, based on the encrypted data packet to be defended, connection requests initiated by the first abnormal IP address are blocked.

[0090] Since the preset self-learning fingerprint database includes threatening traffic fingerprints, and the full intelligence database includes abnormal IP addresses and suspected abnormal IP addresses, when both the first traffic fingerprint extracted from the encrypted data packet to be defended is in the preset self-learning fingerprint database and the first source IP address extracted from the encrypted data packet to be defended is in the full intelligence database, blocking the connection initiated by the sender of the first source IP address can more accurately block abnormal connections sending encrypted data packets to be defended.

[0091] Figure 2 A flowchart illustrating another method for blocking abnormal connections provided in this application is shown below. Figure 2 As shown, in this embodiment... Figure 1 Based on the embodiments, the method for blocking abnormal connections is described in detail, which includes:

[0092] S201. Extract the source IP address from the received encrypted data packet to be learned to obtain the second source IP address; wherein, the encrypted data packet to be learned includes information sent by the sender of the received second source IP address based on network communication.

[0093] For example, the executing entity of this embodiment can be any device among servers, distributed systems, terminal devices, other electronic devices / computer devices, and other apparatuses or devices that can implement the solution of this application, without limitation. The server can be a standalone server or a server cluster, such as, but not limited to, any form including cloud servers, distributed servers, blockchain servers, etc.

[0094] This embodiment uses the server as the executing entity for description.

[0095] For example, this embodiment is divided into a learning phase and a defense phase. Steps S201-206 are the learning phase, used to update the threatening traffic fingerprints in the initial self-learning fingerprint database based on the encrypted data packets to be learned, to obtain a preset self-learning fingerprint database, and to block connection requests initiated by the source IP address of the sender of the encrypted data packets to be learned that are not in the precise intelligence database but are in the full intelligence database. Steps S207-S211 are the defense phase, used to block connection requests initiated by the source IP address of the sender of the encrypted data packets to be defended that are in the preset self-learning fingerprint database and whose source IP address is in the full intelligence database.

[0096] The server can first execute a learning phase. Once the preset self-learning fingerprint database meets the preset conditions, the defense phase can then begin. Subsequently, the learning and defense phases can run in parallel, thereby continuously updating the threatening traffic fingerprints in the preset self-learning fingerprint database and using them in the defense phase to more accurately block abnormal connections initiated by abnormal IP addresses.

[0097] The preset conditions can be, for example, reaching a preset first number of traffic fingerprints in a preset self-learning fingerprint database; or, within a preset time period, the change in the number of traffic fingerprints in the preset self-learning fingerprint database is less than a preset second number, etc. The preset conditions are set here to obtain a preset self-learning fingerprint database for the defense phase. This embodiment does not limit the preset conditions; they can be determined according to actual needs, as long as a preset self-learning fingerprint database can be obtained for blocking abnormal connections during the prevention phase.

[0098] In step S201, the encrypted data packet to be learned is similar to the encrypted data packet to be defended in step S101. For details, please refer to the description of the encrypted data packet to be defended in step S101. The difference is that the encrypted data packet to be learned is used in the learning phase, while the encrypted data packet to be defended is used in the defense phase.

[0099] The encrypted data packet to be learned can be one or more. In this embodiment, there is no limitation on the sender of the encrypted data packet to be learned or the number of encrypted data packets to be learned. If several encrypted data packets to be learned are received, then based on the order of receipt, each encrypted data packet to be learned can be processed according to steps S201-S206.

[0100] The encrypted data packets to be learned and the encrypted data packets to be defended can be the same or different, or partially the same or partially different. This embodiment does not impose any restrictions on this.

[0101] Similar to the encrypted data packet to be defended described in step S101, the server can extract the second source IP address from the received encrypted data packet to be learned. The second source IP address can be understood as the IP address of the sender of the encrypted data packet to be learned.

[0102] S202. Obtain the precise intelligence database and compare the second source IP address with the IP address in the precise intelligence database to obtain the third comparison result; wherein, the precise intelligence database includes abnormal IP addresses in the full intelligence database.

[0103] For example, after obtaining the second source IP address, the server can retrieve a precise intelligence database and compare the second source IP address with the IP addresses in the precise intelligence database to obtain a third comparison result. The precise intelligence database can, for example, contain anomalous IP addresses obtained from the full intelligence database. The third comparison result can be, for example, that the second source IP address exists in the precise intelligence database, or that the second source IP address does not exist in the precise intelligence database.

