Method and device for detecting threat degree of encrypted traffic and computer equipment

Abstract

The invention discloses an encrypted traffic threat degree detection method and device and computer equipment. The method comprises the steps that a traffic mirror image of full traffic is acquired, session reorganization is carried out on the traffic mirror image, reorganized traffic is obtained, and the traffic mirror image comprises encrypted traffic; the recombined traffic is decrypted by adopting a multi-dimensional decryption mode to obtain plaintext traffic, and the multi-dimensional decryption mode at least comprises one of decryption by adopting a decryption algorithm library, decryption by adopting a certificate and decryption by adopting a standard encryption and decryption algorithm; the plaintext traffic is detected in multiple modes to obtain multiple detection results, the multiple detection results are fused to obtain a final detection result, and the detection result is used for indicating the threat degree of the traffic. According to the method and the device, the technical problem of relatively low detection accuracy of the threat degree of the encrypted traffic in related technologies is solved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and more specifically, to a method, device and computer equipment for detecting the threat level of encrypted traffic. Background Art

[0002] With the widespread application of encryption technology, network traffic is increasingly encrypted, posing a huge challenge to network security protection. Traditional security devices based on plaintext analysis are difficult to deal with threats in encrypted traffic. Malware and attackers gradually hide their attack behaviors in encrypted communications to evade detection. The existing technology has the following shortcomings: Most security devices cannot decrypt and analyze encrypted traffic, resulting in detection blind spots. Detection methods based on rules and signatures are difficult to adapt to the ever-changing means of attack. Lack of effective threat intelligence and traceability analysis methods make it impossible to track and locate the source of threats. The detection model is slow to update and iterate, making it difficult to quickly respond to new threats. Summary of the invention

[0003] The embodiments of the present application provide a method, apparatus, and computer device for detecting the threat level of encrypted traffic, so as to at least solve the technical problem of low accuracy in detecting the threat level of encrypted traffic in the related art.

[0004] According to one aspect of an embodiment of the present application, a method for detecting the threat level of encrypted traffic is provided, including: obtaining a traffic mirror of the entire traffic, and performing session reassembly on the traffic mirror to obtain reassembled traffic, wherein the traffic mirror includes encrypted traffic; decrypting the reassembled traffic using a multi-dimensional decryption method to obtain plaintext traffic, and the multi-dimensional decryption method includes at least one of the following: decrypting using a decryption algorithm library, decrypting using a certificate, and decrypting using a standard encryption and decryption algorithm; detecting the plaintext traffic using multiple methods to obtain multiple detection results, fusing the multiple detection results to obtain a final detection result, and the detection result is used to indicate the threat level of the traffic.

[0005] Optionally, a multi-dimensional decryption method is used to decrypt the reassembled traffic to obtain plaintext traffic, including: when the multi-dimensional decryption method is to use a certificate for decryption, extracting the encryption key suite of the reassembled traffic; obtaining a private key corresponding to the reassembled traffic through the certificate corresponding to the reassembled traffic, decrypting the encryption key suite, and obtaining a symmetric encryption key for subsequent communications; decrypting the reassembled traffic based on the symmetric encryption key to obtain plaintext traffic; when it is detected that the certificate corresponding to the reassembled traffic is updated, updating the private key corresponding to the reassembled traffic, and when the session corresponding to the reassembled traffic belongs to the certificate before the update, using the private key before the update for decryption until the session belonging to the certificate before the update ends; after the session belonging to the certificate before the update ends, all sessions corresponding to the reassembled traffic are decrypted using the updated private key.

[0006] Optionally, at least one method is selected from multiple methods to detect plaintext traffic and obtain a detection result, wherein the multiple methods include: rule detection, fingerprint detection and model detection, wherein rule detection includes: matching the characteristics of plaintext traffic with the rule set in a preset detection rule library, fingerprint detection includes: comparing the fingerprint information of the plaintext traffic with the fingerprint information in a preset fingerprint library, and model detection includes: using a pre-trained model to identify the characteristics of the plaintext traffic.

[0007] Optionally, at least one method is selected from a plurality of methods to detect the plaintext traffic and obtain a detection result, including: when the detection method of the rule detection is adopted, the plaintext traffic is restored to plaintext data; the characteristics of the plaintext data are matched with the rule set in the preset detection rule library, and when the characteristics of the plaintext data match any rule in the rule set, the detection result is determined to be that the plaintext traffic corresponding to the plaintext data is threatening traffic, wherein any rule in the rule set is used to represent the characteristics of threatening traffic, and when the characteristics of the plaintext data are the same as the characteristics of the threatening traffic, it is determined that the characteristics of the plaintext data match the rules in the rule set; when fingerprint detection is adopted, the plaintext traffic is obtained. Fingerprint information is used to characterize feature information obtained during the handshake process between the server and the client; the similarity between the fingerprint information and the fingerprint information in a preset fingerprint library is obtained, and when the similarity is higher than a preset similarity threshold, the plaintext traffic corresponding to the fingerprint information is determined to be threatening traffic; in the case of using model detection, the traffic statistical characteristics of the plaintext traffic are obtained as input of a pre-trained model, and the output of the pre-trained model is obtained, wherein the output of the pre-trained model includes: a threat level score of the plaintext traffic, and the statistical characteristics of the plaintext traffic include at least: a request method of the plaintext traffic, a URI length of the plaintext traffic, and the number of parameters corresponding to the plaintext traffic; based on the output of the pre-trained model, it is determined whether the plaintext traffic is threatening traffic.

[0008] Optionally, the method also includes: obtaining honeypot data, the honeypot data includes: multiple attack traffic data; extracting multi-dimensional features of traffic attack behavior from the multiple attack traffic data, the multi-dimensional features of attack behavior include: network layer features, host layer features and application layer features, wherein the network layer features at least include: source IP, port and protocol of the attack traffic, the host layer features at least include: system operation information and file read and write information of the attacker, and the application layer features at least include: URL parameters of the network attack and SQL injection statements of the network attack; building a honeypot model based on the multi-dimensional features of the traffic attack behavior, and using the honeypot model to analyze the plaintext traffic to obtain initial detection results, and inputting the initial detection results into a pre-trained model to output detection results.

[0009] Optionally, the method also includes: obtaining a source code corpus, and dividing the source code in the source code corpus into token sequences; compiling the source code in the source code corpus into an intermediate representation; constructing a control flow graph of the program based on the intermediate representation; performing feature extraction on the token sequence and the control flow graph of the program respectively to obtain source code sequence features and program structure graph features; training a vulnerability detection model based on the source code sequence features and the program structure graph features, and the vulnerability detection model is used to detect vulnerabilities in the server system.

[0010] Optionally, a plurality of methods are used to detect plaintext traffic to obtain a plurality of detection results, including: extracting multi-dimensional features from the plaintext traffic, the multi-dimensional features at least including: network layer features, application layer features, content features and behavior features, the network layer features at least including: IP address, port, protocol type, the application layer features at least including: HTTP header information, TLS handshake parameters, the content features at least including: keywords and byte distribution in the payload, the behavior features at least including: connection duration, data transmission mode; at least one method is selected from the plurality of methods to detect the multi-dimensional features to obtain the detection results, wherein the plurality of methods include: rule detection, fingerprint detection and model detection, wherein rule detection includes: matching the multi-dimensional features with the rule set in the preset detection rule library, fingerprint detection includes: comparing the fingerprint information of the plaintext traffic with the fingerprint information in the preset fingerprint library, and model detection includes: using a pre-trained model to identify the multi-dimensional features.

[0011] Optionally, multiple detection results are integrated to obtain a final detection result, and the detection result is used to indicate the threat level of the traffic, including: obtaining the threat level scores indicated by multiple detection results; obtaining the weight corresponding to each detection result; and determining the final detection result based on the weight corresponding to each detection result and the threat level score indicated by each detection result.

[0012] Optionally, a plurality of detection results are integrated to obtain a final detection result, including: obtaining each detection result to respectively determine different characteristics of the plaintext traffic; and determining the traffic type of the traffic mirror based on the different characteristics of the plaintext traffic.

[0013] According to another aspect of an embodiment of the present application, there is also provided a device for detecting the threat level of encrypted traffic, including: an acquisition module, used to obtain a traffic mirror of the entire traffic, and perform session reorganization on the traffic mirror to obtain reorganized traffic, wherein the traffic mirror includes encrypted traffic; a decryption module, used to decrypt the reorganized traffic using a multi-dimensional decryption method to obtain plaintext traffic, and the multi-dimensional decryption method includes at least one of the following: decryption using a decryption algorithm library, decryption using a certificate, and decryption using a standard encryption and decryption algorithm; a detection module, used to detect the plaintext traffic using multiple methods to obtain multiple detection results, and to fuse the multiple detection results to obtain a final detection result, and the detection result is used to indicate the threat level of the traffic.

[0014] According to another aspect of an embodiment of the present application, a computer device is also provided, including: a memory and a processor, wherein the memory is used to store program instructions; and the processor is connected to the memory and is used to execute the above-mentioned method for detecting the threat level of encrypted traffic.

