Traffic detection method and device, electronic equipment and computer storage medium

Abstract

The invention discloses a traffic detection method and device, electronic equipment and a computer storage medium. The method comprises the following steps: acquiring a target data stream; performing protocol identification on the target data stream to obtain a target protocol type corresponding to the target data stream; based on the target protocol type, extracting target metadata of the target data stream; detecting the target metadata by using a target detection model corresponding to the target protocol type to obtain a target detection result corresponding to the target data stream; the target detection model comprises a preset detection rule; the target protocol types are different, and the preset detection rules included in the target detection model are also different, so that targeted flow detection is realized for the target data streams of different protocol types, and the accuracy of flow detection is ensured.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a flow detection method, device, electronic equipment and computer storage medium. Background Art

[0002] In the modern office environment, remote office software such as TeamViewer, Todesk and Sunflower have become common tools in daily work. These software greatly facilitate cross-regional collaboration and remote management. However, their use also brings potential security risks. In some industries or organizations, the use of remote control software is even subject to strict compliance requirements. Because these software are usually equipped with a variety of security measures, such as authentication and data encryption, but in actual use, criminals may exploit the vulnerabilities of these remote control software to pose a serious threat to the user's data security. For example, attackers may use security vulnerabilities in remote control software to implant viruses, Trojans or other malicious programs to illegally obtain access rights to users' computers. This illegal remote control behavior may lead to the theft of sensitive data, seriously endanger personal privacy and corporate secrets, and cause significant losses to the leakage of personal privacy data or the leakage of confidential information and data of enterprises. Summary of the invention

[0003] The embodiments of the present application provide a flow detection method, device, electronic device and computer storage medium. The flow detection method can implement targeted flow detection for target data streams of different protocol types to ensure the accuracy of flow detection.

[0004] In a first aspect, an embodiment of the present application provides a flow detection method, including:

[0005] Get the target data stream;

[0006] Performing protocol identification on the target data stream to obtain a target protocol type corresponding to the target data stream;

[0007] Based on the target protocol type, extract target metadata of the target data stream;

[0008] The target metadata is detected using the target detection model corresponding to the target protocol type to obtain the target detection result corresponding to the target data stream; the target detection model includes preset detection rules; the preset detection rules included in the target detection model are different for different target protocol types.

[0009] In a possible implementation, the above-mentioned preset detection rules include:

[0010] In the case where the target metadata meets the target detection condition corresponding to the target remote control software, determining that the target data stream belongs to the data stream sent by the target remote control software;

[0011] In the case that the target metadata does not satisfy the target detection condition, determining that the target data stream does not belong to the data stream sent by the target remote control software;

[0012] Among them, the target detection conditions included in the preset detection rules are different for different target protocol types; and the target detection conditions are also different for different target remote control software.

[0013] In a possible implementation, when the target protocol type is the TLS protocol, the target metadata includes at least one of the following: a common name of a certificate subject, a certificate verification status, a certificate chain length, an SNI identifier, a number of bytes transmitted by a data stream, and a data stream transmission time;

[0014] The preset detection condition includes at least one of the following: the target metadata is located in a preset database, the length of the certificate chain is within a preset range, and the ratio of the number of bytes transmitted by the data stream to the transmission time of the data stream is greater than a first threshold; the preset database includes metadata corresponding to the historical data stream sent by the target remote control software; the preset database includes at least one of the following: a preset SNI identifier library, a preset remote control software certificate user library, and a preset certificate verification status library;

[0015] Among them, the above-mentioned target remote control software is different, and the above-mentioned preset database, the above-mentioned preset range and the above-mentioned first threshold are also different.

[0016] In a possible implementation, when the target protocol type is TCP protocol, the target metadata includes at least one of the following: the number of data packets transmitted by the data stream, the number of bytes transmitted by the data stream, the data stream transmission time, and the payload of the first N non-empty data packets in the target data stream; N is a positive integer;

[0017] The preset detection condition includes at least one of the following: the proportion of the specific payload sequence in the payload of the first N non-empty data packets is greater than the second threshold, the first data packet of the target data stream contains a specific payload identifier, and the ratio of the number of bytes transmitted by the data stream to the transmission time of the data stream is greater than the third threshold;

[0018] Among them, the above-mentioned target remote control software is different, and the above-mentioned specific load sequence, the above-mentioned specific load identifier, the above-mentioned second threshold value, and the above-mentioned third threshold value are also different.

[0019] In a possible implementation, when the target protocol type is UDP protocol, the target metadata includes at least one of the following: the number of data packets transmitted by the data stream, the number of bytes transmitted by the data stream, the data stream transmission time, and the payload of the first N non-empty data packets in the target data stream; N is a positive integer;

[0020] The preset detection condition includes at least one of the following: a TCP data flow or a TLS data flow appears within a preset time period before the target data flow appears, a proportion of a specific load sequence in the payload of the first N non-empty data packets is greater than a fourth threshold, a first data packet of the target data flow contains a specific load identifier, and a ratio of the number of bytes transmitted by the data flow to the transmission time of the data flow is greater than a fifth threshold;

[0021] Among them, the above-mentioned target remote control software is different, and the above-mentioned specific load sequence, the above-mentioned specific load identifier, the above-mentioned fourth threshold value, and the above-mentioned fifth threshold value are also different.

[0022] In a possible implementation, the obtaining of the target data stream includes:

[0023] Receive traffic to be detected;

[0024] The above traffic to be detected is subjected to data preprocessing to obtain the target data flow.

[0025] In a possible implementation, the target metadata is detected using the target detection model corresponding to the target protocol type to obtain a target detection result corresponding to the target data stream, including:

[0026] The target metadata is input into the target detection model corresponding to the target protocol type for detection to obtain the target detection result corresponding to the target data stream; the target detection model is trained based on the sample metadata data set of the target protocol type with known detection results.

[0027] In a second aspect, an embodiment of the present application provides a flow detection device, including:

[0028] An acquisition module, used to acquire a target data stream;

[0029] An identification module, used to perform protocol identification on the target data stream to obtain a target protocol type corresponding to the target data stream;

[0030] An extraction module, used for extracting target metadata of the target data stream based on the target protocol type;

[0031] A detection module is used to detect the target metadata using a target detection model corresponding to the target protocol type to obtain a target detection result corresponding to the target data stream; the target detection model includes preset detection rules; the preset detection rules included in the target detection model are different for different target protocol types.

