Decryption analysis method and device for HTTPS encrypted traffic

Abstract

The invention discloses a decryption analysis method and device for HTTPS encrypted traffic, and belongs to the technical field of network security, and the method comprises the steps: setting a special Wi-Fi network, and configuring a dynamic certificate replacement mechanism on network equipment of the special Wi-Fi network; when the user equipment accesses the HTTPS website through the Wi-Fi network, implementing a dynamic certificate replacement mechanism; and after certificate replacement is completed, decryption and data analysis are performed on the HTTPS encrypted traffic, and whether malicious software or abnormal behaviors exist in the equipment is judged. According to the scheme, under the condition that a proxy server does not need to be configured, the HTTPS flow can be decrypted and analyzed simply, conveniently, efficiently and safely, and effective detection of data collection software and malicious software is achieved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a decryption analysis method, device, computing equipment and storage medium for HTTPS encrypted traffic. Background Art

[0002] In recent years, in order to ensure the security and privacy of data transmission, more and more network traffic has been encrypted using Secure Sockets Layer (SSL) and Transport Layer Security (TLS). However, the widespread use of encryption protocols has also brought new challenges to network security. Since traditional security detection firewalls cannot detect encrypted traffic, more than 70% of attackers now use encryption protocols to deliver malware, hide attack activities and steal confidential data, resulting in the following security incidents: viruses are hidden in executable files downloaded by intranet users through encrypted traffic; intranet users unknowingly visit malicious websites using the HTTPS protocol; unauthorized internal confidential information is leaked to the external network in the form of encrypted data transmission.

[0003] Since the normal operation of encrypted traffic depends on certificates, SSL encrypted traffic detection is also called SSL / TLS decryption. By configuring SSL encrypted traffic detection on the firewall, the encrypted traffic is decrypted, and the firewall performs content security checks on the decrypted traffic (including URL filtering, intrusion prevention, anti-virus, etc.), thereby effectively detecting network threats hidden in encrypted traffic. However, SSL / TLS decryption technology requires complex certificate management before decrypting and analyzing traffic. Certificate replacement during the decryption process may lead to additional security and management overhead. Man-in-the-Middle Attack (MITM) technology inserts an intermediate proxy between the client and the server, replaces the server's certificate, decrypts and views the encrypted data content, and thus detects potential malware or data collection software. This technology also requires complex configuration and certificate management, which increases the complexity of deployment and has potential security risks. HTTPS decryption proxy uses a dedicated proxy server to establish encrypted connections with the client and target server respectively, decrypts the traffic by replacing the certificate, and then performs content analysis. This method requires the maintenance and management of the proxy server, which not only increases the hardware cost, but also increases the complexity of operation and maintenance. Since the proxy server needs to process a large amount of data during the decryption process, it will lead to performance degradation. Summary of the invention

[0004] In order to solve the problems existing in the prior art, this solution proposes a decryption analysis method, device, computing device and storage medium for HTTPS encrypted traffic. By connecting to a specific Wi-Fi network and implementing certificate replacement technology in the Wi-Fi network, HTTPS traffic can be decrypted, avoiding the security risks caused by the configuration and management requirements of the proxy server, and can be widely used in various devices and network environments.

[0005] According to a first aspect of the present invention, a method for decrypting and analyzing HTTPS encrypted traffic is provided, comprising: setting up a dedicated Wi-Fi network and configuring a dynamic certificate replacement mechanism on its network devices; when a user device accesses an HTTPS website through the Wi-Fi network, implementing the dynamic certificate replacement mechanism; after completing the certificate replacement, decrypting and analyzing the HTTPS encrypted traffic to determine whether there is malware or abnormal behavior in the device.

[0006] By adopting the above technical solution, the traffic of all devices connected to the Wi-Fi network can be monitored through the Wi-Fi network equipment, and all HTTPS communications between user devices and external servers can be captured and analyzed in real time without the configuration and management of proxy servers. The certificate replacement technology is implemented in the Wi-Fi network, so that when the user device visits the HTTPS website, the traffic can be decrypted through the intermediate certificate, thereby avoiding compatibility issues and can be widely used in various devices and network environments.

[0007] Optionally, in the decryption and analysis method for HTTPS encrypted traffic provided by the present invention, a dedicated Wi-Fi network is set up through a Wi-Fi network device, and the Wi-Fi network is isolated from other networks; the Wi-Fi network device is configured to enable it to intercept and decrypt HTTPS traffic; an intermediate certificate is generated, and the intermediate certificate is installed in the Wi-Fi network device and a user device connected to the WiFi network.