[0015] According to another aspect of an embodiment of the present application, a non-volatile storage medium is also provided, which includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the above-mentioned method for detecting the threat level of encrypted traffic by running the computer program.

[0016] According to another aspect of the embodiments of the present application, a computer program product is also provided, including computer instructions, which, when executed by a processor, implement the above-mentioned method for detecting the threat level of encrypted traffic.

[0017] In an embodiment of the present application, a traffic mirror of the entire traffic is obtained, and a session is reassembled on the traffic mirror to obtain reassembled traffic, wherein the traffic mirror includes encrypted traffic; a multi-dimensional decryption method is used to decrypt the reassembled traffic to obtain plaintext traffic, and the multi-dimensional decryption method includes at least one of the following: decryption using a decryption algorithm library, decryption using a certificate, and decryption using a standard encryption and decryption algorithm; a plurality of methods are used to detect the plaintext traffic to obtain a plurality of detection results, and the plurality of detection results are integrated to obtain a final detection result, and the detection result is used to indicate the threat level of the traffic, thereby achieving the purpose of decrypting the encrypted traffic before detecting it, thereby achieving the technical effect of improving the accuracy of detecting the threat level of the encrypted traffic, and thus solving the technical problem of low accuracy of detecting the threat level of the encrypted traffic in the related technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0019] Figure 1 It is a hardware structure block diagram of a computer terminal for implementing a method for detecting the threat level of encrypted traffic according to an embodiment of the present application;

[0020] Figure 2 is a flow chart of a method for detecting the threat level of encrypted traffic according to an embodiment of the present application;

[0021] Figure 3 It is a structural diagram of a device for detecting the threat level of encrypted traffic according to an embodiment of the present application. DETAILED DESCRIPTION

[0022] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0023] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0024] The information collected in the embodiments of the present application is information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with the relevant laws, regulations and standards of the relevant regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or reject automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered.

[0025] In order to solve the problems existing in the related art, the embodiment of the present application provides a method for detecting the threat level of encrypted traffic, which can be run on Figure 1 In the computer terminal shown, the computer terminal is explained below.

[0026] The encrypted traffic threat level detection method embodiment provided in the embodiment of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 The hardware structure block diagram of a computer terminal for implementing a method for detecting the threat level of encrypted traffic is shown. Figure 1 As shown, the computer terminal 10 may include one or more (102a, 102b, ..., 102n are used to illustrate) processors (the processor may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission module 106 for communication functions connected via a wired and / or wireless network. In addition, it may also include: a display, a keyboard, a cursor control device, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, and a BUS bus. Those skilled in the art can understand that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown.

[0027] It should be noted that the one or more processors and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 10. As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0028] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the method for detecting the threat level of encrypted traffic in the embodiment of the present application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, the above-mentioned method for detecting the threat level of encrypted traffic is realized. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely arranged relative to the processor, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0029] The transmission module 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission module 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission module 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0030] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 .

[0031] It should be noted that, in some optional embodiments, the above Figure 1 The computer terminal shown may include hardware elements (including circuits), software elements (including computer code stored on a computer-readable medium), or a combination of hardware elements and software elements. It should be noted that Figure 1 This is merely one example of a particular embodiment and is intended to illustrate the types of components that may be present in the computer terminal described above.

[0032] In the above-mentioned operating environment, an embodiment of the present application provides an embodiment of a method for detecting the threat level of encrypted traffic. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0033] Figure 2 is a flow chart of a method for detecting the threat level of encrypted traffic according to an embodiment of the present application, such as Figure 2 As shown, the method comprises the following steps:

[0034] Step S202, obtaining a traffic mirror of the entire traffic, and performing session reorganization on the traffic mirror to obtain reorganized traffic, wherein the traffic mirror includes encrypted traffic;

[0035] In step S202, the specific steps of full traffic mirroring and access are as follows:

[0036] Step 1.1: Deploy traffic mirroring equipment at the network egress to replicate all traffic in real time.

[0037] Step 1.1.1, select a suitable traffic mirroring solution, such as TAP (Test Access Point), SPAN (Switch Port Analyzer), etc.

[0038] Among them, the TAP solution deploys physical splitter devices in parallel on the network link to losslessly replicate bidirectional traffic; the SPAN solution forwards the traffic of the designated port to the mirror port through the switch mirror port.

[0039] It is understandable that the mirroring device must be able to support the preset throughput to ensure that the traffic mirroring is consistent with the original traffic and there is no packet loss. The preset throughput should meet the network peak demand, for example: not less than 10Gbps. The mirroring device must have traffic caching capabilities to cope with burst traffic.

[0040] Step 1.1.2: Deploy redundant mirroring devices to prevent single point failures from affecting data collection.

[0041] It should be noted that when deploying redundant mirroring devices, you can use high-availability solutions such as master-slave and load balancing. Configure automatic fault switching and alarm mechanisms.

[0042] Step 1.2: Transmit the traffic mirror to the threat detection and tracing system (a system for executing the method provided in the embodiment of the present application) through a dedicated secure channel.

[0043] Step 1.2.1: Plan the transmission network for traffic mirroring to ensure that bandwidth and latency meet requirements.

[0044] Among them, the transmission network should be independent of the business network to avoid affecting normal business. The transmission network bandwidth should not be lower than the preset value, for example: 40Gbps, and support linear expansion; the network delay is less than the preset delay, for example: 1ms, to ensure the real-time nature of the data.

[0045] Step 1.2.2: Traffic mirroring must be encrypted throughout the transmission process to prevent data leakage and tampering.

[0046] There are many encryption algorithms for encrypted transmission, such as IPSec (Internet Protocol Security) and MACsec (Media Access Control security).

[0047] During the encryption process, server-level encryption equipment is used to ensure sufficient encryption processing performance.

[0048] Step 1.2.3: Reassemble the incoming traffic mirror for subsequent protocol analysis.

[0049] The data is reassembled according to the five-tuple information (source IP, source port, destination IP, destination port, protocol) of the traffic mirror to obtain the reassembled traffic.

[0050] Through the above steps, you can build an efficient, reliable, secure and real-time full-flow mirror access solution. This is the data basis of the threat detection system and a prerequisite for subsequent detection work. At the same time, this solution can also be reused in other scenarios such as network performance monitoring and fault diagnosis to improve the overall network operation and maintenance level. At the same time, due to the use of large-capacity cache, it can ensure that stateless UDP data packets can also be correctly reassembled.

[0051] Step S204, decrypting the reassembled traffic using a multi-dimensional decryption method to obtain plaintext traffic, where the multi-dimensional decryption method includes at least one of the following: decrypting using a decryption algorithm library, decrypting using a certificate, and decrypting using a standard encryption and decryption algorithm;

[0052] In step S204, the multi-dimensional decryption method includes: decryption using a decryption algorithm library, decryption using a certificate, and decryption using a standard encryption and decryption algorithm. The decryption algorithm library is used for real-time decryption of encrypted traffic encrypted by TLS (Transport Layer Security) and SSL (Secure Sockets Layer).

[0053] Use the certificate to obtain and update the server private key, and use the private key to decrypt the encrypted traffic.

[0054] Decrypt encrypted traffic using standard encryption and decryption algorithms.

[0055] Step S206, using multiple methods to detect the plaintext traffic, obtaining multiple detection results, integrating the multiple detection results to obtain a final detection result, and the detection result is used to indicate the threat level of the traffic.

[0056] Through the above steps S202 to S206, by obtaining the traffic mirror of the entire traffic and reassembling the traffic mirror for a session, the reassembled traffic is obtained, wherein the traffic mirror contains encrypted traffic; the reassembled traffic is decrypted by a multi-dimensional decryption method to obtain plaintext traffic, and the multi-dimensional decryption method includes at least one of the following: decryption by a decryption algorithm library, decryption by a certificate, and decryption by a standard encryption and decryption algorithm; the plaintext traffic is detected by multiple methods to obtain multiple detection results, and the multiple detection results are integrated to obtain the final detection result, and the detection result is used to indicate the threat level of the traffic, thereby achieving the purpose of decrypting the encrypted traffic before detection, thereby achieving the technical effect of improving the accuracy of the threat level detection of the encrypted traffic, and thus solving the technical problem of low accuracy of the threat level detection of the encrypted traffic in the related technology. The following is a detailed description.

[0057] In the technical solution provided in step S204 of the above-mentioned method for detecting the threat level of encrypted traffic, a multi-dimensional decryption method is used to decrypt the reassembled traffic to obtain plaintext traffic, including: when the multi-dimensional decryption method is to use a certificate for decryption, extract the encryption key suite of the reassembled traffic; obtain the private key corresponding to the reassembled traffic through the certificate corresponding to the reassembled traffic, decrypt the encryption key suite, and obtain the symmetric encryption key for subsequent communication; decrypt the reassembled traffic based on the symmetric encryption key to obtain the plaintext traffic; when it is detected that the certificate corresponding to the reassembled traffic is updated, update the private key corresponding to the reassembled traffic, and when the session corresponding to the reassembled traffic belongs to the certificate before the update, use the private key before the update to decrypt until the session belonging to the certificate before the update ends; after the session belonging to the certificate before the update ends, all sessions corresponding to the reassembled traffic are decrypted using the updated private key.

