Network tunnel identification method and device, electronic equipment and storage medium

Abstract

The invention relates to a network tunnel identification method and device, electronic equipment and a storage medium, and belongs to the technical field of communication, and the method comprises the steps: analyzing a network message of a terminal in a detected range, and determining a correlation ratio of protocols in the network message; performing weight assignment on the correlation ratio regularly based on a preset reference and a preset weight, and performing accumulation to obtain an accumulated value; and when the accumulated value exceeds a preset value, identifying the network tunnel used by the terminal. According to the network tunnel identification method provided by the invention, the correlation ratio of the network messages is regularly acquired and counted, and the mechanism of weight assignment and detection value is combined, so that the identification accuracy of tunnel communication is remarkably improved, when the accumulated value exceeds the preset value, the network tunnel used by the terminal is identified, the result of single detection is considered, and the network tunnel identification accuracy is improved. In addition, final judgment is made through the cumulative effect of multiple times of detection, so that the risk of false detection and missing detection is reduced, tunnel communication is identified by analyzing the correlation proportion of the network messages, and the universality is high.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a network tunnel identification method, device, electronic device and storage medium. Background Art

[0002] With the rapid development of network technology, network tunneling technology, as an important means to achieve secure and private communication between networks, has been widely used in scenarios such as network sharing, bypassing network censorship, and remote access. Network tunneling encapsulates and encrypts original data packets, allowing data to maintain its integrity and confidentiality when transmitted on public networks, thereby effectively protecting the security of network communications.

[0003] However, the widespread use of network tunnels has also brought a series of security risks and challenges. First, due to the encapsulation and encryption characteristics of network tunnel technology, it is difficult for traditional network security detection methods based on feature recognition to effectively identify tunnel communications, resulting in the inability to accurately detect and trace network sharing, illegal access and other behaviors. Secondly, some lawless elements use network tunnel technology to bypass the review of network security equipment and conduct illegal activities such as dark web and wall climbing, which seriously endangers network security and social stability.

[0004] In addition, there are many types of network tunnels, with different technical routes, and there is a lack of effective unified identification standards between different tunnel protocols. This makes it difficult for identification methods that rely on specific tunnel features to face many difficulties in practical applications, making it difficult to achieve comprehensive and accurate identification of various types of network tunnels. Summary of the invention

[0005] In view of this, it is necessary to provide a network tunnel identification method, device, electronic device and storage medium to solve the problems of low accuracy and poor versatility of network tunnel identification methods of existing identification methods.

[0006] In order to solve the above problem, the present invention provides a network tunnel identification method, comprising: Parsing network messages of terminals within the detected range to determine correlation ratios of protocols in the network messages; Assigning weights to the correlation ratios based on a preset reference and a preset weight timing, and accumulating to obtain an accumulated value; When the accumulated value exceeds a preset value, the network tunnel used by the terminal is identified.

[0007] In a possible implementation, parsing the network message of the terminal within the detected range to determine the correlation ratio of the protocol in the network message includes: Parsing the network message to obtain target information in the network message; the target information includes protocol type, port number and load content; Based on the target information, determining the number of ports and the number of protocols; Based on the number of the ports and the number of the protocols, determining the proportion of the number of packets of the protocol in the network packets to the total number of packets; Based on the ratio, a correlation ratio of the protocol is determined.

[0008] In a possible implementation manner, the weighting the correlation ratio based on a preset reference and a preset weight timing, and accumulating to obtain an accumulated value, includes: Regularly comparing the correlation ratio with the preset benchmark; When the correlation ratio is greater than the preset reference, assigning a value to the correlation ratio based on the preset weight; The assigned values ​​are accumulated in sequence to obtain the accumulated value.

[0009] In a possible implementation, the method further includes: The preset benchmark is regularly updated based on the network message.

[0010] In a possible implementation manner, after identifying the network tunnel used by the terminal, the method further includes: Exception processing is performed on the network tunnel to determine whether the network tunnel is a legal network tunnel or an illegal network tunnel.

[0011] In a possible implementation, before parsing the network message of the terminal within the detected range and determining the correlation ratio of the protocol in the network message, the method further includes: Deploy data collection equipment at key nodes of the network; Based on the data collection device, regularly collect the network messages; The network message includes at least one of the following: Total number of network packets, TCP packets, UDP packets, broadcast packets, or multicast packets.