[0032] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a processor and a memory; wherein the memory stores executable program code, and the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to execute the method steps provided in the first aspect of the embodiment of the present application or any possible implementation method of the first aspect.

[0033] In a fourth aspect, an embodiment of the present application provides a computer storage medium, which stores multiple instructions, and the instructions are suitable for being loaded by a processor and executing the method steps provided by the first aspect of the embodiment of the present application or any possible implementation of the first aspect.

[0034] The beneficial effects brought about by the technical solutions provided by some embodiments of the present application include at least:

[0035] In an embodiment of the present application, after the protocol of the target data stream is identified, the target metadata is extracted based on the target protocol type corresponding to the target data stream, and then the target metadata is detected using a corresponding target detection model. Different target protocol types include different preset detection rules included in the target detection model used. Therefore, by adopting targeted extraction methods and different traffic detection rules for target data streams of different protocol types, targeted traffic detection is achieved for target data streams of different protocol types, thereby ensuring the accuracy of traffic detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0037] Figure 1 A schematic diagram of the architecture of a flow detection system provided by an exemplary embodiment of the present application;

[0038] Figure 2 A flow chart of a flow detection method provided by an exemplary embodiment of the present application;

[0039] Figure 3A schematic diagram of a TLS data stream detection process provided for an exemplary embodiment of the present application;

[0040] Figure 4 A schematic diagram of a detection process of a TCP data stream provided by an exemplary embodiment of the present application;

[0041] Figure 5 A schematic diagram of a UDP data stream detection process provided by an exemplary embodiment of the present application;

[0042] Figure 6 A schematic diagram of an implementation process of a flow detection method provided by an exemplary embodiment of the present application;

[0043] Figure 7 A schematic structural diagram of a flow detection device provided by an exemplary embodiment of the present application;

[0044] Figure 8 A schematic structural diagram of an electronic device provided as an exemplary embodiment of the present application. DETAILED DESCRIPTION

[0045] In order to make the features and advantages of the present application more obvious and easy to understand, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present application.

[0046] The terms "first", "second", "third", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices.

[0047] Please refer to the following Figure 1 , which is a schematic diagram of the architecture of a flow detection system provided by an exemplary embodiment of this specification. Figure 1 As shown, the traffic detection system may include: a terminal 110 and a server 120 .

[0048] in:

[0049] The terminal 110 can interact with the server 120 through the network to receive messages from the server 120 or send messages to the server 120. The terminal 110 can be hardware or software. When the terminal 110 is hardware, it can be various electronic devices, including but not limited to smart watches, smart phones, tablet computers, laptop portable computers and desktop computers. When the terminal 110 is software, it can be installed in the electronic devices listed above, which can be implemented as multiple software or software modules (for example: used to provide distributed services), or it can be implemented as a single software or software module, which is not specifically limited here.

[0050] In the embodiments of the present specification, the terminal 110 may be a user terminal for a user to perform traffic detection. When a user wants to detect the traffic of a certain business system, the user may first obtain the target data stream through the terminal 110, but is not limited to; then, perform protocol identification on the target data stream to obtain the target protocol type corresponding to the target data stream; then, based on the target protocol type, extract the target metadata of the target data stream; finally, use the target detection model corresponding to the target protocol type to detect the target metadata to obtain the target detection result corresponding to the target data stream; the target detection model includes preset detection rules; different target protocol types include different preset detection rules.

[0051] The server 120 may be a server that provides various traffic detection functions. It should be noted that the server 120 may be hardware or software. When the server 120 is hardware, it may be implemented as a distributed server cluster consisting of multiple servers, or it may be implemented as a single server. When the server 120 is software, it may be implemented as multiple software or software modules (for example, for providing distributed services), or it may be implemented as a single software or software module, which is not specifically limited here. The server 120 may be, but is not limited to, a hardware server, a virtual server, a cloud server, etc.

[0052] Optionally, after receiving the flow detection instruction sent by the terminal 110 through the network, the server 120 may also perform flow detection using the flow detection method provided in the embodiment of the present application.

[0053] It can be understood that the traffic detection method provided in the embodiment of the present application can be executed by the terminal 110 alone, by the server 120 alone, or by the terminal 110 and the server 120 together, and the embodiment of the present application is not limited to this.

[0054] The network may be a medium providing a communication link between the terminal 110 and the server 120, or may be the Internet including network devices and transmission media, but is not limited thereto. The transmission media may be a wired link, such as but not limited to coaxial cable, optical fiber, and digital subscriber line (DSL), or a wireless link, such as but not limited to wireless fidelity (WIFI), Hypertext Transfer Protocol (HTTP), Bluetooth, and mobile device network, etc.

[0055] Understandably, Figure 1 The number of terminals 110 and servers 120 in the traffic detection system shown is only an example. In a specific implementation, the traffic detection system may include any number of terminals 110 and servers 120.

[0056] Next, combine Figure 1 , taking the terminal 110 performing flow detection as an example, the flow detection method provided by an exemplary embodiment of the present application is introduced. For details, please refer to Figure 2 , which exemplarily shows a flow chart of a flow detection method provided by an embodiment of the present application. Figure 2 As shown, the flow detection method may include the following steps:

[0057] S201, obtaining a target data stream.

[0058] Optionally, when the user terminal exchanges data with the business system, after the user terminal receives the traffic to be detected sent by the business system, the traffic to be detected can be preprocessed to obtain a target data stream. For example, but not limited to, the traffic to be detected can be screened first to remove redundant data packets therein, and then at least one data stream unit (target data stream) can be segmented according to the four-tuple <source IP, source port number, destination IP, destination port number> segmentation rule. The above-mentioned redundant data packets can be data packets with the same content, or invalid data packets with format errors or verification failures, or data packets that cannot participate in network training and detection, and the embodiments of the present application are not limited to this.