[0058] Specifically, the certificate can be used for decryption through the following steps, including:

[0059] Step 1: Obtain and update the server private key to ensure decryption capabilities.

[0060] Step 1.1, deploy a certificate management system to centrally manage all SSL / TLS certificates within the organization.

[0061] Among them, the certificate management system can adopt mature certificate management platforms such as Venafi, OpenCA, etc.

[0062] Role-based access control (RBAC) strictly limits access to private keys and reduces the risk of certificate misconfiguration and expiration through centralized management.

[0063] Step 2: Set up the traffic decryption module to connect with the certificate management system and synchronize certificate information.

[0064] Specifically, through the API interface of the certificate management system, the certificates used by the business system can be queried in real time; the public key, private key, validity period and other metadata information of the certificate can be synchronized; sensitive information such as the private key can be encrypted and stored to ensure security.

[0065] Step 3: The decryption module dynamically decrypts TLS traffic based on the synchronized certificate private key.

[0066] Specifically, extract the encryption key suite in the TLS traffic, such as SessionKey; use the private key to decrypt the encryption key suite to obtain the symmetric encryption key for subsequent communications; and decrypt the application layer data in the TLS session based on the symmetric key.

[0067] Step 4: When the certificate changes, the decryption module automatically updates the private key information to ensure that decryption is not interrupted.

[0068] The specific update steps are as follows: when the business system certificate is changed, the certificate management system sends a change notification; the decryption module pulls the new certificate private key from the certificate management system; the new private key is smoothly switched to decrypt the newly created connection.

[0069] To explain the certificate renewal process more clearly, an example is given below:

[0070] To ensure the security of HTTPS (Hypertext Transfer Protocol Secure) services, e-commerce platforms frequently change SSL certificates. In the event of a certificate change, follow the steps below to complete the service transition:

[0071] Step 1: The e-commerce platform imports the newly applied certificate into the certificate management system and automatically pushes it to the business server after approval.

[0072] Step 2: Subscribe to certificate changes and obtain new certificate metadata from the certificate management system API.

[0073] Step 3: When the certificate takes effect, the decryption system automatically updates the private key information and switches to using the new private key for decryption.

[0074] Step 4: For the session with the old certificate, the decryption system continues to use the old private key until the session ends.

[0075] Step 5: After the new certificate takes full effect, all new connections are decrypted using the new private key to ensure a smooth transition of services.

[0076] By linking with the certificate management system, the traffic decryption system can adapt to changes in business certificates and continuously and efficiently decrypt SSL traffic. This solution avoids the risk of omissions caused by manual configuration and improves the reliability of decryption. At the same time, by encrypting and protecting sensitive information such as private keys, unauthorized use of certificates is prevented, and security risks are controlled to the greatest extent.

[0077] In some embodiments of the present application, multiple methods are used to detect plaintext traffic, and the specific steps for obtaining multiple detection results are as follows: select at least one method from multiple methods to detect plaintext traffic and obtain detection results, wherein the multiple methods include: rule detection, fingerprint detection and model detection, wherein rule detection includes: matching the characteristics of plaintext traffic with the rule set in a preset detection rule library, fingerprint detection includes: comparing the fingerprint information of plaintext traffic with the fingerprint information in a preset fingerprint library, and model detection includes: using a pre-trained model to identify the characteristics of plaintext traffic.

[0078] Wherein, when the detection is performed in the manner of rule detection, the plaintext traffic is restored to plaintext data; the characteristics of the plaintext data are matched with the rule set in the preset detection rule library, and when the characteristics of the plaintext data match any rule in the rule set, it is determined that the detection result is that the plaintext traffic corresponding to the plaintext data is threatening traffic, wherein any rule in the rule set is used to represent the characteristics of threatening traffic, and when the characteristics of the plaintext data are the same as the characteristics of the threatening traffic, it is determined that the characteristics of the plaintext data match the rules in the rule set;

[0079] Specifically, the deployment rule detection engine, the specific detection process is as follows:

[0080] Step 1: Deploy a detection rule library with built-in 150+ common encryption attack tools.

[0081] Step 2: Perform multi-mode rule matching analysis based on the decrypted plaintext traffic. The rule engine supports flexible customization and allows new detection rules to be added quickly.

[0082] Taking Cobalt Strike (CS) attack detection as an example, the workflow of the rule detection engine is explained in detail.

[0083] It should be noted that Cobalt Strike is a common commercial penetration testing tool, but it is also often abused by hackers for actual attacks. Its communication is mainly encrypted traffic, which is difficult to detect with traditional detection methods.

[0084] Step 1: Deploy a detection rule library for common encryption attack tools, including:

[0085] Obtain the communication protocol and behavior characteristics of Cobalt Strike. CS uses SSL encrypted communication by default, and the ports are usually 443, 8443, etc.; CS beacon communication uses the HTTP protocol; the URI structure has certain rules.

[0086] For example: extract keywords of CS traffic such as "30820", "2d2d2d2d", " / jquery-3.3.1.min.js", etc.

[0087] Step 2: Develop detection rules based on features to form a CS rule base.

[0088] The rule syntax may adopt the mature Snort and Suricata formats, for example:

[0089] alert tcp any any->any$HTTP_PORTS(msg:"Suspected Cobalt StrikeBeacon";

[0090] ssl_version:tls1.2; content:" / jquery-3.3.1.min.js"; sid:100001;), which means: It identifies possible Cobalt Strike Beacon activities by detecting specific encrypted HTTP traffic (especially URLs that use TLS1.2 and contain " / jquery-3.3.1.min.js"). When matching traffic is detected, it will issue an alarm to help security personnel discover and respond to potential network threats in a timely manner.

[0091] Combined with threat intelligence, supplemented with other known CS server IP, domain name and other information.

[0092] Step 3: Based on the decrypted plaintext traffic, perform multi-mode rule matching analysis, including: restoring the decrypted traffic to plaintext data to extract the HTTP protocol request header and message body data; performing URL decoding on the request parameters to restore the original data content. Input the plaintext traffic into the rule engine for multi-mode matching.

[0093] Specifically, multi-mode matching algorithms such as AC automata and Wu-Manber are used to achieve efficient matching, and an alarm is triggered when the traffic successfully matches any rule in the rule set.

[0094] It should be noted that the AC automaton can build a pattern tree to search for multiple feature strings at the same time, while the Wu-Manber algorithm can search for multiple different patterns in the text without multiple scans.

[0095] It should also be noted that the rule engine supports flexible customization and new detection rules can be added quickly.

[0096] Specifically, follow up Cobalt Strike updates and extract communication features of new versions. For example, CS 4.0 uses a new Beacon configuration file syntax. Pay attention to emergency vulnerability warnings and analyze changes in CS attack chains. Iterate the rule base based on new features to maintain the effectiveness of detection rules. Rule definitions follow standard formats to ensure rule quality and maintainability.

[0097] It should be noted that the newly added rules have been fully tested to control the false positive rate. The rule base supports hot updates without restarting the detection engine. The updated rules take effect in real time and detect new threat variants as soon as possible.

[0098] To better understand the rule detection process, an example is given below to further explain it.

[0099] A large amount of suspicious encrypted traffic suddenly appeared in the intranet of an institution. After analysis, it was found that multiple hosts continued to initiate SSL connections to overseas IP addresses.

[0100] 1. Decrypt the traffic and restore the plaintext of SSL traffic, and find that it is HTTP traffic.

[0101] 2. The rule engine matches the URI features of Cobalt Strike, such as " / jquery-3.3.1.min.js".

[0102] 3. It was determined to be a Cobalt Strike botnet, and the C&C server was identified through the IP intelligence of the rule base.

[0103] 4. Rapidly isolate the victim host, block C&C communication, and prevent the attack from expanding.

[0104] 5. Follow up on the latest CS variants, extract targeted detection rules, and add them to the rule engine.

[0105] With a massive built-in attack tool rule library and support for flexible customization of new rules, the rule detection engine can continuously discover various hidden attacks in encrypted traffic, leaving attackers nowhere to hide. At the same time, the rule engine adopts an efficient multi-mode matching mechanism, which can achieve real-time detection without affecting business, providing a solid guarantee for the performance and efficiency of the entire detection system.

[0106] When fingerprint detection is used, fingerprint information of the plaintext traffic is obtained to characterize the feature information obtained during the handshake process between the server and the client; the similarity between the fingerprint information and the fingerprint information in the preset fingerprint library is obtained, and when the similarity is higher than the preset similarity threshold, the plaintext traffic corresponding to the fingerprint information is determined to be threatening traffic.

[0107] The specific fingerprint detection process is as follows:

[0108] Step 1: Build a 300+ CS fingerprint feature library to extract TLS fingerprint information from encrypted traffic.

[0109] Step 2: Use fingerprint matching algorithm to achieve fast and accurate malware family identification.

[0110] Step 3: The fingerprint library supports automatic cloud updates to maintain the ability to identify new variant families.

[0111] Taking the Cobalt Strike variant used by the APT41 organization as an example, the working principle of the fingerprint detection mechanism is explained in detail.