[0104] S203. If the third comparison result indicates that the second source IP address exists in the accurate intelligence database, then the initial self-learning fingerprint database is obtained, and the initial self-learning fingerprint database is updated according to the encrypted data packet to be learned, so as to obtain the preset self-learning fingerprint database.

[0105] In one example, step S203, "updating the initial self-learning fingerprint database based on the encrypted data packet to be learned, to obtain a preset self-learning fingerprint database," includes the following process:

[0106] Traffic fingerprinting is performed on the encrypted data packets to be learned to obtain a second traffic fingerprint; the second traffic fingerprint is used to identify the sending device that sent the encrypted data packets to be learned.

[0107] If the second traffic fingerprint does not exist in the initial self-learning fingerprint database, then the second traffic fingerprint is stored in the initial self-learning fingerprint database to obtain the preset self-learning fingerprint database.

[0108] For example, when the server receives the first encrypted data packet to be learned and executes step S203, the initial self-learning fingerprint database may be empty, or it may contain threatening traffic fingerprints obtained through other means and stored in advance. This embodiment does not limit this. When the server receives the second and subsequent encrypted data packets to be learned and executes step S203, the initial self-learning fingerprint database may be understood as the latest preset self-learning fingerprint database up to the present.

[0109] In one example, if the third comparison result shows that the second source IP address exists in the precise intelligence database, it means that the second source IP address that sent the encrypted data packet to be learned is an abnormal IP address. This can also be understood as the traffic fingerprint of the sender of the encrypted data packet to be learned being a threatening traffic fingerprint, which needs to be added to the initial self-learning fingerprint database.

[0110] Specifically, the server can obtain an initial self-learning fingerprint database. It then extracts the second traffic fingerprint from the encrypted data packet to be learned, and determines whether the second traffic fingerprint exists in the initial self-learning fingerprint database. If it does not exist, the second traffic fingerprint is stored in the initial self-learning fingerprint database to obtain a preset self-learning fingerprint database; if it exists, it means that the second traffic fingerprint is already in the initial self-learning fingerprint database and does not need to be added again.

[0111] By learning the received encrypted data packets to be learned in step S203, the server can continuously update the initial self-learning fingerprint database and obtain a preset self-learning fingerprint database.

[0112] S204. If the third comparison result indicates that the second source IP address does not exist in the precise intelligence database, then obtain the full intelligence database and compare the second source IP address with the IP address in the full intelligence database to obtain the fourth comparison result.

[0113] For example, if the third comparison result indicates that the second source IP address does not exist in the precise intelligence database, it means that the second source IP address sending the encrypted data packet to be learned is not an abnormal IP address. However, this does not mean that the second source IP address is necessarily a legitimate IP address. The server can also obtain the full intelligence database and compare the second source IP address with the IP addresses in the full intelligence database to obtain the fourth comparison result. The method for obtaining the full intelligence database can be found in step S103, and will not be repeated here. The fourth comparison result may be, for example, that the second source IP address exists in the full intelligence database, or that the second source IP address does not exist in the full intelligence database.

[0114] S205. If the fourth comparison result indicates that the second source IP address exists in the full intelligence database, then the second source IP address is determined to represent the second abnormal IP address.

[0115] For example, if the third comparison result is that the second source IP address does not exist in the precise intelligence database, and the fourth comparison result is that the second source IP address exists in the full intelligence database, then it is indicated that the second source IP address is a suspected abnormal IP address. In this case, the second source IP address is determined as the second abnormal IP address. The second abnormal IP address can be understood, for example, as an IP address suspected of sending an abnormal connection to the server.

[0116] If the third comparison result shows that the second source IP address does not exist in the precise intelligence database, and the fourth comparison result shows that the second source IP address does not exist in the full intelligence database, then the second source IP address is a legitimate IP address and can be allowed to proceed.

[0117] S206. Based on the encrypted data packet to be learned, block the connection initiated by the second abnormal IP address.

[0118] In one example, step S206 includes the following process:

[0119] Based on the encrypted data packet to be learned, a third and a fourth close data packet are generated; the third close data packet is used to notify the sender of the second abnormal IP address to stop sending connection requests; the fourth close data packet is used to notify to stop receiving connection requests sent by the sender of the second abnormal IP address.

[0120] Send the third close packet to the sender of the second abnormal IP address and stop sending connection requests sent by the sender of the second abnormal IP address;

[0121] Simulate receiving the fourth close packet from the sender of the second abnormal IP address, and stop receiving connection requests from the sender of the second abnormal IP address.