[0059] Exemplarily, first use a network traffic monitoring tool or a network packet capture tool (such as Wireshark) to capture the business system traffic, screen the data packets in the business system traffic, remove invalid or erroneous data packets, and filter out data packets that are irrelevant to the detection target. Then, according to the <source IP, source port number, destination IP, destination port number> segmentation rule, segment at least one independent data stream unit (target data stream). Wherein, each data stream unit (target data stream) represents a specific communication session and has a unique five-tuple identifier. For each data stream unit (target data stream), it is necessary to maintain its state information (such as but not limited to the start time of the data stream, the end time of the data stream, the number of packets, etc.), which helps to conduct more detailed analysis and monitoring later.

[0060] S202, performing protocol identification on the target data stream to obtain a target protocol type corresponding to the target data stream.

[0061] Specifically, different operations in different remote control software will generate data streams of different protocol types. For example, Sunflower remote control software mainly transmits data through a data stream based on the Transport Layer Security (TLS) protocol, and transfers files through a data stream based on the User Datagram Protocol (UDP); TeamViewer remote control software mainly establishes a connection through a data stream based on the Transmission Control Protocol (TCP), and transfers files through a data stream based on the UDP protocol. After obtaining the target data stream, the target data stream can be identified by a network packet capture tool (such as Wireshark) but is not limited to. For example, but not limited to, the target protocol type corresponding to the target data stream can be determined by a specific protocol port number (for example, the TLS protocol usually uses a specific port number of 443 for communication) or according to the transmission protocol in the five-tuple information of the data packet or according to the format and content of the target data stream.

[0062] S203, extracting target metadata of the target data stream based on the target protocol type.

[0063] Specifically, since data streams of different protocol types have different characteristic formats and contents. Therefore, when analyzing the target data stream, the corresponding target metadata can be extracted according to the target protocol type to which it belongs, so as to subsequently complete the accurate analysis and detection of the target data stream based on the target metadata. The target metadata is descriptive data of the target data stream and its related information, which provides detailed information about the data stream itself and its various attributes and states during the processing. The target metadata may include, but is not limited to, the certificate user common name, certificate verification status, certificate chain length, Server Name Indication (SNI) identifier, the payload of the first N non-empty data packets in the target data stream, the number of bytes transmitted by the data stream, the number of data packets transmitted by the data stream, the data stream transmission time, etc., where N is a positive integer.

[0064] S204, using the target detection model corresponding to the target protocol type to detect the target metadata, and obtain the target detection result corresponding to the target data stream. The target detection model includes preset detection rules. Different target protocol types have different preset detection rules included in the target detection model.

[0065] Specifically, different operations in different remote control software will generate data streams of different protocol types. At the same time, data streams of different protocol types have different feature formats and contents. Therefore, in order to achieve more accurate data stream detection, different target detection models can be used to perform targeted detection on the target metadata of target data streams of different target protocol types. The above target detection model includes at least one preset detection rule, and the preset detection rules are different for different target protocol types.

[0066] Optionally, the preset detection rules may include: when the target metadata meets the target detection conditions corresponding to the target remote control software, it means that the target data stream corresponding to the target metadata meets the traffic characteristics issued by the target remote control software, and it is determined that the target data stream belongs to the data stream issued by the target remote control software; when the target metadata does not meet the target detection conditions, it means that the target data stream corresponding to the target metadata does not meet the traffic characteristics issued by the target remote control software, and it is determined that the target data stream does not belong to the data stream issued by the target remote control software. Wherein, the target detection conditions included in the preset detection rules are different for different target protocol types; the target detection conditions are also different for different target remote control software. That is, the above target detection conditions are formulated for data streams of different protocol types generated by different target remote control software. For the same target remote control software, the corresponding target detection conditions may be one or more, which can be set according to actual conditions, and the embodiments of the present application are not limited to this.

[0067] Optionally, after obtaining the target metadata corresponding to the target data stream, the target metadata can be input into the target detection model corresponding to the target protocol type for detection to obtain the target detection result corresponding to the target data stream. The target detection model is trained based on a sample metadata dataset of the target protocol type with known detection results. The target detection model can be, but is not limited to, a model based on deep learning or a pre-trained large model.

[0068] In an embodiment of the present application, after the protocol of the target data stream is identified, the target metadata is extracted based on the target protocol type corresponding to the target data stream, and then the target metadata is detected using a corresponding target detection model. Different target protocol types include different preset detection rules included in the target detection model used. Therefore, by adopting targeted extraction methods and different traffic detection rules for target data streams of different protocol types, targeted traffic detection is achieved for target data streams of different protocol types, thereby ensuring the accuracy of traffic detection.

[0069] Please refer to the following Figure 3 , which exemplarily shows a schematic diagram of a TLS data stream detection process provided by an embodiment of the present application. Figure 3 As shown, the flow detection process may include the following steps:

[0070] S301, based on the TLS protocol, extract the target metadata of the target data stream, the target metadata includes at least one of the following: the common name of the certificate user, the certificate verification status, the certificate chain length, the SNI identifier, the number of bytes transmitted by the data stream, and the data stream transmission time.

[0071] Specifically, when the target protocol type corresponding to the target data stream is the TLS protocol, that is, the target data stream is a TLS data stream, the corresponding target metadata can be directly extracted from the target data stream according to the TLS protocol attributes. The above-mentioned TLS data stream is a data stream based on the TLS protocol, which can ensure that the data of the remote control software will not be stolen or tampered with during the transmission process by encrypting the transmitted data. This may include sensitive information entered by the user, the execution results of the remote command, etc. For example, the Sunflower remote control software uses the TLS protocol to encrypt the remote desktop connection to ensure the security of data transmission. At the same time, the TLS protocol will perform identity authentication during the handshake phase to ensure that both the client and the server are trustworthy. This helps prevent man-in-the-middle attacks and ensures that both parties to the remote control software connection are legitimate.

[0072] S302: Determine whether the target metadata is located in a preset database.