[0112] Step 1: 300+ CS fingerprint feature libraries to extract TLS fingerprint information from encrypted traffic, including:

[0113] Step 1.1, collect various CS samples, including malicious traffic captured in the wild and honeypot system records.

[0114] Obtain CS variant samples used by APT41 and other organizations.

[0115] Through the globally deployed honeypot network, CS traffic that imitates legitimate business is actively captured.

[0116] Step 1.2, extract the network behavior fingerprint of CS variants and build a fingerprint library.

[0117] Specifically, we collect CS configuration files; use the sandbox system to run CS samples in a controllable environment and extract the TLS fingerprints they generate, such as the cipher suite, compression method, extension, and other fields in the TLS Client Hello. We also extract metadata information such as the issuer and validity period of the SSL certificate. We semi-automatically optimize the fingerprints so that they can match different variants of the same family.

[0118] Step 2: Use fingerprint matching algorithms to achieve fast and accurate malware family identification, including:

[0119] Step: 2.1, after decrypting the traffic, extract its TLS fingerprint information.

[0120] It can be understood that the fingerprint information of the traffic can be extracted in two ways. One is to passively extract the TLS negotiation process in the plaintext traffic; the second is to actively initiate a TLS request and obtain the fingerprint information returned by the server.

[0121] Step 2.2, compare the extracted fingerprint with the feature library.

[0122] The specific comparison method is: use a similarity algorithm, such as the Jaccard coefficient, to calculate the similarity of the fingerprint, and perform a one-to-many match with the known family fingerprints in the feature library. When the similarity exceeds the similarity threshold, for example, 90%, it is determined to be the malware family.

[0123] Step 3: The fingerprint database supports automatic cloud updates to maintain the ability to identify new variant families, including:

[0124] Step 3.1, establish a malware fingerprint cloud management platform.

[0125] It is understandable that the fingerprint cloud management platform aggregates fingerprint data from multiple institutions to achieve fingerprint sharing and joint defense. Member units can submit new fingerprints they discover, which will be reviewed and confirmed by platform experts.

[0126] Step 3.2, the fingerprint library is automatically synchronized with the cloud for updates.

[0127] The terminal detection device regularly pulls the latest fingerprint library from the cloud. The updated fingerprint library takes effect immediately and is applied to local traffic detection.

[0128] To better understand the rule detection process, an example is given below to further explain it.

[0129] A department was suspected of being attacked by a targeted attack. The attacker used a CS variant disguised as normal business traffic to evade traditional detection.

[0130] 1. After the encrypted traffic is decrypted and extracted, the abnormal TLS fingerprint is extracted:

[0131] Client Hello enables uncommon compression methods such as DEFLATE.

[0132] The server certificate contains a special CN field that is inconsistent with legitimate business.

[0133] 2. The fingerprint detection mechanism quickly determines that the TLS fingerprint belongs to the Cobalt Strike variant family used by APT41 (Advanced Persistent Threat41, the code name of the advanced persistent threat APT organization).

[0134] 3. It was determined that this was a targeted penetration attack by APT41 against the department, and a warning message was issued in a timely manner.

[0135] 4. Submit the variant fingerprint to the cloud management platform and update it to the local fingerprint library of all members after review.

[0136] 5. Other units have discovered similar TLS fingerprints and promptly detected and blocked APT41's infiltration activities.

[0137] In summary, the fingerprint detection mechanism is a powerful tool for identifying encrypted malware such as Cobalt Strike variants of advanced APT organizations. It can quickly compare and identify malware families. Even if the malware is disguised by traffic, it cannot escape the sharp eyes of fingerprint comparison. The cloud-based joint defense of the fingerprint library further enhances the intelligence acquisition and analysis capabilities of each member unit, greatly increasing the attack cost of APT organizations. At the same time, this mechanism can be easily extended to the detection of other types of malware, and has broad application prospects.

[0138] In the case of model detection, traffic statistical characteristics of plaintext traffic are obtained as input of a pre-trained model, and the output of the pre-trained model is obtained, wherein the output of the pre-trained model includes: a threat level score of the plaintext traffic, and the statistical characteristics of the plaintext traffic include at least: a request method of the plaintext traffic, a URI length of the plaintext traffic, and the number of parameters corresponding to the plaintext traffic; based on the output of the pre-trained model, it is determined whether the plaintext traffic is threatening traffic.

[0139] The specific method of model detection is as follows:

[0140] Step 1: Use machine learning algorithms to train traffic anomaly detection models, where the detection models include but are not limited to: a webshell (a website backdoor program) detection model based on LightGBM (a machine learning algorithm), a hidden tunnel detection model based on LOF, and a variant Trojan detection model based on ExtraTrees and AE.

[0141] Step 2: Extract traffic statistical features (such as packet size, duration, etc.) as model input.

[0142] Step 3: Output suspicious threat events and threat scores to identify high-risk traffic.

[0143] Taking the webshell detection model based on LightGBM as an example, the workflow of the model detection capability is explained in detail.

[0144] It should be noted that Webshell is a type of malware commonly used by hackers. It is remotely controlled through web scripts and is highly concealed. Traditional feature detection is difficult to deal with various variants.

[0145] Among them, step 1 uses a machine learning algorithm to train a traffic anomaly detection model, including:

[0146] Taking the webshell detection model based on LightGBM as an example,

[0147] Data preparation stage: Collect samples of common webshell families, such as China Chopper, Behinder, etc.; artificially construct webshell traffic disguised as normal business to enrich the diversity of samples; use expert knowledge and crawler technology to mark the malicious types of samples to form a training set.

[0148] Feature engineering stage: extract statistical features of HTTP traffic, such as request method, URI length, number of parameters, etc.; extract N-Gram features of request content and capture webshell code snippets; use algorithms such as TF-IDF to perform weighted processing on features.

[0149] Model training phase: Use the LightGBM algorithm to train the binary classification model; use grid search and other technologies to optimize model hyperparameters and improve performance; use cross-validation and other methods to evaluate the generalization ability of the model.

[0150] Step 2: Extract traffic statistics features as model input, including:

[0151] Step 2.1, extract key information of request and response from the decrypted HTTP traffic.

[0152] Specifically, extract the request URI, message header, message body, etc. Extract the response status code, Server field, response length, and other metadata.

[0153] Step 2.2, calculate the statistical characteristics of the request and response.

[0154] Specifically, the length, path depth, and number of parameters of the request URI are calculated; suspicious keywords in the request are counted, such as eval, base64_decode, etc.; the frequency of HTML tags in the response is calculated, and the entropy value of the response is extracted.

[0155] Step 3: Output suspicious threat events and threat scores to identify high-risk traffic.

[0156] Specifically, the extracted features are input into the trained LightGBM model; the model outputs the malicious probability for each request as a threat score. Set a score threshold (for example, 0.8) and determine requests above the threshold as webshells. Output threat events and supplement threat intelligence. Aggregate multiple malicious requests from the same source IP into one threat event. Associate external threat intelligence such as IP reputation and C&C intelligence to enrich event information. Output detailed information of the event, including: time, source IP, destination URL, attack type, etc.

[0157] In the process of training the detection model, honeypot technology can be used to deploy an intelligent deception environment to attract and capture the malicious behavior of attackers, and actively analyze honeypot alarms through machine learning models to identify real threats.

[0158] Specifically, honeypot data is obtained, and the honeypot data includes: a variety of attack traffic data; multi-dimensional features of traffic attack behavior are extracted from the various attack traffic data, and the multi-dimensional features of attack behavior include: network layer features, host layer features and application layer features, wherein the network layer features at least include: source IP, port and protocol of attack traffic, the host layer features at least include: attacker's system operation information and file read and write information, and the application layer features at least include: URL parameters of network attacks and SQL injection statements of network attacks; a honeypot model is constructed based on the multi-dimensional features of traffic attack behavior, and the honeypot model is used to analyze plaintext traffic to obtain initial detection results, and the initial detection results are input into a pre-trained model to output detection results.

[0159] Specifically, step A1, building a multi-level intelligent honeypot platform, includes:

[0160] Step A1.1, deploy low-interaction honeypots to simulate common network services and applications, such as SSH, RDP, HTTP, etc.

[0161] These honeypots can be deployed quickly and have a wide coverage area. They can effectively attract attack traffic, record the attacker's initial behaviors such as scanning and blasting, and filter suspicious traffic.

[0162] Step A1.2, deploy high-interaction honeypots to provide a complete operating system and application environment. These honeypots are based on real systems and can deeply capture the detailed behavior of attackers. Through VPN, tunneling and other technologies, the high-interaction honeypot traffic is diverted to the sandbox to facilitate behavior analysis.

[0163] Step A1.3, deploy intelligent baits at key nodes, such as artificially synthesized "bait documents".

[0164] It should be noted that the decoy document has a honeytag embedded in it, which can track abnormal operations such as document opening and leakage. The decoy account can induce the attacker to perform specific operations and actively expose the attack intention.

[0165] Step A2, building a multi-dimensional honeypot data analysis model includes:

[0166] Step A2.1: Access multi-source heterogeneous honeypot data to extract multi-dimensional features of attack behavior.