[0122] For example, after determining that the second source IP address represents the second abnormal IP address, the server can block the abnormal connection initiated by the second source IP address.

[0123] For example, a server can extract the destination IP address, which is the server's IP address, from the encrypted data packet to be learned. Assume the server's IP address in the encrypted data packet to be learned is F, and the second source IP address is K. Based on the server's IP address F and the second source IP address K, the server generates a third and a fourth close data packet. The third close data packet has the server's IP address F as the source IP address and the second source IP address K as the destination IP address. This third close data packet can be used to notify the sender at the second source IP address K to stop sending connection requests to the server. The third close data packet can be, for example, a reset packet (RST packet) or a finish packet (FIN packet).

[0124] The source IP address in the fourth close packet is the second source IP address K, and the destination IP address is the server's IP address F. This fourth close packet can be used to notify the server to stop receiving connection requests sent by the sender at the second source IP address K. The fourth close packet can be, for example, a reset packet (RST packet) or a finish packet (FIN packet).

[0125] Next, the server sends the third close packet to the sender at the second source IP address K. After receiving the third close packet, the sender at the second source IP address K stops sending connection requests to the server.

[0126] The server simulates the sender of the second source IP address K and sends a fourth close packet to the server. After receiving the simulated fourth close packet, the server stops receiving connection requests from the sender of the second source IP address K.

[0127] S207. Extract the source IP address and traffic fingerprint of the received encrypted data packet to be defended to obtain the first source IP address and the first traffic fingerprint; wherein, the encrypted data packet to be defended includes information sent by the sender of the first source IP address based on network communication; the first traffic fingerprint is used to identify the sender device that sent the encrypted data packet to be defended.

[0128] For example, step S207 is implemented in the same way as step S101. For a detailed description, please refer to step S101, which will not be repeated here.

[0129] S208. The first traffic fingerprint is compared with the traffic fingerprint in the preset self-learning fingerprint database to obtain the first comparison result; wherein, the preset self-learning fingerprint database includes threatening traffic fingerprints.

[0130] For example, step S208 is implemented in the same way as step S102. For a detailed description, please refer to step S102, which will not be repeated here.

[0131] S209. If the first comparison result indicates that the first traffic fingerprint exists in the preset self-learning fingerprint database, then the full intelligence database is obtained, and the first source IP address is compared with the IP address in the full intelligence database to obtain the second comparison result; wherein, the full intelligence database includes abnormal IP addresses and suspected abnormal IP addresses.

[0132] For example, step S209 is implemented in the same way as step S103. For a detailed description, please refer to step S103, which will not be repeated here.

[0133] S210. If the second comparison result indicates that the first source IP address exists in the full intelligence database, then the first source IP address is determined to represent the first abnormal IP address.

[0134] For example, step S210 is implemented in the same way as step S104. For a detailed description, please refer to step S104, which will not be repeated here.

[0135] S211. Based on the encrypted data packet to be defended, block the connection request initiated by the first abnormal IP address.

[0136] In one example, step S211 includes the following process:

[0137] Based on the encrypted data packet to be defended, a first closing data packet and a second closing data packet are generated; wherein, the first closing data packet is used to notify the sender of the first abnormal IP address to stop sending connection requests; the second closing data packet is used to notify to stop receiving connection requests sent by the sender of the first abnormal IP address;

[0138] Send the first close packet to the sender of the first abnormal IP address, and stop sending connection requests sent by the sender of the first abnormal IP address;

[0139] Simulate receiving a second close packet from the sender of the first abnormal IP address, and stop receiving connection requests from the sender of the first abnormal IP address.

[0140] For example, after determining that the first source IP address represents the first abnormal IP address, the server can block the abnormal connection initiated by the first source IP address.

[0141] For example, a server can extract the destination IP address, i.e., the server's IP address, from the encrypted data packet to be defended. Assuming the server's IP address in the encrypted data packet to be defended is W, and the first source IP address is H, the server generates a first close packet and a second close packet based on the server's IP address W and the first source IP address H. The first close packet contains the server's IP address W as the source IP address and the first source IP address H as the destination IP address. This first close packet can be used to notify the sender at the first source IP address H to stop sending connection requests to the server. The first close packet can be, for example, a reset packet (RST packet) or a finish packet (FIN packet).

[0142] The source IP address in the second close packet is the first source IP address H, and the destination IP address is the server's IP address W. This second close packet can be used to notify the server to stop receiving connection requests sent by the sender at the first source IP address H. The second close packet can be, for example, a reset packet (RST packet) or a finish packet (FIN packet).