[0073] Specifically, the preset database includes metadata corresponding to the historical data stream sent by the target remote control software. The preset database includes at least one of the following: a preset SNI identifier library, a preset remote control software certificate user library, and a preset certificate verification status library. Among them, the target remote control software is different, and the preset database is also different. If any of the SNI identifier, the remote control software certificate user, and the certificate verification status in the target metadata is not located in the preset database, it means that the target data stream does not belong to the data stream generated by the target remote control software. The above-mentioned SNI identifier is an extension of the TLS protocol. Its main function is to allow the client to specify the host name of the server it is trying to connect to during the TLS handshake process. It is a unique attribute of the TLS protocol. The above-mentioned certificate verification status can be used to determine whether the data stream is secure, or whether the communication between the two parties connected by the remote control software is secure. The security of the communication can be preliminarily determined by determining whether the certificate is in the validity period. The above-mentioned remote control software certificate user is usually specific. The remote control software certificate is usually issued by a trusted certificate authority (CA) to prove the identity and credibility of the remote control software. The certificate contains relevant information about the remote control software, such as the software name, developer information, issuing authority, etc., and uses public key encryption technology to ensure the security of communication. Secondly, each remote control software will have a specific developer or development team when it is developed, who are responsible for the design, coding and distribution of the software. Therefore, when applying for a certificate, it is usually applied in the name of the developer or development team, so that the user of the certificate is a specific developer or development team. Therefore, by identifying the user of the remote control software certificate in the target metadata, it is possible to determine whether the target data flow belongs to the data flow sent by the target remote control software or to determine the name of the target remote control software to which the target data flow belongs.

[0074] S303: Determine whether the length of the certificate chain is within a preset range.

[0075] Specifically, the above-mentioned certificate chain is also called a certificate path or a certificate hierarchy, which is a sequence of multiple digital certificates, usually consisting of a root certificate, an intermediate certificate, and a leaf certificate (usually a server or client certificate). The certificate chain provides a mechanism to ensure that the issuer of each certificate is authenticated by the previous certificate, thereby creating a chain of trust. It is essential to prevent man-in-the-middle attacks and ensure the security of data transmission. An incomplete certificate chain or a certificate chain of unreasonable length may introduce potential security risks. For example, hackers may exploit vulnerabilities in the certificate chain to conduct a man-in-the-middle attack to steal or tamper with transmitted data. By verifying whether the length of the certificate chain is within the expected range, these potential security risks can be discovered and fixed in a timely manner to ensure the security of communication. Among them, the above-mentioned preset range is different for different target remote control software.

[0076] S304: Determine whether the ratio of the number of bytes transmitted by the data stream to the data stream transmission time is greater than a first threshold.

[0077] Specifically, the ratio of the number of bytes transmitted by the above data stream to the data stream transmission time is actually the data transmission rate. The data transmission rate refers to the amount of data transmitted through a computer network or a data transmission channel per unit time, which reflects the speed of data transmission. There are differences in the data transmission rates of different target remote control software. Taking ToDesk and Sunflower, two mainstream remote control software, as examples, they have obvious differences in data transmission rates. Moreover, the first threshold mentioned above is different for different target remote control software. In this way, it is determined whether the target data stream belongs to the data stream sent by the target remote control software or to determine the name of the target remote control software to which the target data stream belongs.

[0078] It should be noted that in the embodiment of the present application, the execution order of S302, S303 and S304 is not limited, and they can be executed successively or simultaneously.

[0079] S305, if the target metadata is not located in the preset database, or the certificate chain length is not within the preset range, or the ratio of the number of bytes transmitted by the data stream to the data stream transmission time is less than or equal to the first threshold, it is determined that the target data stream does not belong to the data stream sent by the target remote control software.

[0080] Specifically, the above-mentioned preset database, preset range, and first threshold are all set for TLS data streams issued by different remote control software. If the target metadata is not located in the preset database, or the certificate chain length is not within the preset range, or the ratio of the number of bytes transmitted by the data stream to the data stream transmission time is less than or equal to the first threshold, it can be determined that the target data stream does not belong to the data stream issued by the target remote control software.

[0081] S306: If the target metadata is in a preset database, the certificate chain length is within a preset range, and the ratio of the number of bytes transmitted by the data stream to the data stream transmission time is greater than a first threshold, determine the name of the target remote control software to which the target data stream belongs.

[0082] Specifically, if the target metadata is located in the preset database, the certificate chain length is within the preset range, and the ratio of the number of bytes transmitted by the data stream to the data stream transmission time is greater than the first threshold, then it means that the target data stream corresponding to the target metadata is safe and reliable, and meets the target detection conditions corresponding to the target remote control software, then the name of the target remote control software to which the target data stream belongs can be determined.

[0083] Please refer to the following Figure 4 , which exemplarily shows a TCP data stream detection process diagram provided by an embodiment of the present application. Figure 4As shown, the flow detection process may include the following steps:

[0084] S401, based on the TCP protocol, extract the target metadata of the target data stream, the target metadata includes at least one of the following: the number of data stream transmission packets, the number of data stream transmission bytes, the data stream transmission time, the payload of the first N non-empty data packets in the target data stream, N is a positive integer.

[0085] Specifically, when the target protocol type corresponding to the target data stream is the TCP protocol, that is, the target data stream is a TCP data stream, the corresponding target metadata can be directly extracted from the target data stream according to the TCP protocol attributes. The above-mentioned TCP data stream is a data stream based on the TCP protocol. Before transmitting data, TCP needs to establish a connection to ensure that the communication path between the sender and the receiver is reliable. The TCP protocol uses a flow control mechanism to prevent the sender from sending too fast and avoid situations where the receiver cannot handle it.

[0086] S402: Determine whether the proportion of a specific payload sequence in the effective payloads of the first N non-empty data packets is greater than a second threshold.

[0087] Specifically, the above-mentioned effective load is the data content actually contained in the non-empty data packet, and the content can be any form of data such as text, image, audio, video, etc., depending on the application scenario and transmission requirements of the data packet. The above-mentioned specific load is a load sequence that the TCP data stream sent by the target remote control software usually contains. Among them, the target remote control software is different, and the above-mentioned specific load sequence and the above-mentioned second threshold are also different. For example, for the TCP data stream sent by the Sunflower remote control software, its non-empty data packet usually starts with 0x000x00 0x00 0x00 0x00 0x00 0x00 load and contains 0x170x24 load. Therefore, it is possible to determine whether the target data stream is a data stream sent by the target remote control software or to determine the name of the target remote control software to which the target data stream belongs by calculating whether the proportion of the above-mentioned specific load in the effective load of the first N non-empty data packets exceeds the second threshold.