[0167] Network layer characteristics: source IP, port, protocol, etc. of attack traffic.

[0168] Host layer characteristics: attacker’s system operations, file reading and writing, etc.

[0169] Application layer features: URL parameters of Web attacks, SQL injection statements, etc.

[0170] Step A2.2, using machine learning algorithms, build a honeypot alarm analysis model.

[0171] In some embodiments of the present application, an unsupervised learning clustering algorithm, such as DBSCAN, may be used to mine attack clusters and discover new attacks, or a supervised learning classification algorithm, such as SVM, may be used to accurately identify attack types.

[0172] In step A2.3, the model is continuously trained and adaptively learned to improve the accuracy and robustness of detection.

[0173] The specific training process includes: analyzing typical attack logs, optimizing model features and hyperparameters, regularly verifying model performance, introducing adversarial samples, and simulating the challenges faced by the model.

[0174] Step A3, realizing the automated analysis and response of honeypot alarms, includes:

[0175] Step A3.1: Input honeypot alarms into the machine learning model in real time to automatically identify real threats. Aggregate multi-dimensional abnormal behaviors of the same attacker to improve the confidence of threat judgment. Filter out harmless traffic alarms such as scanners to reduce alarm fatigue.

[0176] Step A3.2, automatically start the emergency response process according to the severity of the threat. In particular, promptly notify security personnel of high-risk threats and conduct in-depth analysis and evidence collection. Link protection equipment to block and isolate malicious sources to curb further intrusion.

[0177] Step A3.3, feed back the analysis results to the honeypot platform in a timely manner to continuously evolve the deception environment.

[0178] Specifically, the distribution of honeypot resources is adjusted to induce attackers to be interested in specific targets. According to the attack method, the behavior script of the high-interaction honeypot is dynamically adjusted to extend the attacker's stay time.

[0179] Through the above solution, the combination of honeypot technology and machine learning models can build an intelligent and continuously evolving deception defense system. Just like the siren in mythology, it attracts attackers with confusing illusions, lures them to reveal their true form, and then accurately identifies and actively counterattacks. This deception defense mode can significantly improve the ability to perceive unknown threats, making network attack and defense proactive. At the same time, through automated alarm analysis, it greatly improves security operation efficiency, realizes intelligent security operation of human-machine collaboration, and lays a solid foundation for realizing overall network security situation awareness.

[0180] In actual application scenarios, while detecting encrypted traffic, the system vulnerabilities of the server can also be detected. Specifically, a vulnerability detection model can be constructed. The specific construction method of the vulnerability detection model is as follows: obtain a source code corpus, and divide the source code in the source code corpus into token sequences; compile the source code in the source code corpus into an intermediate representation; build a control flow graph of the program based on the intermediate representation; extract features of the token sequence and the control flow graph of the program respectively, and obtain source code sequence features and program structure graph features; train a vulnerability detection model based on the source code sequence features and the program structure graph features, and the vulnerability detection model is used to detect vulnerabilities in the server system.

[0181] The specific implementation steps are as follows:

[0182] Step B1, building a multi-task sequence-to-sequence representation learning model for source code;

[0183] Wherein, step B1 comprises:

[0184] Step B1.1: Collect a large-scale source code corpus covering various programming languages ​​and application scenarios. For example: crawl high-star projects from open source communities such as GitHub and GitLab; crawl high-quality code solutions from programming competition platforms.

[0185] Step B1.2, preprocess the source code, unify the format, and extract the tokenized sequence of the source code.

[0186] Specifically, remove noise such as comments and blank characters; use the lexical analyzer of the programming language to split the source code into token sequences.

[0187] Step B1.3: Train the language model of the source code based on a sequence-to-sequence model such as Transformer.

[0188] Specifically, the masked language modeling (MLM) task is used to predict the masked token; the next sentence prediction (NSP) task is used to determine whether two code snippets are adjacent; the clone detection task is used to determine whether two code snippets are semantically similar; and multiple tasks are trained jointly to fully capture the semantic and structural features of the source code.

[0189] Step B2, constructing a graph neural network encoding model of the program control flow graph;

[0190] Wherein, step B2 comprises:

[0191] Step B2.1, compile the source code into an intermediate representation (IR) and extract the control flow graph (CFG) of the program.

[0192] Specifically, use a compiler framework such as LLVM to obtain the IR of the program; extract basic blocks and control flow edges from the IR to build CFG.

[0193] Step B2.2, encode the CFG into a graph data structure and preprocess the features of the nodes and edges of the graph.

[0194] Specifically, node features may include instruction types, operands, etc. of basic blocks; edge features may include control flow types (sequence, branch, loop, etc.).

[0195] In step B2.3, a graph neural network such as a graph convolutional network (GCN) is used to learn the embedded representation of CFG.

[0196] Specifically, through the message passing mechanism, the neighborhood information of the node is aggregated and the node embedding is updated; through the pooling mechanism, the embedding vector of the entire CFG is generated.

[0197] A graph attention network (GAT) can be used to assign different attention weights to different edges.

[0198] Step B3, integrate source code sequence features and program structure graph features to train an end-to-end vulnerability detection model.

[0199] Wherein, step B3 comprises:

[0200] Step B3.1, concatenate the source code sequence embedding of step B1 and the CFG embedding of step B2.

[0201] It should be noted that in the splicing process, an attention mechanism can be used to adaptively assign weights to the two types of features, and a gating mechanism can also be used to control the information flow of the two types of features.

[0202] Step B3.2: Access source code samples with and without vulnerabilities, as well as the corresponding CFG graph data.

[0203] Specifically, we obtain known vulnerability code examples from vulnerability databases such as NVD, manually inject various typical vulnerabilities, and build a data set. We use vulnerability static analysis tools to generate vulnerability labels as supervisory signals for training.

[0204] Step B3.3, end-to-end training of vulnerability classification model, outputs whether a given code contains a vulnerability. Use cross entropy loss function to optimize model parameters. Use MSIVD fine-tuning method to use a small amount of annotated data for self-guided continuous optimization. Use few-shot learning technology to maximize the value of annotated data. Generate chain prompts to guide the model to perform continuous reasoning and self-consistency verification. Dynamically adjust the weight ratio of source code sequence features and graph features during training.

[0205] Through the above scheme, the organic combination of multi-task sequence-to-sequence LLM and graph neural network can fully mine the semantic and structural information of the source code and comprehensively characterize the vulnerability characteristics of the code. End-to-end training tightly couples the feature extraction and vulnerability identification processes to form an integrated end-to-end vulnerability detection solution. At the same time, the MSIVD fine-tuning method uses the advantages of LLM in few-sample learning and continuous reasoning to give vulnerability detection stronger self-guided optimization capabilities, allowing the model to continue to evolve and adapt to changing vulnerability forms. Compared with traditional rule-based or single machine learning model methods, this solution has significantly improved the accuracy, generalization and automation of vulnerability detection, providing a new technical path for code security auditing, which is of great significance for improving the overall security of the system.

[0206] For example, a website administrator mistakenly uploaded a webshell file to a web server and was hacked.

[0207] The specific detection process is as follows:

[0208] 1. The full traffic mirroring device captures the HTTP traffic of the website in real time.

[0209] 2. After the traffic is decrypted, key statistical features are extracted and input into the LightGBM model.

[0210] 3. The model found that multiple URIs contained suspicious keywords, such as eval, base64_decode, etc., with a threat score as high as 0.95.

[0211] 4. Identified as a variant attack of the China Chopper webshell family.

[0212] 5. Output threat events and describe the attack process in detail:

[0213] The attacker detected the website's webshell file through Google Hacking.

[0214] The attacker uses the webshell to initiate malicious requests to the server and execute system commands.

[0215] By analyzing the requested IP and User-Agent, it was determined to be a foreign APT organization.

[0216] 6. Security personnel promptly cleared the webshell and patched the vulnerability, preventing further data leakage.

[0217] In summary, model detection capability is one of the core engines of traffic threat detection. Through machine learning algorithms, the potential characteristics of malware can be automatically mined to discover unknown threats such as webshells, tunnels, and Trojans. Combined with external intelligence, model detection can quickly focus on high-risk traffic and output actionable threat events, greatly improving the efficiency of security analysts. In actual combat, this capability has played a key role in detecting webshell attacks on government and enterprise intranets, accurately identifying various hidden variants and defending website system security. In the future, with further optimization of the algorithm, model detection is expected to become the "trump card" of traffic threat detection, escorting network security in various industries.

[0218] In some embodiments of the present application, encrypted traffic detection can be automated model operation, the specific steps are as follows:

[0219] Step 1: Implement cloud model version control and push through the SecXOps platform.

[0220] Step 2: Continuously optimize and build detection models based on real business traffic.

[0221] Step 3: Automatically split the training set and test set, evaluate the effect of the new model, and conduct AB testing.

[0222] In some embodiments of the present application, source tracing and forensic analysis may also be performed on the traffic determined to be a threat. The specific steps are as follows:

[0223] Step 1: Correlate threat events from the detection engine and aggregate and analyze suspicious traffic.