[0143] Next, the server sends the first close packet to the sender at the first source IP address H. After receiving the first close packet, the sender at the first source IP address H stops sending connection requests to the server.

[0144] The server simulates the sender of the first source IP address H and sends a second close packet to the server. After receiving the simulated second close packet, the server stops receiving connection requests from the sender of the first source IP address H.

[0145] The abnormal connection blocking method provided in this application embodiment extracts a second source IP address from the encrypted data packet to be learned. If the second source IP address exists in the accurate intelligence database, a second traffic fingerprint is extracted from the encrypted data packet to be learned, and the second traffic fingerprint is updated to the initial self-learning fingerprint database to obtain a preset self-learning fingerprint database.

[0146] This process enables continuous learning of threatening traffic fingerprints from encrypted data packets to be learned, updating the initial self-learning fingerprint database and obtaining a preset self-learning fingerprint database containing more threatening traffic fingerprints. Subsequently, in the defense phase, the abnormal connections can be blocked more accurately based on the preset self-learning fingerprint database containing more threatening traffic fingerprints.

[0147] During the learning phase, if the second source IP address does not exist in the precise intelligence database but exists in the full intelligence database, the connection request sent by the sender of the second source IP address will be blocked, thus blocking abnormal connections from suspected abnormal IP addresses.

[0148] During the learning phase, by generating third and fourth close packets and sending them to the network, the server and the sender can simulate sending each other notifications to stop the connection, thereby accurately blocking the abnormal connection initiated by the sender of the second source IP address.

[0149] During the defense phase, by generating a first close packet and a second close packet and sending them to the network, it is possible to simulate the server and the sender sending each other a notification to stop the connection, thereby accurately blocking the abnormal connection initiated by the sender of the first source IP address.

[0150] Figure 3 A schematic diagram of the structure of the abnormal connection blocking device provided in this application is shown below. Figure 3 As shown, the abnormal connection blocking device 30 provided in this embodiment includes:

[0151] Extraction module 301 is used to extract the source IP address and traffic fingerprint of the received encrypted data packet to be defended, and obtain the first source IP address and the first traffic fingerprint; wherein, the encrypted data packet to be defended includes information sent by the sender of the first source IP address based on network communication; the first traffic fingerprint is used to identify the sender device that sent the encrypted data packet to be defended;

[0152] The first comparison module 302 is used to compare the first traffic fingerprint with the traffic fingerprint in the preset self-learning fingerprint database to obtain the first comparison result; wherein, the preset self-learning fingerprint database includes threatening traffic fingerprints.

[0153] The second comparison module 303 is used to obtain the full intelligence database if the first comparison result indicates that the first traffic fingerprint exists in the preset self-learning fingerprint database, and compare the first source IP address with the IP address in the full intelligence database to obtain the second comparison result; wherein, the full intelligence database includes abnormal IP addresses and suspected abnormal IP addresses.

[0154] The determination module 304 is used to determine that the first source IP address represents the first abnormal IP address if the second comparison result indicates that the first source IP address exists in the full intelligence database.

[0155] The blocking module 305 is used to block connection requests initiated by the first abnormal IP address based on the encrypted data packet to be defended.

[0156] In one possible implementation, the device 30 is further configured to:

[0157] The source IP address is extracted from the received encrypted data packet to be learned to obtain the second source IP address; the encrypted data packet to be learned includes information sent by the sender of the received second source IP address based on network communication; a precise intelligence database is obtained, and the second source IP address is compared with the IP addresses in the precise intelligence database to obtain the third comparison result; the precise intelligence database includes abnormal IP addresses in the full intelligence database.

[0158] If the third comparison result indicates that the second source IP address exists in the accurate intelligence database, then the initial self-learning fingerprint database is obtained, and the initial self-learning fingerprint database is updated according to the encrypted data packet to be learned, so as to obtain the preset self-learning fingerprint database.

[0159] In one possible implementation, the function of device 30, "updating the initial self-learning fingerprint database according to the encrypted data packet to be learned, to obtain a preset self-learning fingerprint database," is specifically used for:

[0160] Traffic fingerprinting is performed on the encrypted data packets to be learned to obtain a second traffic fingerprint; the second traffic fingerprint is used to identify the sending device that sent the encrypted data packets to be learned.

[0161] If the second traffic fingerprint does not exist in the initial self-learning fingerprint database, then the second traffic fingerprint is stored in the initial self-learning fingerprint database to obtain the preset self-learning fingerprint database.