[0088] S403, determining whether the first data packet of the target data stream contains a specific payload identifier.

[0089] Specifically, the above-mentioned specific payload identifier is embedded in the first data packet of the target data stream by the target remote control software in order to realize certain specific functions. The above-mentioned specific functions may be, but are not limited to, session management, identity authentication, load balancing, etc. The specific functions realized by the target data stream can be identified through these specific payload identifiers. At the same time, the above-mentioned specific payload identifiers are different for different target remote control software.

[0090] S404: Determine whether the ratio of the number of bytes transmitted by the data stream to the data stream transmission time is greater than a third threshold.

[0091] Specifically, the third threshold is different for different target remote control software. S404 is consistent with S304 and will not be described in detail here.

[0092] It should be noted that in the embodiment of the present application, the execution order of S402, S403 and S404 is not limited, and they can be executed successively or simultaneously.

[0093] S405: If the proportion of the specific payload sequence in the payloads of the first N non-empty data packets is less than or equal to the second threshold and the first data packet of the target data stream does not contain a specific payload identifier, or the ratio of the number of bytes transmitted by the data stream to the data stream transmission time is less than or equal to the third threshold, it is determined that the target data stream does not belong to the data stream sent by the target remote control software.

[0094] Specifically, the second threshold, specific load identifier, and third threshold are all set for TCP data streams sent by different remote control software. If the proportion of the specific load sequence in the payload of the first N non-empty data packets in the target data stream is less than or equal to the second threshold, or the first data packet of the target data stream does not contain the specific load identifier, or the ratio of the number of bytes transmitted by the data stream to the data stream transmission time is less than or equal to the third threshold, it can be determined that the target data stream does not belong to the data stream sent by the target remote control software.

[0095] S406, if the proportion of the specific payload sequence in the payloads of the first N non-empty data packets is greater than the second threshold, or the first data packet of the target data stream contains a specific payload identifier, and the ratio of the number of bytes transmitted by the data stream to the data stream transmission time is greater than the third threshold, then determine the name of the target remote control software to which the target data stream belongs.

[0096] Specifically, if the proportion of a specific payload sequence in the payloads of the first N non-empty data packets is greater than a second threshold, or the beginning data packet of the target data stream contains a specific payload identifier, and the ratio of the number of bytes transmitted by the data stream to the data stream transmission time is greater than a third threshold, then it means that the target data stream corresponding to the target metadata meets the target detection conditions corresponding to the target remote control software. At the same time, the name of the target remote control software to which the target data stream belongs can also be determined based on the above target detection conditions.

[0097] Please refer to the following Figure 5 , which exemplarily shows a schematic diagram of a UDP data stream detection process provided by an embodiment of the present application. Figure 5 As shown, the flow detection process may include the following steps:

[0098] S501, based on the UDP protocol, extract the target metadata of the target data stream, the target metadata includes at least one of the following: the number of data stream transmission packets, the number of data stream transmission bytes, the data stream transmission time, the payload of the first N non-empty data packets in the target data stream, N is a positive integer.

[0099] Specifically, when the target protocol type corresponding to the target data stream is the UDP protocol, that is, the target data stream is a UDP data stream, the corresponding target metadata can be directly extracted from the target data stream according to the UDP protocol attributes. The above-mentioned UDP data stream is a data stream based on the UDP protocol. There is no need to establish a connection before transmitting data. The sender only needs to send the data message directly to the IP address and port number of the receiver. At the same time, since there is no overhead of connection establishment and confirmation retransmission, and it is not restricted by congestion control, the transmission speed of the UDP data stream is faster than that of the TCP data stream.

[0100] S502, determining whether a TCP data flow or a TLS data flow has appeared within a preset time period before the target data flow appears.

[0101] Specifically, for UDP data streams, because they are usually used for file transfer, the file transfer stage in the remote control software is often located after the connection is established, so it is possible to determine whether a TCP data stream or a TLS data stream has been generated within a preset time period before the target data stream appears, to assist in determining whether the target data stream is a UDP data stream sent by the target remote control software. The above preset time period can be 5 minutes or 10 minutes, which is not limited in the embodiments of the present application.

[0102] S503: Determine whether the proportion of the specific payload sequence in the effective payloads of the first N non-empty data packets is greater than a fourth threshold.

[0103] Specifically, the fourth threshold is different for different target remote control software. S503 is consistent with S402 and will not be described in detail here.

[0104] S504: Determine whether the first data packet of the target data stream contains a specific payload identifier.

[0105] Specifically, the target remote control software is different, and the above-mentioned specific load identifier is also different. S504 is consistent with S403, and will not be repeated here.

[0106] S505: Determine whether the ratio of the number of bytes transmitted by the data stream to the data stream transmission time is greater than a fifth threshold.

[0107] Specifically, the fifth threshold is different for different target remote control software. S505 is consistent with S404 and will not be described in detail here.

[0108] It should be noted that in the embodiment of the present application, the execution order of S502, S503, S504 and S505 is not limited, and they can be executed sequentially or simultaneously.

[0109] S506: If no TCP data stream or TLS data stream appears within a preset time period before the target data stream appears, or the proportion of a specific payload sequence in the payloads of the first N non-empty data packets is less than or equal to the fourth threshold and the beginning data packet of the target data stream does not contain a specific payload identifier, or the ratio of the number of bytes transmitted by the data stream to the data stream transmission time is less than or equal to the fifth threshold, it is determined that the target data stream does not belong to a data stream sent by the target remote control software.

[0110] Specifically, the fourth threshold, specific load identifier, and fifth threshold are all set for UDP data streams sent by different remote control software. If no TCP data stream or TLS data stream appears in the preset time period before the target data stream appears, it may indicate that the target data stream is not a data stream sent by the target remote control software. If the proportion of specific load sequences in the payload of the first N non-empty data packets in the target data stream is less than or equal to the fourth threshold and the beginning data packet of the target data stream does not contain a specific load identifier, or the ratio of the number of bytes transmitted by the data stream to the data stream transmission time is less than or equal to the fifth threshold, it can be determined that the target data stream does not belong to the data stream sent by the target remote control software.