[0224] Step 2: Extract key intelligence information such as the attacker’s IP, timeline, and attack methods.

[0225] Step 3: Generate a threat analysis report to support visual display and assist in incident response.

[0226] In some embodiments of the present application, an alarm may also be issued for threat traffic. Specifically,

[0227] Step 1: Automatically block malicious traffic based on customer preset policies.

[0228] Step 2: Send alerts in a timely manner via SMS, email, Webhook, etc.

[0229] Step 3: Integrate the situational awareness platform to achieve unified event orchestration and handling.

[0230] In some embodiments of the present application, a plurality of methods are used to detect plaintext traffic, and the specific steps for obtaining a plurality of detection results may be: extracting multi-dimensional features from the plaintext traffic, the multi-dimensional features at least including: network layer features, application layer features, content features and behavior features, the network layer features at least including: IP address, port, protocol type, the application layer features at least including: HTTP header information, TLS handshake parameters, the content features at least including: keywords and byte distribution in the payload, the behavior features at least including: connection duration, data transmission mode; selecting at least one method from a plurality of methods to detect the multi-dimensional features and obtain the detection results, wherein the plurality of methods include: rule detection, fingerprint detection and model detection, wherein rule detection includes: matching the multi-dimensional features with the rule set in the preset detection rule library, fingerprint detection includes: comparing the fingerprint information of the plaintext traffic with the fingerprint information in the preset fingerprint library, and model detection includes: using a pre-trained model to identify the multi-dimensional features.

[0231] Among them, multiple detection results are integrated to obtain a final detection result, and the detection result is used to indicate the threat level of the traffic, including: obtaining the threat level scores indicated by multiple detection results; obtaining the weight corresponding to each detection result; and determining the final detection result based on the weight corresponding to each detection result and the threat level score indicated by each detection result.

[0232] The fusion scheme that integrates multiple methods is as follows:

[0233] A three-layer detection architecture is constructed, which is rule detection, fingerprint detection and model detection. Each layer can run independently or interact with other layers to form an organic whole.

[0234] At the same time, the three detection methods share a unified feature extraction module. This module can extract multi-dimensional features from network traffic in real time, including but not limited to: network layer features: IP address, port, protocol type, etc.; application layer features: HTTP header information, TLS handshake parameters, etc.; content features: keywords in payload, byte distribution, etc.; behavioral features: connection duration, data transmission mode, etc. These features are updated in real time to a shared feature pool for simultaneous access by the three detection methods.

[0235] In some embodiments of the present application, the detection results of each method can be cross-validated. Specifically, the output results of each detection method are not isolated, but verify and complement each other; suspicious behaviors discovered by rule detection will trigger fingerprint detection for further confirmation; the results of fingerprint detection will serve as an important input feature for model detection; high-confidence predictions of model detection will be fed back to the rule base to dynamically update the detection rules.

[0236] In the process of integrating detection results, the weights of the three methods can be dynamically adjusted according to the actual detection effect. For example, for known threats, the weight of rule detection is higher; for variant attacks, the weight of fingerprint detection will be increased; for unknown threats, the weight of model detection is dominant.

[0237] It should also be noted that the detection process will take into account contextual information such as the network environment, service type, historical alarms, etc., and automatically select the most suitable combination of detection strategies.

[0238] The integration of multiple methods can improve detection accuracy: through cross-validation of multiple methods, the false alarm rate and missed alarm rate can be greatly reduced; the defense capability against unknown threats can be enhanced: model detection can capture complex patterns that are difficult to describe by rules and fingerprints; detection efficiency can be improved: the most efficient detection method can be adaptively selected according to the threat type; system robustness can be enhanced: even if one detection method fails, other methods can still guarantee basic defense capabilities; continuous evolution can be supported: the feedback loop of detection results enables the system to continuously optimize itself and adapt to new threats.

[0239] In some embodiments of the present application, different characteristics of plaintext traffic are determined by obtaining each detection result; and the traffic type of traffic mirroring is determined based on the different characteristics of plaintext traffic.

[0240] The three detection methods can respectively detect different characteristics of the traffic to be detected and jointly determine the detection result of the traffic to be detected.

[0241] In order to further explain the detection method of integrating multiple methods, the following adds several detection methods in different detection scenarios for further explanation. For example, in the scenario of advanced persistent threat (APT) detection, attackers usually use highly customized tools and covert techniques.

[0242] Through rule detection: Capture specific attack patterns used by known APT organizations;

[0243] Through fingerprint detection; identify the tool chain and communication protocol features commonly used by APT organizations;

[0244] Through model detection: discover abnormal data outflow behavior and latent activity patterns.

[0245] The three methods work together to form a multi-layered APT detection and defense system.

[0246] When it comes to zero-day vulnerability exploit detection, traditional methods are often powerless in the face of new, undisclosed vulnerability attacks.

[0247] Through rule detection: Quickly deploy temporary rules to block known attack vectors;

[0248] Fingerprint detection: Identify abnormal structures and encoding patterns in attack payloads;

[0249] Through model detection: learn normal traffic patterns and detect abnormal behaviors that deviate from them.

[0250] This combination enables zero-day attacks to be discovered and blocked in a timely manner even without specific vulnerability information.

[0251] For encrypted traffic threat detection, with the popularization of encrypted communications, traditional content-based detection methods face challenges.

[0252] Through rule detection: analyze the plaintext part of the encryption handshake process;

[0253] Through fingerprint detection: extract TLS fingerprints and identify the communication characteristics of malware;

[0254] Through model detection: learning the statistical characteristics of encrypted traffic and discovering covert channels.

[0255] This fusion approach can effectively detect threats in encrypted traffic without decryption.

[0256] In the scenario of WebShell detection, WebShell is a common website backdoor that is diverse and hidden.

[0257] Detection by rules: matching the characteristic string of known WebShell;

[0258] Fingerprint detection: Identify common obfuscation and encoding techniques used by WebShell;

[0259] Through model detection: learn the pattern of normal web requests and detect abnormal command execution;

[0260] Through this multi-dimensional detection, various types of WebShell variants can be effectively discovered.

[0261] In the scenario of DGA domain name detection, Domain Generation Algorithm (DGA) is a communication hiding technology commonly used by botnets.

[0262] By rule detection: matching the domain name pattern generated by the known DGA algorithm;

[0263] Through fingerprint detection: analyzing the registration information and resolution record characteristics of the domain name;

[0264] Through model detection: learn the linguistic features of normal domain names and identify abnormal random strings;

[0265] This combined approach can effectively detect and block the communications of DGA botnets.

[0266] A complex advanced persistent threat (APT) attack scenario is used as an example to show how this framework works in practice.

[0267] A large financial institution encountered a highly complex APT attack. The attacker used a variety of advanced technologies, including zero-day vulnerabilities, custom malware, and encrypted communications. The specific detection and interception process is as follows:

[0268] 1. Initial detection phase;

[0269] (a) Rule detection:

[0270] The system detected a connection attempt from an unfamiliar IP address and matched the "suspicious geographic location" rule.

[0271] Trigger alarm level: low;

[0272] (b) Fingerprint detection:

[0273] Analyzing the TLS handshake parameters of the connection, we found that an uncommon combination of cipher suites was used.

[0274] After comparing with the fingerprint database of known APT organizations, an 80% similarity was found.

[0275] Trigger alert level: Medium;

[0276] (c) Model testing:

[0277] Based on the connection behavior pattern (such as time, frequency, and data volume), the model determines it as abnormal behavior.

[0278] Anomaly score: 0.75 (higher than the threshold of 0.7);

[0279] Trigger alert level: Medium.

[0280] 2. In-depth analysis stage;

[0281] (a) Dynamic feature sharing:

[0282] The three detection methods share the same features: suspicious IP, abnormal TLS parameters, and abnormal behavior patterns.

[0283] Update the shared feature pool for subsequent detection.

[0284] (b) Cross-validation of test results:

[0285] Rule detection: Raises the alert level from "low" to "medium" based on the results of fingerprints and models.

[0286] Fingerprint detection: Feedback the APT organization fingerprint similarity information to the model detection.

[0287] Model detection: Feedback anomaly scores to the rule engine to dynamically generate new rules.

[0288] (c) Adaptive weight adjustment:

[0289] The system finds that fingerprint detection and model detection perform better and dynamically increases their weights.

[0290] For example: rule detection weight: 30%, fingerprint detection weight: 35%, model detection weight: 35%.

[0291] In actual application scenarios, the alarm levels of rule detection and fingerprint detection can be converted into threat scores according to preset rules, and the threat scores of the three detection results can be weighted and summed to obtain the final threat score, thereby generating an alarm level.

[0292] 3. Continuous monitoring stage;

[0293] (a) Rule detection:

[0294] Based on the newly generated rules, suspicious DNS request patterns were found, which were suspected to be DGA.

[0295] Trigger alert level: Medium;

[0296] (b) Fingerprint detection:

[0297] Communication fingerprints suspected of a custom C2 (command and control) protocol were identified.

[0298] Trigger alarm level: High;

[0299] (c) Model testing:

[0300] Abnormal data outflow patterns were detected, which were highly consistent with known data theft behaviors.