[0008] By adopting the above technical solutions, a dedicated Wi-Fi network can support multiple types of devices (such as smartphones, tablets, laptops, etc.) at the same time, facilitating traffic analysis in multiple operating systems and device environments. Isolating the dedicated Wi-Fi network from other networks reduces potential external threats and attack surfaces, and generates and installs intermediate certificates, making the traffic decryption process transparent and effective.

[0009] Optionally, in the decryption and analysis method of HTTPS encrypted traffic provided by the present invention, OpenSSL is used to generate a private key of a root certificate to create a self-signed root certificate; OpenSSL is used to generate an intermediate certificate private key to create a signing request for the intermediate certificate, and the root certificate is used to sign the intermediate certificate; the intermediate certificate is installed in a Wi-Fi network device and a user device connected to the WiFi network.

[0010] By adopting the above technical solution, the self-signed root certificate allows the entire certificate chain to be controlled in the internal environment, which can reduce dependence on external certificate authorities and potential security risks.

[0011] Optionally, in the decryption and analysis method for HTTPS encrypted traffic provided by the present invention, when a user device accesses an HTTPS website through a Wi-Fi network, the Wi-Fi network device intercepts the HTTPS request; a new certificate is dynamically generated using a pre-created intermediate certificate, and the certificate of the target server is replaced with the dynamically generated intermediate certificate.

[0012] By adopting the above technical solution, dynamically generating new certificates can effectively intercept and decrypt HTTPS traffic between users and target servers, thereby achieving comprehensive monitoring and analysis of data.

[0013] Optionally, in the decryption analysis method for HTTPS encrypted traffic provided by the present invention, OpenSSL is used to encrypt, store and back up the intermediate certificate private key; access to the intermediate certificate and private key is monitored, and when the intermediate certificate is detected to be lost or leaked, the intermediate certificate is updated.

[0014] By adopting the above technical solution, monitoring the access to intermediate certificates and private keys helps to quickly detect potential security threats, such as unauthorized access, abnormal activities, etc. After discovering that the intermediate certificate is lost or leaked, the certificate can be quickly updated to reduce the security risks caused by certificate leakage and maintain the security of the system.

[0015] Optionally, in the decryption and analysis method of HTTPS encrypted traffic provided by the present invention, the HTTPS encrypted traffic is decrypted using an intermediate certificate private key to convert the encrypted data into plaintext data; key fields are extracted from the plaintext data, the key fields including user credentials, session ID, HTTP method, and request parameters; and malware and abnormal behavior in the key fields are identified.

[0016] By adopting the above technical solution, after decrypting HTTPS traffic, all transmitted data can be accessed in plain text. By analyzing the plain text data, potential malware activities and abnormal access patterns can be identified in a timely manner.

[0017] Optionally, in the decryption and analysis method for HTTPS encrypted traffic provided by the present invention, application behavior and network request patterns are analyzed to identify abnormal traffic peaks and frequent connection requests; a signature database of known malware and data collection software is used to match key fields to identify known malware and data collection software.

[0018] By adopting the above technical solutions, combined with traffic anomaly detection and malware identification, a multi-layer protection strategy can be implemented to improve the overall security protection capabilities.

[0019] According to a second aspect of the present invention, a decryption analysis device for HTTPS encrypted traffic is provided, comprising: a configuration module, a certificate replacement module and a decryption analysis module. Among them, the configuration module is used to set up a dedicated Wi-Fi network and configure a dynamic certificate replacement mechanism on its network devices; the certificate replacement module is used to implement the dynamic certificate replacement mechanism when the user device accesses the HTTPS website through the Wi-Fi network; the decryption analysis module is used to decrypt and analyze the HTTPS encrypted traffic after completing the certificate replacement to determine whether there is malware or abnormal behavior in the device.

[0020] By adopting the above technical solution, by connecting to a specific Wi-Fi network and implementing certificate replacement technology in the Wi-Fi network, HTTPS traffic can be decrypted to avoid the security risks caused by the configuration and management requirements of the proxy server; through the dynamic certificate replacement mechanism, HTTPS traffic can be effectively monitored and analyzed, and potential malware and abnormal behaviors can be discovered in time, thereby improving network security. Users will not notice that the traffic is being analyzed when visiting HTTPS websites, which improves the user experience while ensuring the integrity of the data.