[0162] In one possible implementation, the device 30 is further configured to:

[0163] If the third comparison result indicates that the second source IP address does not exist in the precise intelligence database, then the full intelligence database is obtained, and the second source IP address is compared with the IP address in the full intelligence database to obtain the fourth comparison result;

[0164] If the fourth comparison result indicates that the second source IP address exists in the full intelligence database, then the second source IP address is determined to be the second abnormal IP address; and the connection initiated by the second abnormal IP address is blocked according to the encrypted data packet to be learned.

[0165] In one possible implementation, the "blocking of connections initiated by the second abnormal IP address based on the encrypted data packet to be learned" in device 30 is specifically used for:

[0166] Based on the encrypted data packet to be learned, a third and a fourth close data packet are generated; the third close data packet is used to notify the sender of the second abnormal IP address to stop sending connection requests; the fourth close data packet is used to notify to stop receiving connection requests sent by the sender of the second abnormal IP address.

[0167] Send the third close packet to the sender of the second abnormal IP address and stop sending connection requests sent by the sender of the second abnormal IP address;

[0168] Simulate receiving the fourth close packet from the sender of the second abnormal IP address, and stop receiving connection requests from the sender of the second abnormal IP address.

[0169] In one possible implementation, the blocking module 305 is specifically used for:

[0170] Based on the encrypted data packet to be defended, a first closing data packet and a second closing data packet are generated; wherein, the first closing data packet is used to notify the sender of the first abnormal IP address to stop sending connection requests; the second closing data packet is used to notify to stop receiving connection requests sent by the sender of the first abnormal IP address;

[0171] Send the first close packet to the sender of the first abnormal IP address, and stop sending connection requests sent by the sender of the first abnormal IP address;

[0172] Simulate receiving a second close packet from the sender of the first abnormal IP address, and stop receiving connection requests from the sender of the first abnormal IP address.

[0173] The abnormal connection blocking device provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and will not be described in detail here.

[0174] Figure 4 A schematic diagram of the structure of the electronic device provided in this application. Figure 4 As shown, the electronic device 40 provided in this embodiment includes at least one processor 401 and a memory 402. Optionally, the device 40 further includes a communication component 403. The processor 401, memory 402, and communication component 403 are connected via a bus 404.

[0175] In a specific implementation, at least one processor 401 executes computer execution instructions stored in memory 402, causing at least one processor 401 to perform the above-described method.

[0176] The specific implementation process of processor 401 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.

[0177] In the above embodiments, it should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.

[0178] The memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage device.

[0179] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0180] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0181] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the above-described method.

[0182] The aforementioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.

[0183] An exemplary readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and the readable storage medium can exist as discrete components in the device.

[0184] The division of units is merely a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0185] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0186] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0187] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0188] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0189] Finally, it should be noted that other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This invention is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein, and is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of the invention is limited only by the appended claims.

Claims

1. A method of blocking an abnormal connection, characterized by, The method comprises: The method comprises: If the third comparison result indicates that the second source IP address exists in the precise intelligence library, an initial self-learning fingerprint library is obtained, and traffic fingerprint extraction is performed on the encrypted data packet to be learned to obtain a second traffic fingerprint; wherein the second traffic fingerprint is used to identify the sender device that sends the encrypted data packet to be learned; if the second traffic fingerprint does not exist in the initial self-learning fingerprint library, the second traffic fingerprint is stored in the initial self-learning fingerprint library to obtain a preset self-learning fingerprint library; The method comprises: If the first comparison result indicates that the first traffic fingerprint exists in the preset self-learning fingerprint library, a full-amount intelligence library is obtained, and the first source IP address is compared with the IP addresses in the full-amount intelligence library to obtain a second comparison result; wherein the full-amount intelligence library includes abnormal IP addresses and suspected abnormal IP addresses; If the second comparison result indicates that the first source IP address exists in the full-amount intelligence library, it is determined that the first source IP address represents a first abnormal IP address; and according to the encrypted data packet to be defended, a blocking process is performed on the connection request initiated by the first abnormal IP address. The method further comprises:

2. The method of claim 1, wherein, If the third comparison result indicates that the second source IP address does not exist in the precise intelligence library, a full-amount intelligence library is obtained, and the second source IP address is compared with the IP addresses in the full-amount intelligence library to obtain a fourth comparison result; ​ If the fourth comparison result represents that the second source IP address exists in the full information base, it is determined that the second source IP address represents a second abnormal IP address; and a connection initiated by the second abnormal IP address is blocked according to the to-be-learned encrypted data packet.