[0111] S507: If a TCP data stream or a TLS data stream appears within a preset time period before the target data stream appears, and the proportion of a specific payload sequence in the payloads of the first N non-empty data packets is greater than the fourth threshold, or the beginning data packet of the target data stream contains a specific payload identifier, and the ratio of the number of bytes transmitted by the data stream to the data stream transmission time is greater than the fifth threshold, then determine the name of the target remote control software to which the target data stream belongs.

[0112] Specifically, if a TCP data stream or a TLS data stream appears within a preset time period before the target data stream appears, it means that the target data stream may be a data stream sent by the target remote control software. If the proportion of a specific payload sequence in the payload of the first N non-empty data packets is greater than the fourth threshold or the first data packet of the target data stream contains a specific payload identifier, and the ratio of the number of bytes transmitted by the data stream to the data stream transmission time is greater than the fifth threshold, it means that the target data stream corresponding to the target metadata meets the target detection condition corresponding to the target remote control software. At the same time, the name of the target remote control software to which the target data stream belongs can also be determined based on the above target detection condition.

[0113] Please refer to the following Figure 6 , which exemplarily shows a schematic diagram of the implementation process of a flow detection method provided in an embodiment of the present application. Figure 6As shown, first pre-process the accessed network traffic, filter out redundant traffic and data packets that cannot participate in network training and detection, and then divide the data stream into each target data stream according to <source IP, source port number, destination IP, destination port number>; then identify the protocol type to which each target data stream belongs (the protocol type to which the data stream generated by the target remote control software belongs is mainly TLS, TCP or UDP); then, extract the relevant target metadata according to the target protocol type and load characteristics to which each target data stream belongs; finally, according to the target protocol type corresponding to the target data stream of each target metadata, input the target metadata into the corresponding target detection model (TLS flow detection model, TCP flow detection model, UDP flow detection model), and obtain the final detection result (target detection result). For example, but not limited to, when the target protocol type is TCP protocol, the target metadata corresponding to the target data stream is input into the TCP flow detection model to obtain the target detection result corresponding to the target data stream. The above three target detection models can be composed of preset detection rules corresponding to their respective protocol types, or they can be trained based on sample metadata data sets of corresponding target protocol types of known detection results, and the embodiments of the present application are not limited to this.

[0114] Please refer to the following Figure 7 , which exemplarily shows a structural diagram of a flow detection device provided in an embodiment of the present application. Figure 7 As shown, the flow detection device 700 may include:

[0115] An acquisition module 710 is used to acquire a target data stream;

[0116] The identification module 720 is used to perform protocol identification on the target data stream to obtain a target protocol type corresponding to the target data stream;

[0117] An extraction module 730, configured to extract target metadata of the target data stream based on the target protocol type;

[0118] The detection module 740 is used to detect the above-mentioned target metadata using the target detection model corresponding to the above-mentioned target protocol type to obtain the target detection result corresponding to the above-mentioned target data stream; the above-mentioned target detection model includes preset detection rules; the above-mentioned target protocol type is different, and the preset detection rules included in the above-mentioned target detection model are also different.

[0119] In some possible embodiments, the preset detection rules include: when the target metadata satisfies the target detection conditions corresponding to the target remote control software, determining that the target data stream belongs to the data stream emitted by the target remote control software; when the target metadata does not satisfy the target detection conditions, determining that the target data stream does not belong to the data stream emitted by the target remote control software; wherein, the target detection conditions included in the preset detection rules are different for different target protocol types; and the target detection conditions are also different for different target remote control software.

[0120] In some possible embodiments, when the target protocol type is the TLS protocol, the target metadata includes at least one of the following: certificate user common name, certificate verification status, certificate chain length, SNI identifier, number of bytes transmitted by the data stream, and data stream transmission time; the preset detection condition includes at least one of the following: the target metadata is located in a preset database, the certificate chain length is within a preset range, and the ratio of the number of bytes transmitted by the data stream to the data stream transmission time is greater than a first threshold; the preset database includes metadata corresponding to historical data streams emitted by the target remote control software; the preset database includes at least one of the following: a preset SNI identifier library, a preset remote control software certificate user library, and a preset certificate verification status library; wherein, if the target remote control software is different, the preset database, the preset range, and the first threshold are also different.

[0121] In some possible embodiments, when the target protocol type is the TCP protocol, the target metadata includes at least one of the following: the number of data packets transmitted by the data stream, the number of bytes transmitted by the data stream, the data stream transmission time, and the payload of the first N non-empty data packets in the target data stream; N is a positive integer; the preset detection conditions include at least one of the following: the proportion of a specific payload sequence in the payload of the first N non-empty data packets is greater than a second threshold, the beginning data packet of the target data stream contains a specific payload identifier, and the ratio of the number of bytes transmitted by the data stream to the data stream transmission time is greater than a third threshold; wherein, the target remote control software is different, and the specific payload sequence, the specific payload identifier, the second threshold, and the third threshold are also different.

[0122] In some possible embodiments, when the target protocol type is the UDP protocol, the target metadata includes at least one of the following: the number of data packets transmitted by the data stream, the number of bytes transmitted by the data stream, the data stream transmission time, and the payload of the first N non-empty data packets in the target data stream; N is a positive integer; the preset detection conditions include at least one of the following: a TCP data stream or a TLS data stream appeared within a preset time period before the target data stream appeared, the proportion of a specific payload sequence in the payload of the first N non-empty data packets was greater than a fourth threshold, the beginning data packet of the target data stream contained a specific payload identifier, and the ratio of the number of bytes transmitted by the data stream to the data stream transmission time was greater than a fifth threshold; wherein, if the target remote control software is different, the specific payload sequence, the specific payload identifier, the fourth threshold, and the fifth threshold are also different.

[0123] In some possible embodiments, the acquisition module 710 is specifically used to: receive the traffic to be detected; and perform data preprocessing on the traffic to be detected to obtain a target data flow.