[0021] According to a third aspect of the present invention, there is provided a computing device comprising: at least one processor; and a memory storing program instructions, wherein the program instructions are configured to be suitable for execution by at least one processor, and the program instructions include instructions for executing the above-mentioned decryption analysis method of HTTPS encrypted traffic.

[0022] According to a fourth aspect of the present invention, a readable storage medium storing program instructions is provided. When the program instructions are read and executed by a computing device, the computing device executes the above-mentioned decryption and analysis method of HTTPS encrypted traffic.

[0023] In summary, the decryption analysis method and device for HTTPS encrypted traffic provided by the present invention can at least achieve the following technical effects: 1. By connecting to a specific Wi-Fi network and implementing certificate replacement technology in the Wi-Fi network, HTTPS traffic can be decrypted, avoiding the need for proxy server configuration and management, simplifying the deployment process and reducing maintenance costs; 2. Implement certificate replacement technology in Wi-Fi networks, so that when user devices access HTTPS websites, they can decrypt traffic through intermediate certificates, thus avoiding compatibility issues and being widely applicable to various devices and network environments, adapting to different versions of the HTTPS protocol; 3. Users do not need to perform complex device settings or software installation. They only need to connect to a specific Wi-Fi network to achieve traffic decryption. When visiting HTTPS websites, they will not notice that the traffic is being analyzed, which improves the user experience and makes malware detection more convenient and efficient.

[0024] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 A block diagram of a computing device 100 according to an embodiment of the present invention is shown; Figure 2 A schematic diagram of a flow chart of a decryption analysis method 200 for HTTPS encrypted traffic according to an embodiment of the present invention is shown; Figure 3 A schematic diagram of the structure of a decryption and analysis device 300 for HTTPS encrypted traffic according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0026] In order to provide a simple, efficient and secure method for decrypting and analyzing HTTPS traffic, this solution implements a certificate replacement mechanism in the Wi-Fi network and automatically handles certificate replacement to achieve decryption of HTTPS encrypted traffic.

[0027] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0028] Figure 1 FIG. 1 is a schematic diagram showing the structure of a computing device 100 according to an embodiment of the present invention. Figure 1As shown, in a basic configuration 102, computing device 100 includes system memory 106 and one or more processors 104. A memory bus 108 may be used for communication between processor 104 and system memory 106.

[0029] The processor 104 may be any type of processor, including but not limited to a microprocessor (µP), a microcontroller (µC), a digital signal processor (DSP), or any combination thereof. The processor 104 may include one or more levels of cache, such as a level 1 cache 110 and a level 2 cache 112, a processor core 114, and registers 116. An example processor core 114 may include an arithmetic logic unit (ALU), a floating point unit (FPU), a digital signal processing core (DSP core), or any combination thereof. An example memory controller 118 may be used with the processor 104, or in some implementations, the memory controller 118 may be an internal part of the processor 104.

[0030] The system memory 106 may be any type of memory, including but not limited to: volatile memory (such as RAM), non-volatile memory (such as ROM, flash memory, etc.) or any combination thereof. The physical memory in the computing device generally refers to the volatile memory RAM, and the data in the disk needs to be loaded into the physical memory before it can be read by the processor 104. The system memory 106 may include an operating system 120, one or more applications 122, and program data 124. In some embodiments, the application 122 may be arranged to execute instructions on the operating system by one or more processors 104 using the program data 124. The operating system 120 may be, for example, Linux, Windows, etc., which includes program instructions for processing basic system services and performing hardware-dependent tasks. The application 122 includes program instructions for implementing various user-desired functions, and the application 122 may be, for example, a browser, instant messaging software, a software development tool (such as an integrated development environment IDE, a compiler, etc.), etc., but is not limited thereto. When the application 122 is installed in the computing device 100, a driver module may be added to the operating system 120.

[0031] When the computing device 100 starts running, the processor 104 reads and executes the program instructions of the operating system 120 from the memory 106. The application 122 runs on the operating system 120 and uses the interfaces provided by the operating system 120 and the underlying hardware to implement various functions desired by the user. When the user starts the application 122, the application 122 is loaded into the memory 106, and the processor 104 reads and executes the program instructions of the application 122 from the memory 106.

[0032] Computing device 100 also includes a storage device 132 including a removable storage 136 and a non-removable storage 138 , both of which are connected to storage interface bus 134 .