[0012] In a possible implementation, after the network messages are collected periodically based on the data collection device, the method further includes: Remove invalid messages and duplicate messages from the network messages.

[0013] The present invention also provides a network tunnel identification device, comprising: The parsing module is used to parse the network messages of the terminals within the detected range and determine the correlation ratio of the protocols in the network messages; An assignment module, used for assigning weights to the correlation ratios based on a preset reference and a preset weight timing, and accumulating to obtain an accumulated value; The identification module is used to identify the network tunnel used by the terminal when the accumulated value exceeds a preset value.

[0014] On the other hand, the present invention also provides an electronic device, including a memory and a processor, wherein: The memory is used to store programs; The processor is coupled to the memory and is used to execute the program stored in the memory to implement the network tunnel identification method described in any of the above implementations.

[0015] On the other hand, the present invention further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the network tunnel identification method described in any of the above implementations is implemented.

[0016] The beneficial effects of the present invention are as follows: the network tunnel identification method, device, electronic device and storage medium provided by the present invention determine the correlation ratio of the protocol in the network message by parsing the network message of the terminal within the detected range, assign weights to the correlation ratio based on a preset benchmark and a preset weight, and accumulate to obtain a cumulative value, and significantly improve the recognition accuracy of tunnel communication by regularly collecting and counting the correlation ratios of network messages and combining the mechanism of weight assignment and detection value. When the cumulative value exceeds the preset value, the network tunnel used by the terminal is identified, which not only considers the result of a single detection, but also makes a final judgment through the cumulative effect of multiple detections, thereby reducing the risk of false detection and missed detection, and identifies tunnel communication by analyzing the correlation ratio of network messages, which has strong versatility. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0018] Figure 1 A method flow chart of an embodiment of a network tunnel identification method provided by the present invention; Figure 2 A schematic diagram of the structure of an embodiment of a network tunnel identification system provided by the present invention; Figure 3 A schematic diagram of the structure of an embodiment of a network tunnel identification device provided by the present invention; Figure 4 A schematic structural diagram of an embodiment of an electronic device provided by the present invention. DETAILED DESCRIPTION

[0019] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0020] In the description of the embodiments of the present invention, unless otherwise specified, "multiple" means two or more than two. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" may mean: A exists alone, A and B exist at the same time, and B exists alone.

[0021] The descriptions of "first", "second", etc. involved in the embodiments of the present invention are only for descriptive purposes and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of the indicated technical features. Therefore, the technical features defined as "first" or "second" may explicitly or implicitly include at least one of the features.

[0022] Figure 1 A method flow chart of an embodiment of the network tunnel identification method provided by the present invention is as follows Figure 1 As shown, the network tunnel identification method includes: S101, parsing network messages of terminals within the inspection range, and determining correlation ratios of protocols in the network messages; S102, assigning weights to the correlation ratios based on a preset reference and a preset weight timing, and accumulating to obtain an accumulated value; S103: When the accumulated value exceeds a preset value, identify the network tunnel used by the terminal.

[0023] In S101, the network messages of the terminals within the detected range are parsed to determine the correlation ratios of the protocols in the network messages.

[0024] First, it is necessary to obtain the network messages of the terminals within the inspection range and parse these network messages. The parsed content may include the header information, data part and the protocol type used in the message.

[0025] Based on the parsing of the message, the correlation ratio between different protocols is calculated to determine the proportion and relationship of different protocols in the traffic. The correlation ratio can be the correlation ratio of the protocol in the network message, that is, the proportion of the number of messages of a certain protocol to the total number of messages.

[0026] In S102, weights are assigned to the correlation ratios based on a preset reference and a preset weight timing, and the weights are accumulated to obtain an accumulated value.

[0027] In order to accurately evaluate the characteristics of network traffic, preset benchmarks and preset weights are required. The preset benchmarks and preset weights can be adjusted according to the actual situation of the network environment to ensure the accuracy of identification.

[0028] According to the preset benchmark and weight, the calculated correlation ratios are assigned values, and these values ​​are accumulated. The accumulated result can reflect the overall characteristics of the network traffic.

[0029] In S103, when the accumulated value exceeds a preset value, the network tunnel used by the terminal is identified.

[0030] The preset value may be set according to the actual situation of the network environment and the identification requirements. When the accumulated value exceeds the preset value, it may be determined that the terminal uses a network tunnel.