[0124] In some possible embodiments, the detection module 740 is specifically used to: input the target metadata into a target detection model corresponding to the target protocol type for detection to obtain a target detection result corresponding to the target data stream; the target detection model is trained based on a sample metadata data set of the target protocol type with known detection results.

[0125] The division of each module in the above-mentioned flow detection device is only for illustration. In other embodiments, the flow detection device can be divided into different modules as needed to complete all or part of the functions of the above-mentioned flow detection device. The implementation of each module in the flow detection device provided in the embodiments of this specification can be in the form of a computer program. The computer program can be run on a terminal or a server. The program module constituted by the computer program can be stored in the memory of the terminal or the server. When the computer program is executed by the processor, all or part of the steps of the flow detection method described in the embodiments of this specification are implemented.

[0126] See next Figure 8 , which is a schematic diagram of the structure of an electronic device provided by an exemplary embodiment of this specification. Figure 8 As shown, the electronic device 800 may include: at least one processor 810 , at least one communication bus 820 , a user interface 830 , at least one network interface 840 , and a memory 850 .

[0127] The communication bus 820 may be used to realize the connection and communication among the above-mentioned components.

[0128] The user interface 830 may include buttons, and the optional user interface may also include a standard wired interface or a wireless interface.

[0129] The network interface 840 may optionally include a Bluetooth module, an NFC module, a Wi-Fi module, etc.

[0130] Among them, the processor 810 may include one or more processing cores. The processor 810 uses various interfaces and lines to connect various parts within the entire electronic device 800, and runs or executes instructions, programs, code sets or instruction sets stored in the memory 850, and calls data stored in the memory 850, and various functions and processing data of the electronic device 800. Optionally, the processor 810 can be implemented in at least one hardware form of DSP, FPGA, and PLA. The processor 810 can integrate one or a combination of CPU, GPU, modem, etc. Among them, the CPU mainly processes the operating system, user interface, and application programs; the GPU is responsible for rendering and drawing the content to be displayed on the display screen; the modem is used to handle wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 810, and it can be implemented separately through a chip.

[0131] The memory 850 may include a RAM or a ROM. Optionally, the memory 850 includes a non-transitory computer-readable medium. The memory 850 may be used to store instructions, programs, codes, code sets, or instruction sets. The memory 850 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as obtaining a target data stream, identifying a target protocol type corresponding to a target data stream, extracting target metadata, etc.), instructions for implementing the above-mentioned various method embodiments, etc.; the data storage area may store data involved in the above-mentioned various method embodiments, etc. The memory 850 may optionally be at least one storage device located away from the aforementioned processor 810. As Figure 8 As shown, the memory 850 as a computer storage medium may include an operating system, a network communication module, a user interface module, and program instructions.

[0132] In some possible embodiments, the electronic device 800 may be the aforementioned Figure 7In the flow detection device 700 shown, the processor 810 can be used to call the program instructions stored in the memory 850, and specifically perform the following operations: obtain the target data stream; perform protocol identification on the above-mentioned target data stream to obtain the target protocol type corresponding to the above-mentioned target data stream; based on the above-mentioned target protocol type, extract the target metadata of the above-mentioned target data stream; use the target detection model corresponding to the above-mentioned target protocol type to detect the above-mentioned target metadata to obtain the target detection result corresponding to the above-mentioned target data stream; the above-mentioned target detection model includes preset detection rules; different target protocol types include different preset detection rules.

[0133] In some possible embodiments, the preset detection rules include: when the target metadata satisfies the target detection conditions corresponding to the target remote control software, determining that the target data stream belongs to the data stream emitted by the target remote control software; when the target metadata does not satisfy the target detection conditions, determining that the target data stream does not belong to the data stream emitted by the target remote control software; wherein, the target detection conditions included in the preset detection rules are different for different target protocol types; and the target detection conditions are also different for different target remote control software.

[0134] In some possible embodiments, when the target protocol type is the TLS protocol, the target metadata includes at least one of the following: certificate user common name, certificate verification status, certificate chain length, SNI identifier, number of bytes transmitted by the data stream, and data stream transmission time; the preset detection condition includes at least one of the following: the target metadata is located in a preset database, the certificate chain length is within a preset range, and the ratio of the number of bytes transmitted by the data stream to the data stream transmission time is greater than a first threshold; the preset database includes metadata corresponding to historical data streams emitted by the target remote control software; the preset database includes at least one of the following: a preset SNI identifier library, a preset remote control software certificate user library, and a preset certificate verification status library; wherein, if the target remote control software is different, the preset database, the preset range, and the first threshold are also different.

[0135] In some possible embodiments, when the target protocol type is the TCP protocol, the target metadata includes at least one of the following: the number of data packets transmitted by the data stream, the number of bytes transmitted by the data stream, the data stream transmission time, and the payload of the first N non-empty data packets in the target data stream; N is a positive integer; the preset detection conditions include at least one of the following: the proportion of a specific payload sequence in the payload of the first N non-empty data packets is greater than a second threshold, the beginning data packet of the target data stream contains a specific payload identifier, and the ratio of the number of bytes transmitted by the data stream to the data stream transmission time is greater than a third threshold; wherein, the target remote control software is different, and the specific payload sequence, the specific payload identifier, the second threshold, and the third threshold are also different.

[0136] In some possible embodiments, when the target protocol type is the UDP protocol, the target metadata includes at least one of the following: the number of data packets transmitted by the data stream, the number of bytes transmitted by the data stream, the data stream transmission time, and the payload of the first N non-empty data packets in the target data stream; N is a positive integer; the preset detection conditions include at least one of the following: a TCP data stream or a TLS data stream appeared within a preset time period before the target data stream appeared, the proportion of a specific payload sequence in the payload of the first N non-empty data packets was greater than a fourth threshold, the beginning data packet of the target data stream contained a specific payload identifier, and the ratio of the number of bytes transmitted by the data stream to the data stream transmission time was greater than a fifth threshold; wherein, if the target remote control software is different, the specific payload sequence, the specific payload identifier, the fourth threshold, and the fifth threshold are also different.

[0137] In some possible embodiments, when the processor 810 executes the above-mentioned acquisition of the target data stream, it is specifically used to execute: receiving the traffic to be detected; and performing data preprocessing on the above-mentioned traffic to be detected to obtain the target data stream.