[0033] The computing device 100 may also include an interface bus 140 that facilitates communication from various interface devices (e.g., output devices 142, peripheral interfaces 144, and communication devices 146) to the basic configuration 102 via the bus / interface controller 130. Example output devices 142 include a graphics processing unit 148 and an audio processing unit 150. They can be configured to facilitate communication with various external devices such as a display or speakers via one or more A / V ports 152. Example peripheral interfaces 144 may include a serial interface controller 154 and a parallel interface controller 156, which may be configured to facilitate communication with external devices such as input devices (e.g., keyboards, mice, pens, voice input devices, touch input devices) or other peripherals (e.g., printers, scanners, etc.) via one or more I / O ports 158. Example communication devices 146 may include a network controller 160, which may be arranged to facilitate communication with one or more other computing devices 162 via a network communication link via one or more communication ports 164.

[0034] A network communication link may be an example of a communication medium. Communication media may generally be embodied as computer-readable instructions, data structures, program modules in a modulated data signal such as a carrier wave or other transmission mechanism, and may include any information delivery medium. A "modulated data signal" may be a signal in which one or more of its data sets or changes thereof may be performed in a manner that encodes information in the signal. As non-limiting examples, communication media may include wired media such as a wired network or a dedicated network, and various wireless media such as sound, radio frequency (RF), microwave, infrared (IR) or other wireless media. The term computer-readable media used herein may include both storage media and communication media. In a computing device 100 according to the present invention, the application 122 includes instructions for executing the decryption analysis method 200 of HTTPS encrypted traffic of the present invention.

[0035] Figure 2 FIG. 2 is a flow chart showing a method 200 for decrypting and analyzing HTTPS encrypted traffic according to an embodiment of the present invention. Figure 2 As shown, in step S210, a dedicated Wi-Fi network is set up and a dynamic certificate replacement mechanism is configured on its network devices.

[0036] First, select a Wi-Fi network device that supports SSL decryption to set up a dedicated Wi-Fi network. For example, create a dedicated SSID on a router or wireless access point device and set a strong password. Use MAC address filtering to ensure that only authorized devices can connect to the Wi-Fi network to reduce the risk of data leakage and ensure that the Wi-Fi network is isolated from other networks (such as internal networks, public networks, etc.). Configure the Wi-Fi network device to intercept and decrypt HTTPS traffic.

[0037] The core of the certificate replacement mechanism is to enable network devices to decrypt and view encrypted traffic between users and target websites by generating dynamic intermediate certificates. Generate an intermediate certificate and install it in the Wi-Fi network device. The main purpose of the intermediate certificate is to establish a chain structure between the root certificate and the server certificate so that the root certificate is not directly involved in the issuance of each website. Whenever the intermediate certificate needs to be used, it is temporarily injected into the Wi-Fi network device and used as a replacement certificate in the HTTPS handshake phase to achieve transparent decoding of encrypted data. Once the data verification is completed, the intermediate certificate will become invalid immediately to avoid the risk of long-term exposure.

[0038] Specifically, first create a root certificate. You can use OpenSSL to generate a private key for the root certificate and create a self-signed root certificate. Then generate an intermediate certificate. Use OpenSSL to generate a new private key for the intermediate certificate, create a certificate signing request for the intermediate certificate, and sign the intermediate certificate with the root certificate. Import the generated root certificate and intermediate certificate into the Wi-Fi network device. Import the intermediate certificate into the user device (mobile phone, computer, etc.) connected to the WiFi network.

[0039] Then in step S220, when the user device accesses the HTTPS website through the Wi-Fi network, the dynamic certificate replacement mechanism is implemented.

[0040] When the user device initiates an HTTPS request to access the target website server (such as HTTPS: / / example.com), the Wi-Fi network device intercepts the HTTPS request. A new certificate is dynamically generated using the pre-created intermediate certificate, and the certificate of the target server is replaced with the dynamically generated intermediate certificate.

[0041] In order to ensure the security of the intermediate certificate and prevent it from being abused or leaked, in one embodiment of the present invention, a trust chain of the intermediate certificate is configured. The private key of the intermediate certificate is encrypted and stored and backed up using OpenSSL. The access to the intermediate certificate and private key is monitored, and the intermediate certificate is updated when the loss or leak of the intermediate certificate is detected.

[0042] Finally, in step S230, after the certificate replacement is completed, the HTTPS encrypted traffic is decrypted and data analyzed to determine whether there is malware or abnormal behavior in the device.