[0301] Trigger alarm level: High.

[0302] 4. Threat identification and response;

[0303] (a) Context-aware detection strategy:

[0304] Taking into account that the target is a financial institution, the system automatically increases the sensitivity, lowers the warning threshold, and determines the alert level based on the comparison between the threat score and the warning threshold.

[0305] (b) Comprehensive analysis:

[0306] Combining the results of the three detection methods, the system determined that this was a highly reliable APT attack.

[0307] Generate detailed threat intelligence reports including attack chains, technical characteristics, and possible attack organizations.

[0308] (c) Automatic Response:

[0309] Isolate the infected host immediately.

[0310] Block all communications with suspected C2 servers.

[0311] Initiate the emergency response plan and notify the security team to conduct in-depth analysis and evidence collection.

[0312] 5. Subsequent optimization;

[0313] (a) Rule updates:

[0314] Based on this attack, new detection rules are automatically generated, such as specific DNS request patterns.

[0315] (b) Fingerprint database expansion:

[0316] Add newly discovered C2 protocol fingerprints to the APT fingerprint library.

[0317] (c) Model retraining:

[0318] Use the data samples from this attack to fine-tune and optimize the anomaly detection model.

[0319] In summary, the three detection methods are not simply juxtaposed, but an organic whole that is deeply integrated and mutually reinforcing; the system can adaptively adjust strategies and flexibly apply different detection methods according to the characteristics of threats at different stages; continuous information sharing and cross-validation mechanisms make the detection results more reliable and comprehensive; context-aware capabilities enable the system to make more accurate judgments based on the specific environment; the detection process is not a one-time process, but a process of dynamic evolution and continuous optimization.

[0320] This multi-level adaptive detection framework demonstrates powerful threat discovery and response capabilities, and can effectively deal with complex APT attacks. Its core advantage lies in the close integration and intelligent collaboration of various components. This deep integration makes it difficult for attackers to bypass any single detection layer, thereby greatly improving the overall security protection level.

[0321] Figure 3 A device for detecting the threat level of encrypted traffic according to an embodiment of the present application includes:

[0322] The acquisition module 30 is used to obtain the traffic image of the whole traffic, and perform session reorganization on the traffic image to obtain the reorganized traffic, wherein the traffic image includes encrypted traffic;

[0323] The decryption module 32 is used to decrypt the reassembled traffic using a multi-dimensional decryption method to obtain plaintext traffic, and the multi-dimensional decryption method includes at least one of the following: decryption using a decryption algorithm library, decryption using a certificate, and decryption using a standard encryption and decryption algorithm;

[0324] The detection module 34 is used to detect the plaintext traffic in multiple ways, obtain multiple detection results, and merge the multiple detection results to obtain the final detection result, which is used to indicate the threat level of the traffic.

[0325] Through the above-mentioned encrypted traffic threat level detection device, by obtaining the traffic mirror of the whole traffic and reassembling the traffic mirror for the session, the reassembled traffic is obtained, wherein the traffic mirror contains encrypted traffic; the reassembled traffic is decrypted by a multi-dimensional decryption method to obtain plaintext traffic, and the multi-dimensional decryption method includes at least one of the following: decryption by a decryption algorithm library, decryption by a certificate, and decryption by a standard encryption and decryption algorithm; the plaintext traffic is detected by multiple methods to obtain multiple detection results, and the multiple detection results are integrated to obtain a final detection result, and the detection result is used to indicate the threat level of the traffic, thereby achieving the purpose of decrypting the encrypted traffic before detecting, thereby achieving the technical effect of improving the accuracy of encrypted traffic threat level detection, and then solving the technical problem of low accuracy of encrypted traffic threat level detection in related technologies.

[0326] The decryption module 32 includes: a decryption submodule, which is used to decrypt the reassembled traffic using a multi-dimensional decryption method to obtain plaintext traffic, including: when the multi-dimensional decryption method is to use a certificate for decryption, extract the encryption key suite of the reassembled traffic; obtain the private key corresponding to the reassembled traffic through the certificate corresponding to the reassembled traffic, decrypt the encryption key suite, and obtain the symmetric encryption key for subsequent communications; decrypt the reassembled traffic based on the symmetric encryption key to obtain plaintext traffic; when it is detected that the certificate corresponding to the reassembled traffic is updated, update the private key corresponding to the reassembled traffic, and when the session corresponding to the reassembled traffic belongs to the certificate before the update, use the private key before the update to decrypt until the session belonging to the certificate before the update ends; after the session belonging to the certificate before the update ends, all sessions corresponding to the reassembled traffic are decrypted using the updated private key.

[0327] The detection module 34 includes: a first detection submodule and a second detection submodule. The first detection submodule is used to detect the plaintext traffic in a variety of ways to obtain a variety of detection results, including: selecting at least one method from a variety of methods to detect the plaintext traffic and obtain a detection result, wherein the multiple methods include: rule detection, fingerprint detection and model detection, wherein rule detection includes: matching the characteristics of the plaintext traffic with the rule set in a preset detection rule library, fingerprint detection includes: comparing the fingerprint information of the plaintext traffic with the fingerprint information in a preset fingerprint library, and model detection includes: using a pre-trained model to identify the characteristics of the plaintext traffic.

[0328] The first detection submodule includes: a detection unit, which is used to select at least one method from a plurality of methods to detect the plaintext traffic and obtain a detection result, including: in the case of using the rule detection method for detection, restoring the plaintext traffic to plaintext data; matching the characteristics of the plaintext data with the rule set in the preset detection rule library, and in the case that the characteristics of the plaintext data match any rule in the rule set, determining that the detection result is that the plaintext traffic corresponding to the plaintext data is a threatening traffic, wherein any rule in the rule set is used to represent the characteristics of the threatening traffic, and in the case that the characteristics of the plaintext data are the same as the characteristics of the threatening traffic, determining that the characteristics of the plaintext data match the rules in the rule set; in the case of fingerprint detection, Fingerprint information of plaintext traffic is obtained to characterize feature information obtained during the handshake process between the server and the client; similarity between the fingerprint information and fingerprint information in a preset fingerprint library is obtained, and when the similarity is higher than a preset similarity threshold, the plaintext traffic corresponding to the fingerprint information is determined to be threatening traffic; in the case of adopting model detection, traffic statistical features of the plaintext traffic are obtained as input of a pre-trained model, and the output of the pre-trained model is obtained, wherein the output of the pre-trained model includes: a threat level score of the plaintext traffic, and the statistical features of the plaintext traffic include at least: a request method of the plaintext traffic, a URI length of the plaintext traffic, and the number of parameters corresponding to the plaintext traffic; based on the output of the pre-trained model, it is determined whether the plaintext traffic is threatening traffic.

[0329] The detection unit also includes: a honeypot sub-unit, which is used to obtain honeypot data, and the honeypot data includes: a variety of attack traffic data; extracting multi-dimensional features of traffic attack behavior from a variety of attack traffic data, the multi-dimensional features of attack behavior include: network layer features, host layer features and application layer features, wherein the network layer features at least include: the source IP, port and protocol of the attack traffic, the host layer features at least include: the attacker's system operation information and file read and write information, and the application layer features at least include: the URL parameters of the network attack and the SQL injection statement of the network attack; building a honeypot model based on the multi-dimensional features of the traffic attack behavior, and using the honeypot model to analyze the plaintext traffic to obtain an initial detection result, and input the initial detection result into a pre-trained model to output the detection result.

[0330] The detection module 34 also includes: a vulnerability unit, which is used to obtain a source code corpus and divide the source code in the source code corpus into token sequences; compile the source code in the source code corpus into an intermediate representation; build a control flow graph of the program based on the intermediate representation; perform feature extraction on the token sequence and the control flow graph of the program respectively to obtain source code sequence features and program structure graph features; and obtain a vulnerability detection model based on the source code sequence features and the program structure graph features. The vulnerability detection model is used to detect vulnerabilities in the server system.

[0331] The second detection submodule is used to detect the plaintext traffic in multiple ways to obtain multiple detection results, including: extracting multi-dimensional features from the plaintext traffic, the multi-dimensional features at least include: network layer features, application layer features, content features and behavior features, the network layer features at least include: IP address, port, protocol type, application layer features at least include: HTTP header information, TLS handshake parameters, content features at least include: keywords and byte distribution in the payload, and behavior features at least include: connection duration, data transmission mode; at least one method is selected from multiple methods to detect the multi-dimensional features to obtain detection results, wherein the multiple methods include: rule detection, fingerprint detection and model detection, wherein rule detection includes: matching the multi-dimensional features with the rule set in the preset detection rule library, fingerprint detection includes: comparing the fingerprint information of the plaintext traffic with the fingerprint information in the preset fingerprint library, and model detection includes: using a pre-trained model to identify the multi-dimensional features.

[0332] The detection module 34 also includes a first fusion submodule and a second fusion submodule. The first fusion submodule is used to fuse multiple detection results to obtain a final detection result, including: obtaining threat level scores indicated by multiple detection results; obtaining the weight corresponding to each detection result; and determining the final detection result based on the weight corresponding to each detection result and the threat level score indicated by each detection result.