[0031] Compared with the prior art, the network tunnel identification method provided in the embodiment of the present invention determines the correlation ratio of the protocol in the network message by parsing the network message of the terminal within the detected range, assigns weights to the correlation ratio based on a preset benchmark and a preset weight, and accumulates the accumulated value. By regularly collecting and counting the correlation ratios of the network messages and combining the mechanism of weight assignment and detection value, the recognition accuracy of tunnel communication is significantly improved. When the accumulated value exceeds the preset value, the network tunnel used by the terminal is identified. Not only the result of a single detection is considered, but also the final judgment is made through the cumulative effect of multiple detections, thereby reducing the risk of false detection and missed detection. Tunnel communication is identified by analyzing the correlation ratio of network messages, and the versatility is strong.

[0032] In some embodiments of the present invention, before parsing the network messages of the terminals within the detected range and determining the correlation ratio of the protocols in the network messages, the method further includes: Deploy data collection equipment at key nodes of the network; Based on the data collection device, regularly collect the network messages; The network message includes at least one of the following: Total number of network packets, TCP packets, UDP packets, broadcast packets, or multicast packets.

[0033] Deploying data collection equipment, such as network probes and traffic mirroring devices, at key nodes in the network can capture network packets passing through the node in real time.

[0034] Data collection equipment can be used to accurately collect data such as the total number of network packets, TCP packets, UDP packets, broadcast packets, and multicast packets of a single terminal in the network in real time.

[0035] In some embodiments of the present invention, after the network messages are collected periodically based on the data collection device, the method further includes: Remove invalid messages and duplicate messages from the network messages.

[0036] In the collected network messages, there may be invalid messages and duplicate messages. Invalid messages may be caused by network errors, equipment failures, or other reasons, such as message format errors, verification failures, etc. Duplicate messages may be caused by network retransmissions, equipment failures, or other reasons.

[0037] The collected network messages are preprocessed, and the captured network messages are preliminarily parsed and filtered to remove invalid and duplicate messages.

[0038] The network tunnel identification method provided by the embodiment of the present invention can ensure the accuracy of network messages by removing invalid messages and duplicate messages in the network messages.

[0039] In some embodiments of the present invention, parsing the network messages of the terminals within the detected range to determine the correlation ratio of the protocols in the network messages includes: Parsing the network message to obtain target information in the network message; the target information includes protocol type, port number and load content; Based on the target information, determining the number of ports and the number of protocols; Based on the number of the ports and the number of the protocols, determining the proportion of the number of packets of the protocol in the network packets to the total number of packets; Based on the ratio, a correlation ratio of the protocol is determined.

[0040] Perform in-depth analysis on pre-processed network messages, extract target information such as protocol type, port number, payload content, etc., and use the protocol parsing library to accurately parse various network protocols.

[0041] According to the analysis results, the number and characteristics of common ports and important protocols are counted. The number of times each port appears is counted to obtain the number distribution of ports, and the number of times each protocol appears in network traffic is counted to obtain the number distribution of protocols.

[0042] Regularly calculate the correlation ratio of various protocols in network messages, that is, the ratio of the number of messages of a certain protocol to the total number of messages.

[0043] Calculate the ratio of the number of protocol packets to the total number of packets, and count the total number of packets, that is, the total number of network packets captured and parsed.

[0044] For each protocol, calculate the ratio of its message number to the total message number to obtain the correlation ratio of the protocol.

[0045] The network tunnel identification method provided in the embodiment of the present invention identifies tunnel communication by analyzing the correlation ratio of network messages instead of relying on specific tunnel characteristics. Therefore, it has wide applicability and can effectively identify any type of network tunnel.

[0046] In some embodiments of the present invention, the step of assigning weights to the correlation ratios based on a preset reference and a preset weight, and accumulating the weights to obtain an accumulated value, includes: Regularly comparing the correlation ratio with the preset benchmark; When the correlation ratio is greater than the preset reference, assigning a value to the correlation ratio based on the preset weight; The assigned values ​​are accumulated in sequence to obtain the accumulated value.

[0047] In some embodiments of the present invention, it further comprises: The preset benchmark is regularly updated based on the network message.

[0048] Through large-scale data analysis, a correlation ratio range of normal user network messages can be established, which can be used as a benchmark for identifying tunnel communications, i.e., a preset benchmark. The preset benchmark can be updated regularly to adapt to changes in the network environment and user behavior.