3. The method of claim 2, wherein, According to the to-be-learned encrypted data packet, the connection initiated by the second abnormal IP address is blocked, including: According to the to-be-learned encrypted data packet, a third closing data packet and a fourth closing data packet are generated; wherein the third closing data packet is used to notify a sender of the second abnormal IP address to stop sending a connection request; and the fourth closing data packet is used to notify to stop receiving the connection request sent by the sender of the second abnormal IP address; The third closing data packet is sent to the sender of the second abnormal IP address, and the connection request sent by the sender of the second abnormal IP address is stopped from being sent. The fourth closing data packet sent by the sender of the second abnormal IP address is simulated to be received, and the connection request sent by the sender of the second abnormal IP address is stopped from being received.

4. The method according to any one of claims 1 to 3, characterized in that, According to the to-be-learned encrypted data packet, the connection request initiated by the second abnormal IP address is blocked, including: According to the to-be-learned encrypted data packet, a third closing data packet and a fourth closing data packet are generated; wherein the third closing data packet is used to notify a sender of the second abnormal IP address to stop sending a connection request; and the fourth closing data packet is used to notify to stop receiving the connection request sent by the sender of the second abnormal IP address; The third closing data packet is sent to the sender of the second abnormal IP address, and the connection request sent by the sender of the second abnormal IP address is stopped from being sent. The fourth closing data packet sent by the sender of the second abnormal IP address is simulated to be received, and the connection request sent by the sender of the second abnormal IP address is stopped from being received.

5. An abnormal connection blocking device, characterized by comprising: Including: The extraction module is used for extracting a source IP address and a traffic fingerprint from a received to-be-defended encrypted data packet to obtain a first source IP address and a first traffic fingerprint; wherein the to-be-defended encrypted data packet includes information sent by a sender of the first source IP address based on network communication; the first traffic fingerprint is generated based on network behavior characteristics of the to-be-defended encrypted data packet and is used to uniquely identify characteristic information of the sender device; the network behavior characteristics include at least one of the following: data packet size, sending frequency, protocol type, and port number; even if the IP address of the sender device is changed, the first traffic fingerprint remains unchanged; The first comparison module is used for comparing the first traffic fingerprint with a traffic fingerprint in a preset self-learning fingerprint library to obtain a first comparison result; wherein the preset self-learning fingerprint library includes a traffic fingerprint of a threat; The third closing data packet is sent to the sender of the second abnormal IP address, and the connection request sent by the sender of the second abnormal IP address is stopped from being sent. The fourth closing data packet sent by the sender of the second abnormal IP address is simulated to be received, and the connection request sent by the sender of the second abnormal IP address is stopped from being received. The second comparison module is configured to, if the first comparison result indicates that the first traffic fingerprint exists in the preset self-learning fingerprint library, acquire a full information library, and compare the first source IP address with IP addresses in the full information library to obtain a second comparison result; wherein the full information library includes abnormal IP addresses and suspected abnormal IP addresses. The determination module is configured to, if the second comparison result indicates that the first source IP address exists in the full information library, determine that the first source IP address represents a first abnormal IP address. The blocking module is configured to, according to the encrypted data packet to be defended, block a connection request initiated by the first abnormal IP address. The apparatus is further configured to: extract a second source IP address from a received encrypted data packet to be learned; wherein the encrypted data packet to be learned includes information sent by a sender of the second source IP address based on network communication; acquire a precise information library, and compare the second source IP address with IP addresses in the precise information library to obtain a third comparison result; wherein the precise information library includes abnormal IP addresses in the full information library; if the third comparison result indicates that the second source IP address exists in the precise information library, acquire an initial self-learning fingerprint library, and extract a second traffic fingerprint from the encrypted data packet to be learned; wherein the second traffic fingerprint is used to identify a sender device that sends the encrypted data packet to be learned; and if the second traffic fingerprint does not exist in the initial self-learning fingerprint library, store the second traffic fingerprint in the initial self-learning fingerprint library to obtain the preset self-learning fingerprint library.

6. An electronic device, comprising: comprise: a memory, a processor; the memory stores computer execution instructions; the processor executes the computer execution instructions stored in the memory, so that the processor executes the method in any one of claims 1-4.

7. A computer readable storage medium characterized by The computer readable storage medium stores computer execution instructions, and the computer execution instructions are executed by the processor to implement the method in any one of claims 1-4.

8. A computer program product, characterised in that, The computer program is executed by the processor to implement the method in any one of claims 1-4.

Images