[0333] The second fusion submodule is used to fuse multiple detection results to obtain a final detection result, including: obtaining each detection result to determine different characteristics of plaintext traffic respectively; determining the traffic type of traffic mirroring based on the different characteristics of plaintext traffic.

[0334] It should be noted that Figure 3 The encrypted traffic threat level detection device is used to perform Figure 2 The method for detecting the threat level of encrypted traffic is shown, so the relevant explanations in the above-mentioned method for detecting the threat level of encrypted traffic are also applicable to the device for detecting the threat level of encrypted traffic, and will not be repeated here.

[0335] An embodiment of the present application also provides a computer device, including: a memory and a processor, wherein the memory is used to store program instructions; the processor is connected to the memory and is used to execute the above-mentioned method for detecting the threat level of encrypted traffic.

[0336] An embodiment of the present application also provides a non-volatile storage medium, which includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the above-mentioned method for detecting the threat level of encrypted traffic by running the computer program.

[0337] An embodiment of the present application also provides a computer program product, including a non-volatile computer-readable storage medium, the non-volatile computer-readable storage medium storing a computer program, and when the computer program is executed by a processor, the steps of the method for detecting the threat level of encrypted traffic in the present application are implemented.

[0338] An embodiment of the present application also provides a computer program product, including computer instructions, which, when executed by a processor, implement the steps of the method for detecting the threat level of encrypted traffic in the present application.

[0339] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0340] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0341] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0342] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed over multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0343] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0344] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or all or part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of each embodiment method of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk, etc. Various media that can store program codes.

[0345] The above are only preferred implementations of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for detecting the threat level of encrypted traffic, characterized in that: include: Obtaining a traffic image of the entire traffic, and performing session reorganization on the traffic image to obtain reorganized traffic, wherein the traffic image includes encrypted traffic; Decrypting the reassembled traffic using a multi-dimensional decryption method to obtain plaintext traffic, wherein the multi-dimensional decryption method includes at least one of the following: decrypting using a decryption algorithm library, decrypting using a certificate, and decrypting using a standard encryption and decryption algorithm; The plaintext traffic is detected in a variety of ways to obtain a variety of detection results, and the multiple detection results are integrated to obtain a final detection result, which is used to indicate the threat level of the traffic.

2. The method according to claim 1, characterized in that The reassembled traffic is decrypted using a multi-dimensional decryption method to obtain plaintext traffic, including: In the case where the multi-dimensional decryption method is to use a certificate for decryption, extracting an encryption key suite of the reassembled traffic; Obtaining a private key corresponding to the reassembled traffic through a certificate corresponding to the reassembled traffic, decrypting the encryption key suite, and obtaining a symmetric encryption key for subsequent communications; Decrypting the reassembled traffic based on the symmetric encryption key to obtain the plaintext traffic; When it is detected that the certificate corresponding to the reassembled traffic is updated, the private key corresponding to the reassembled traffic is updated, and when the session corresponding to the reassembled traffic belongs to the certificate before the update, the private key before the update is used for decryption until the session belonging to the certificate before the update ends; After the session belonging to the certificate before the update ends, all sessions corresponding to the reassembled traffic are decrypted using the updated private key.

3. The method according to claim 1, characterized in that The plaintext traffic is detected in a variety of ways to obtain a variety of detection results, including: At least one method is selected from the multiple methods to detect the plaintext traffic and obtain a detection result, wherein the multiple methods include: rule detection, fingerprint detection and model detection, wherein the rule detection includes: matching the characteristics of the plaintext traffic with the rule set in the preset detection rule library, the fingerprint detection includes: comparing the fingerprint information of the plaintext traffic with the fingerprint information in the preset fingerprint library, and the model detection includes: using a pre-trained model to identify the characteristics of the plaintext traffic.

4. The method according to claim 3, characterized in that At least one method is selected from the multiple methods to detect the plaintext traffic and obtain a detection result, including: When the detection is performed in the manner of rule detection, the plaintext traffic is restored to plaintext data; Matching the features of the plaintext data with the rule set in the preset detection rule base, and in the case where the features of the plaintext data match any rule in the rule set, determining that the detection result is that the plaintext traffic corresponding to the plaintext data is threatening traffic, wherein any rule in the rule set is used to represent the features of threatening traffic, and in the case where the features of the plaintext data are the same as the features of the threatening traffic, determining that the features of the plaintext data match the rules in the rule set; In the case of adopting the fingerprint detection, fingerprint information of the plaintext traffic is obtained, and the fingerprint information is used to characterize feature information obtained during the handshake process between the server and the client; Obtaining similarity between the fingerprint information and the fingerprint information in the preset fingerprint library, and when the similarity is higher than a preset similarity threshold, determining that the plaintext traffic corresponding to the fingerprint information is threatening traffic; In the case of adopting the model detection, the traffic statistical characteristics of the plaintext traffic are obtained as the input of the pre-trained model, and the output of the pre-trained model is obtained, wherein the output of the pre-trained model includes: the threat level score of the plaintext traffic, and the statistical characteristics of the plaintext traffic include at least: the request method of the plaintext traffic, the URI length of the plaintext traffic, and the number of parameters corresponding to the plaintext traffic; Determine whether the plaintext traffic is threatening traffic based on the output of the pre-trained model.

5. The method according to claim 4, characterized in that The method further comprises: Acquire honeypot data, the honeypot data including: multiple attack traffic data; Extracting multi-dimensional features of traffic attack behaviors from the multiple attack traffic data, wherein the multi-dimensional features of the attack behaviors include: network layer features, host layer features, and application layer features, wherein the network layer features at least include: source IP, port, and protocol of the attack traffic, the host layer features at least include: system operation information and file read and write information of the attacker, and the application layer features at least include: URL parameters of the network attack and SQL injection statements of the network attack; A honeypot model is constructed based on the multi-dimensional characteristics of the traffic attack behavior, and the plaintext traffic is analyzed using the honeypot model to obtain an initial detection result, and the initial detection result is input into the pre-trained model to output the detection result.

6. The method according to claim 1, characterized in that The method further comprises: Obtain a source code corpus, and segment source code in the source code corpus into token sequences; Compiling source code in the source code corpus into an intermediate representation; constructing a control flow graph of the program based on the intermediate representation; Extracting features of the token sequence and the control flow graph of the program respectively to obtain source code sequence features and program structure graph features; A vulnerability detection model is obtained by training based on the source code sequence features and the program structure graph features, and the vulnerability detection model is used to detect vulnerabilities in the server system.

7. The method according to claim 1, characterized in that The plaintext traffic is detected in a variety of ways to obtain a variety of detection results, including: Extracting multi-dimensional features from the plaintext traffic, the multi-dimensional features at least including: network layer features, application layer features, content features and behavior features, the network layer features at least including: IP address, port, protocol type, the application layer features at least including: HTTP header information, TLS handshake parameters, the content features at least including: keywords and byte distribution in the payload, the behavior features at least including: connection duration, data transmission mode; At least one method is selected from the multiple methods to detect the multi-dimensional features and obtain a detection result, wherein the multiple methods include: rule detection, fingerprint detection and model detection, wherein the rule detection includes: matching the multi-dimensional features with a rule set in a preset detection rule library, the fingerprint detection includes: comparing the fingerprint information of the plaintext traffic with the fingerprint information in a preset fingerprint library, and the model detection includes: using a pre-trained model to identify the multi-dimensional features.

8. The method according to claim 1, characterized in that The multiple detection results are integrated to obtain the final detection result, including: Obtain threat level scores indicated by various detection results; Get the weight corresponding to each test result; The final detection result is determined based on the weight corresponding to each detection result and the threat level score indicated by each detection result.

9. The method according to claim 1, characterized in that: The multiple detection results are integrated to obtain the final detection result, including: Obtaining each detection result to respectively determine different characteristics of the plaintext traffic; The traffic type of the traffic mirroring is determined based on different characteristics of the plaintext traffic.

10. A device for detecting the threat level of encrypted traffic, characterized in that: include: An acquisition module, used for acquiring a traffic image of the entire traffic, and performing session reorganization on the traffic image to obtain reorganized traffic, wherein the traffic image includes encrypted traffic; A decryption module, used to decrypt the reassembled traffic using a multi-dimensional decryption method to obtain plaintext traffic, wherein the multi-dimensional decryption method includes at least one of the following: decryption using a decryption algorithm library, decryption using a certificate, and decryption using a standard encryption and decryption algorithm; The detection module is used to detect the plaintext traffic in multiple ways to obtain multiple detection results, and to merge the multiple detection results to obtain a final detection result, wherein the detection result is used to indicate the threat level of the traffic.

11. A computer device, characterized in that: include: A memory and a processor, wherein the memory is used to store program instructions; The processor is connected to the memory and is used to execute the method for detecting the threat level of encrypted traffic as described in any one of claims 1-8.

12. A computer program product comprising computer instructions, characterized in that: When the computer instructions are executed by the processor, the method for detecting the threat level of encrypted traffic described in any one of claims 1-8 is implemented.

Images