[0049] The network message correlation ratio of the terminals within the inspection range is collected and counted regularly, and the correlation ratio is compared with the preset benchmark. If the specific correlation message ratio of a terminal exceeds the normal range, a weight is assigned.

[0050] Specific related messages refer to certain specific messages with indicators in the protocol, for example, the proportion of CLIENT HELLO messages in TCP_443 messages, or the proportion of POST / GET messages in TCP_80 messages.

[0051] When the proportion of a specific related message reaches the threshold, the weight value is increased by 50%. When the weight values ​​of multiple specific related messages reach 100% in total, the terminal is determined to have tunnel behavior.

[0052] If after multiple detections, the accumulated weight value exceeds a preset detection value, it is determined that the terminal uses a tunnel.

[0053] The network tunnel identification method provided by the embodiment of the present invention significantly improves the identification accuracy of tunnel communication by regularly collecting and counting the correlation ratio of network messages and combining the weight assignment and detection value mechanism. This method not only considers the results of a single detection, but also makes the final judgment through the cumulative effect of multiple detections, thereby reducing the risk of false detection and missed detection.

[0054] In some embodiments of the present invention, after identifying the network tunnel used by the terminal, the method further includes: Exception processing is performed on the network tunnel to determine whether the network tunnel is a legal network tunnel or an illegal network tunnel.

[0055] By identifying the source / destination IP or special tunnel mark of the terminal, it is possible to distinguish between legal and compliant tunnel proxy behaviors (such as VPN) and illegal tunnel communications, and determine whether the network tunnel is legal or illegal.

[0056] You can also use auxiliary tools such as IP address library and tunnel mark library for quick identification.

[0057] For terminals that are mistakenly identified as using tunnels, they are confirmed through manual review or automatic review mechanism. If it is confirmed to be a false detection, the terminal is removed from the tunnel list and the identification benchmark and algorithm parameters are updated.

[0058] The network tunnel identification method provided by the embodiment of the present invention ensures that the network access of users who legally use the network tunnel (such as remote office, international roaming, etc.) is not interfered. By distinguishing between legal and illegal tunnels and adopting the weight assignment and detection value mechanism to avoid false detection, the user experience is improved and the network access interruption or restriction caused by false detection is reduced.

[0059] The present invention provides a universal network tunnel identification method, which identifies tunnel communication by analyzing the correlation ratio of network messages, rather than relying on specific tunnel features. The network tunnel identification method is as follows: Step 1: Data collection and statistics.

[0060] Collect data such as the total number of network packets, TCP packets, UDP packets, broadcast packets, and multicast packets of a single terminal in the network in real time and accurately.

[0061] Perform in-depth analysis on the collected network messages, and count the number and characteristics of important commonly used ports (such as 443, 80, 53, etc.) and important protocols (such as TLS CLIENT HELLO, HTTP header, DNS, etc.).

[0062] Step 2: Calculate the correlation ratio.

[0063] Accurately calculate the correlation ratio of various protocols / important protocols in network messages to provide strong data support for subsequent tunnel identification.

[0064] Step 3: Identification benchmark establishment.

[0065] Through large-scale network message data analysis, a correlation ratio range of normal user network messages was established as a benchmark for identifying tunnel communications.

[0066] Step 4: Tunnel identification.

[0067] The specific relevant message ratio of the detected terminal is compared with the normal user ratio range to accurately identify the terminal using the network tunnel.

[0068] Step 5: Exception processing.

[0069] Considering that there are some legal and compliant tunnel proxy behaviors (such as VPN) in the network, the present invention also provides an exception processing mechanism. By identifying the terminal source / destination IP or special tunnel flag, the legal and compliant tunnel proxy behaviors can be identified and excluded at the application level to prevent false detection.

[0070] For example, Figure 2 A schematic diagram of the structure of an embodiment of the network tunnel identification system provided by the present invention is shown as follows: Figure 2 As shown in FIG. 1 , the network tunnel identification system is mainly composed of a data acquisition module, a data analysis module, a tunnel identification module, and an exception processing module. These modules work together to achieve accurate identification of tunnel communications in the network.

[0071] The data collection module is used to periodically collect network messages from terminals within the inspection range.

[0072] The data analysis module is connected to the data collection module and is used to perform in-depth analysis on the collected network messages and calculate the correlation ratio of the network messages.