[0138] In some possible embodiments, when the processor 810 executes the detection of the target metadata using the target detection model corresponding to the target protocol type to obtain the target detection result corresponding to the target data stream, it is specifically used to execute: inputting the target metadata into the target detection model corresponding to the target protocol type for detection to obtain the target detection result corresponding to the target data stream; the target detection model is trained based on a sample metadata data set of the target protocol type with known detection results.

[0139] The embodiment of the present application also provides a computer storage medium, which stores instructions, and when the instructions are executed on a computer or a processor, the computer or the processor executes one or more steps in any of the above methods. If the components of the above flow detection device are implemented in the form of software functional units and sold or used as independent products, they can be stored in the above storage medium.

[0140] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The above computer program product includes one or more computer instructions. When the above computer program instructions are loaded and executed on a computer, the above process or function according to the embodiment of the present application is generated in whole or in part. The above computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The above computer instructions can be stored in a computer-readable storage medium or transmitted by the above computer-readable storage medium. The above computer instructions can be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.). The above computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integration. The above available medium can be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid state drive (SSD)), etc.

[0141] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk and other media that can store program codes. In the absence of conflict, the technical features in this embodiment and the implementation scheme can be combined arbitrarily.

[0142] The above-mentioned embodiments are merely preferred embodiments of the present application and are not intended to limit the scope of the present application. Without departing from the design spirit of the present application, various modifications and improvements made to the technical solutions of the present application by ordinary technicians in this field should fall within the protection scope determined by the claims of the present application.

Claims

1. A flow detection method, characterized in that: include: Get the target data stream; Performing protocol identification on the target data stream to obtain a target protocol type corresponding to the target data stream; Extracting target metadata of the target data stream based on the target protocol type; Detecting the target metadata using a target detection model corresponding to the target protocol type to obtain a target detection result corresponding to the target data stream; The target detection model includes preset detection rules; the preset detection rules included in the target detection model are different depending on the target protocol type.

2. The method according to claim 1, characterized in that The preset detection rules include: In the case where the target metadata meets the target detection condition corresponding to the target remote control software, determining that the target data flow belongs to the data flow sent by the target remote control software; In the case that the target metadata does not satisfy the target detection condition, determining that the target data stream does not belong to the data stream sent by the target remote control software; Among them, the target detection conditions included in the preset detection rules are different when the target protocol types are different; the target detection conditions are also different when the target remote control software is different.

3. The method according to claim 2, characterized in that In the case where the target protocol type is the TLS protocol, the target metadata includes at least one of the following: a certificate subject common name, a certificate verification status, a certificate chain length, an SNI identifier, a number of bytes transmitted by a data stream, and a data stream transmission time; The preset detection condition includes at least one of the following: the target metadata is located in a preset database, the certificate chain length is within a preset range, and the ratio of the number of bytes transmitted by the data stream to the data stream transmission time is greater than a first threshold; the preset database includes metadata corresponding to the historical data stream sent by the target remote control software; the preset database includes at least one of the following: a preset SNI identifier library, a preset remote control software certificate user library, and a preset certificate verification status library; Among them, the target remote control software is different, and the preset database, the preset range, and the first threshold are also different.

4. The method according to claim 2, characterized in that In the case where the target protocol type is the TCP protocol, the target metadata includes at least one of the following: the number of data packets transmitted by the data stream, the number of bytes transmitted by the data stream, the data stream transmission time, and the payload of the first N non-empty data packets in the target data stream; N is a positive integer; The preset detection condition includes at least one of the following: the proportion of the specific payload sequence in the payload of the first N non-empty data packets is greater than the second threshold, the first data packet of the target data stream contains a specific payload identifier, and the ratio of the number of bytes transmitted by the data stream to the transmission time of the data stream is greater than the third threshold; Among them, the target remote control software is different, and the specific load sequence, the specific load identifier, the second threshold, and the third threshold are also different.

5. The method according to claim 2, characterized in that In the case where the target protocol type is UDP protocol, the target metadata includes at least one of the following: the number of data packets transmitted by the data stream, the number of bytes transmitted by the data stream, the data stream transmission time, and the payload of the first N non-empty data packets in the target data stream; N is a positive integer; The preset detection condition includes at least one of the following: a TCP data flow or a TLS data flow has appeared within a preset time period before the target data flow appears, the proportion of a specific load sequence in the payload of the first N non-empty data packets is greater than a fourth threshold, the first data packet of the target data flow contains a specific load identifier, and the ratio of the number of bytes transmitted by the data flow to the transmission time of the data flow is greater than a fifth threshold; Among them, the target remote control software is different, and the specific load sequence, the specific load identifier, the fourth threshold, and the fifth threshold are also different.

6. The method according to claim 1, characterized in that The step of obtaining the target data stream comprises: Receive traffic to be detected; Data preprocessing is performed on the traffic to be detected to obtain a target data flow.

7. The method according to claim 1, characterized in that The detecting the target metadata using the target detection model corresponding to the target protocol type to obtain the target detection result corresponding to the target data stream includes: The target metadata is input into a target detection model corresponding to the target protocol type for detection to obtain a target detection result corresponding to the target data stream; the target detection model is trained based on a sample metadata data set of the target protocol type with known detection results.

8. A flow detection device, characterized in that: include: An acquisition module, used to acquire a target data stream; An identification module, used to perform protocol identification on the target data stream to obtain a target protocol type corresponding to the target data stream; An extraction module, configured to extract target metadata of the target data stream based on the target protocol type; A detection module, used to detect the target metadata using a target detection model corresponding to the target protocol type, and obtain a target detection result corresponding to the target data stream; The target detection model includes preset detection rules; the preset detection rules included in the target detection model are different depending on the target protocol type.

9. An electronic device, characterized in that: include: A processor and a memory; wherein the memory stores an executable program code, and the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to execute the method according to any one of claims 1 to 7.

10. A computer storage medium, characterized in that: The computer storage medium stores a plurality of instructions, which are suitable for being loaded by a processor and executing the method steps according to any one of claims 1-7.

Images