[0073] The tunnel identification module is connected to the data analysis module and is used to assign weights to the network message correlation ratios of the terminal according to preset identification benchmarks and algorithm parameters, and when the accumulated weight assignments exceed the preset detection value, it is determined that the terminal uses a network tunnel.

[0074] The exception processing module is connected to the tunnel identification module and is used to distinguish between legal tunnels and illegal tunnels and to process false detection situations.

[0075] The data acquisition module is deployed at key nodes of the network, including network probes and traffic mirroring devices, to capture network messages passing through the node in real time.

[0076] The data analysis module includes a data preprocessing unit and a deep analysis unit. The data preprocessing unit is used to remove invalid and duplicate messages and count the basic network data of a single terminal; the deep analysis unit is used to extract key information such as protocol type, port number, load content, etc. in the message and calculate the correlation ratio.

[0077] The tunnel identification module also includes an identification benchmark establishing unit, which is used to establish a correlation ratio range of normal user network messages through large-scale data analysis as a benchmark for identifying tunnel communications.

[0078] The exception processing module includes a legal tunnel identification unit and a false positive processing unit. The legal tunnel identification unit is used to identify legal and compliant tunnel proxy behaviors; the false positive processing unit is used to manually review or automatically check terminals that are mistakenly judged to use tunnels, and update the identification benchmark and algorithm parameters.

[0079] The network tunnel identification system also includes a report generation module, which is used to generate a report based on the identification result and the exception processing result, and send it to the network administrator.

[0080] Based on the above network tunnel identification system, the present invention also provides a network tunnel identification method, including: Regularly collect network messages from terminals within the inspection range; Perform in-depth analysis on the collected network messages and calculate the correlation ratio of the network messages; According to the preset recognition benchmark and algorithm parameters, weights are assigned to the terminal's network message correlation ratios; When the accumulated weight value exceeds the preset detection value, it is determined that the terminal uses a network tunnel; Distinguish between legitimate and illegitimate tunnels and handle false detections.

[0081] The method also includes: the step of establishing an identification benchmark, and establishing a correlation ratio range of normal user network messages through large-scale data analysis.

[0082] The method also includes: a report generation step, generating a report of the identification result and the exception processing result, and sending the report to the network administrator.

[0083] The network tunnel identification method provided by the present invention has the following advantages: (1) Improve identification accuracy. The present invention significantly improves the identification accuracy of tunnel communication by regularly collecting and counting the correlation ratio of network messages and combining the weight assignment and detection value mechanism. This method not only considers the results of a single detection, but also makes the final judgment through the cumulative effect of multiple detections, thereby reducing the risk of false detection and missed detection.

[0084] (2) Enhanced network security: Accurate identification of network tunnels is essential for maintaining network security. Through an improved detection mechanism, the present invention can timely detect and respond to potential security threats, trace the source of network security incidents, and effectively prevent malicious behaviors such as data leakage and illegal access, thereby significantly improving the overall network security protection capabilities.

[0085] (3) Reduce economic losses of operators. The present invention helps operators effectively manage network resources and prevent unauthorized network sharing. By accurately identifying network tunnels, operators can promptly discover and prevent such behaviors, thereby reducing economic losses caused by the abuse of network resources. At the same time, the weight assignment and detection value mechanism also ensures the accuracy and stability of identification.

[0086] (4) Strong versatility. The present invention does not rely on a specific tunnel protocol or technology, and therefore has wide applicability. Regardless of the type of network tunnel, the present invention can effectively identify it. This versatility makes the present invention more flexible and adaptable in the field of network communication security.

[0087] (5) Both real-time and stability are important. The present invention realizes real-time detection of network tunnels by regularly collecting network messages and calculating correlation ratios. At the same time, the weight assignment and detection value mechanism also ensure the stability of detection and avoid misjudgment caused by a single abnormal detection.

[0088] (6) Supporting legal tunnel management. The present invention not only focuses on the identification of illegal tunnels, but also can identify and manage legal and compliant tunnel proxy behaviors at the application level. This helps operators and enterprises better manage their internal networks while ensuring that the network access needs of legal users are met.

[0089] (7) Optimizing network resource allocation: By accurately identifying network tunnels, operators can better understand the distribution and usage of network traffic. This helps optimize the allocation of network resources and improve the overall performance and efficiency of the network. At the same time, the present invention can also help operators identify potential network resource abuse, thereby further optimizing network resource management.

[0090] (8) Improve user experience. For users who use network tunnels legally (such as remote office, international roaming, etc.), the present invention can ensure that their network access is not disturbed. By distinguishing between legal and illegal tunnels and using a weight assignment and detection value mechanism to avoid false detection, the present invention improves user experience and reduces network access interruptions or restrictions caused by false detection.

[0091] Taking a certain enterprise network as an example, the network tunnel identification method provided by the present invention is described in detail: Deploy data collection equipment on the egress router of the enterprise network to capture outbound traffic in real time.

[0092] The data acquisition device transmits the captured network messages to the data analysis server for processing.

[0093] The data analysis server performs in-depth analysis of the messages and calculates the correlation ratio to obtain the network message characteristics of each terminal.

[0094] The tunnel identification module performs tunnel communication identification on each terminal according to preset identification benchmarks and algorithm parameters.

[0095] For the identified terminals using tunnels, exceptional processing is performed to distinguish between legal tunnels and illegal tunnels.

[0096] Report the identification results and exception handling results to the network administrator so that appropriate security measures can be taken.

[0097] Through the above specific implementation methods, the present invention can realize accurate identification of tunnel communications in the network, and provide strong support for network security protection and operator resource management.

[0098] In order to better implement the network tunnel identification method in the embodiment of the present invention, based on the network tunnel identification method, the embodiment of the present invention also provides a network tunnel identification device. Figure 3 A schematic diagram of the structure of an embodiment of a network tunnel identification device provided by the present invention is shown as follows: Figure 3 As shown, the network tunnel identification device 300 includes: The parsing module 310 is used to parse the network messages of the terminals within the detected range and determine the correlation ratio of the protocols in the network messages; The value assignment module 320 is used to assign weights to the correlation ratios based on a preset reference and a preset weight timing, and accumulate to obtain an accumulated value; The identification module 330 is used to identify the network tunnel used by the terminal when the accumulated value exceeds a preset value.

[0099] The network tunnel identification device 300 provided in the above embodiment can implement the technical solution described in the above network tunnel identification method embodiment. The specific implementation principles of the above modules or units can refer to the corresponding contents in the network tunnel identification method embodiment, which will not be repeated here.

[0100] like Figure 4 As shown, the present invention also provides an electronic device 400. The electronic device 400 includes a processor 401, a memory 402 and a display 403. Figure 4 Only some components of the electronic device 400 are shown, but it should be understood that it is not required to implement all of the components shown, and more or fewer components may be implemented instead.

[0101] In some embodiments, the processor 401 may be a central processing unit (CPU), a microprocessor or other data processing chip, and is used to run program codes or process data stored in the memory 402, such as the network tunnel identification method of the present invention.

[0102] In some embodiments, processor 401 may be a single server or a server group. The server group may be centralized or distributed. In some embodiments, processor 401 may be local or remote. In some embodiments, processor 401 may be implemented in a cloud platform. In some embodiments, the cloud platform may include a private cloud, a public cloud, a hybrid cloud, a community cloud, a distributed cloud, an internal cloud, a multi-cloud, etc., or any combination thereof.

[0103] In some embodiments, the memory 402 may be an internal storage unit of the electronic device 400, such as a hard disk or memory of the electronic device 400. In other embodiments, the memory 402 may also be an external storage device of the electronic device 400, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc., equipped on the electronic device 400.

[0104] Furthermore, the memory 402 may include both an internal storage unit of the electronic device 400 and an external storage device. The memory 402 is used to store application software installed in the electronic device 400 and various data.

[0105] In some embodiments, the display 403 may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, an organic light-emitting diode (OLED) touch device, etc. The display 403 is used to display information on the electronic device 400 and to display a visual user interface. The components 401-403 of the electronic device 400 communicate with each other via a system bus.

[0106] In one embodiment, when the processor 401 executes the network tunnel identification program in the memory 402, the following steps may be implemented: Parsing network messages of terminals within the detected range to determine correlation ratios of protocols in the network messages; Assigning weights to the correlation ratios based on a preset reference and a preset weight timing, and accumulating to obtain an accumulated value; When the accumulated value exceeds a preset value, the network tunnel used by the terminal is identified.

[0107] It should be understood that: when the processor 401 executes the network tunnel identification program in the memory 402, in addition to the above functions, other functions can also be implemented. For details, please refer to the description of the corresponding method embodiment above.

[0108] Furthermore, the embodiment of the present invention does not specifically limit the type of the electronic device 400 mentioned, and the electronic device 400 may be a portable electronic device such as a mobile phone, a tablet computer, a personal digital assistant (PDA), a wearable device, a laptop computer, etc. Exemplary embodiments of portable electronic devices include but are not limited to portable electronic devices equipped with IOS, Android, Microsoft or other operating systems. The above-mentioned portable electronic device may also be other portable electronic devices, such as a laptop computer with a touch-sensitive surface (e.g., a touch panel). It should also be understood that in some other embodiments of the present invention, the electronic device 400 may not be a portable electronic device, but a desktop computer with a touch-sensitive surface (e.g., a touch panel).

[0109] Correspondingly, an embodiment of the present invention also provides a computer-readable storage medium, which is used to store computer-readable programs or instructions. When the program or instructions are executed by a processor, it can implement the steps or functions of the network tunnel identification method provided in the above-mentioned method embodiments.

[0110] Those skilled in the art will appreciate that all or part of the processes of the above-mentioned embodiments can be implemented by instructing related hardware (such as a processor, a controller, etc.) through a computer program, and the computer program can be stored in a computer-readable storage medium, wherein the computer-readable storage medium is a disk, an optical disk, a read-only storage memory, or a random access memory, etc.

[0111] The network tunnel identification method, device, electronic device and storage medium provided by the present invention are introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as limiting the present invention.

Claims

1. A network tunnel identification method, characterized in that: include: Parsing network messages of terminals within the detected range to determine correlation ratios of protocols in the network messages; Based on a preset reference and a preset weight, the correlation ratio is weighted and accumulated to obtain an accumulated value; When the accumulated value exceeds a preset value, the network tunnel used by the terminal is identified.

2. The network tunnel identification method according to claim 1, characterized in that: The parsing of the network messages of the terminals within the detected range to determine the correlation ratio of the protocols in the network messages includes: Parsing the network message to obtain target information in the network message; the target information includes protocol type, port number and load content; Based on the target information, determining the number of ports and the number of protocols; Based on the number of the ports and the number of the protocols, determining the proportion of the number of packets of the protocol in the network packets to the total number of packets; Based on the ratio, a correlation ratio of the protocol is determined.

3. The network tunnel identification method according to claim 1, characterized in that: The step of assigning weights to the correlation ratios based on a preset reference and a preset weight, and accumulating the weights to obtain an accumulated value, includes: Regularly comparing the correlation ratio with the preset benchmark; When the correlation ratio is greater than the preset reference, assigning a value to the correlation ratio based on the preset weight; The assigned values ​​are accumulated in sequence to obtain the accumulated value.

4. The network tunnel identification method according to claim 3, characterized in that: Also includes: The preset benchmark is regularly updated based on the network message.

5. The network tunnel identification method according to claim 1, characterized in that: After the network tunnel used by the terminal is identified, the method further includes: Exception processing is performed on the network tunnel to determine whether the network tunnel is a legal network tunnel or an illegal network tunnel.

6. The network tunnel identification method according to claim 1, characterized in that: Before parsing the network messages of the terminals within the detected range and determining the correlation ratio of the protocols in the network messages, the method further includes: Deploy data collection equipment at key nodes of the network; Based on the data collection device, regularly collect the network messages; The network message includes at least one of the following: Total number of network packets, TCP packets, UDP packets, broadcast packets, or multicast packets.

7. The network tunnel identification method according to claim 6, characterized in that: After the network messages are collected periodically based on the data collection device, the method further includes: Remove invalid messages and duplicate messages from the network messages.

8. A network tunnel identification device, characterized in that: include: The parsing module is used to parse the network messages of the terminals within the detected range and determine the correlation ratio of the protocols in the network messages; An assignment module, used for assigning weights to the correlation ratios based on a preset reference and a preset weight timing, and accumulating to obtain an accumulated value; The identification module is used to identify the network tunnel used by the terminal when the accumulated value exceeds a preset value.

9. An electronic device, characterized in that: comprising a memory and a processor, wherein: The memory is used to store programs; The processor is coupled to the memory and is used to execute the program stored in the memory to implement the network tunnel identification method as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the network tunnel identification method according to any one of claims 1 to 7 is implemented.

Images