[0043] Traffic decryption can be achieved by replacing the target server's certificate with an intermediate certificate trusted by the target server through a Wi-Fi network device. The intermediate certificate private key can be used to decrypt HTTPS encrypted traffic and convert the encrypted data into plaintext data. Key fields are extracted from the decrypted plaintext data, including user credentials, session ID, HTTP method, request parameters, etc.

[0044] Identify malware and abnormal behaviors in key fields based on security tools or traffic pattern analysis algorithms. For example, analyze application behavior and network request patterns to identify abnormal traffic peaks, frequent connection requests, etc. Use signature databases of known malware and data collection software to match key fields and identify known malware and data collection software.

[0045] You can also apply machine learning models to analyze traffic by first training the model to recognize normal traffic patterns and then monitoring traffic that deviates from normal traffic patterns. Alternatively, you can monitor traffic based on pre-defined security rules to detect specific types of attacks or suspicious behavior.

[0046] In a typical office environment, companies want to strengthen supervision of employee network behavior to prevent external hacker intrusion and internal information leakage. First, use wireless access points to configure a dedicated Wi-Fi network, and use MAC address filtering policies to only allow internal computers and mobile phones to join. Next, use OpenSSL to create a hierarchical root certificate and intermediate certificate system. Whenever an employee opens a web browser and tries to access an external website, the network device will immediately intervene in the HTTPS handshake, using the intermediate certificate instead of the original server certificate to establish a controlled communication channel. At this point, even highly confidential information can be fully parsed for background review, and all this is done without the user noticing.

[0047] Through the above technical solution, without configuring a proxy server, only connecting to a specific Wi-Fi network, implementing certificate replacement technology in the Wi-Fi network, so that the target device can decrypt traffic through the intermediate certificate when accessing the HTTPS website, simplifying the deployment process, reducing the difficulty of implementation and maintenance costs. The decrypted traffic can be analyzed in real time to detect potential malware or data collection software activities.

[0048] Figure 3 FIG. 3 is a schematic diagram showing a structure of a decryption and analysis device 300 for HTTPS encrypted traffic according to an embodiment of the present invention. Figure 3 As shown, the device 300 includes: a configuration module 310, a certificate replacement module 320 and a decryption analysis module 330.

[0049] The configuration module 310 is used to set up a dedicated Wi-Fi network and configure a dynamic certificate replacement mechanism on its network devices. Specifically, the configuration module 310 can set up an SSID and a strong password for the dedicated Wi-Fi network, configure MAC address filtering, and only allow authorized devices to connect. Generate a dynamic intermediate certificate on the Wi-Fi network device, install the root certificate on the user device, and configure the device to automatically update and trust the newly generated intermediate certificate.

[0050] The certificate replacement module 320 can implement a dynamic certificate replacement mechanism when the user device accesses an HTTPS website through a Wi-Fi network. For example, the certificate replacement module 320 can intercept the HTTPS request through a Wi-Fi network device, such as a router, when the user device requests an HTTPS website through a Wi-Fi network. A new certificate is dynamically generated using a pre-created intermediate certificate, and the certificate of the target server is replaced with the dynamically generated intermediate certificate.

[0051] After completing the certificate replacement, the decryption analysis module 330 can decrypt and analyze the HTTPS encrypted traffic to determine whether there is malware or abnormal behavior in the device. According to one embodiment of the present invention, the decryption analysis module 330 can use the intermediate certificate private key to decrypt the HTTPS encrypted traffic and convert the encrypted data into plaintext data. Extract key fields including user credentials, session ID, HTTP method, request parameters, etc. from the plaintext data. Analyze the patterns of application behavior and network requests to identify abnormal traffic peaks and frequent connection requests. Use the signature database of known malware and data collection software to match the key fields to identify known malware and data collection software.

[0052] In summary, the decryption analysis method and device for HTTPS encrypted traffic provided by the present invention can at least achieve the following technical effects: 1. By connecting to a specific Wi-Fi network and implementing certificate replacement technology in the Wi-Fi network, HTTPS traffic can be decrypted, avoiding the security risks caused by the configuration and management requirements of the proxy server, simplifying the deployment process and reducing maintenance costs; 2. Implementing certificate replacement technology in Wi-Fi networks enables user devices to decrypt traffic through intermediate certificates when accessing HTTPS websites, thus avoiding compatibility issues and being widely applicable to various devices and network environments.

[0053] 3. Users do not need to perform complex device settings or software installation. They only need to connect to a specific Wi-Fi network to achieve traffic decryption. When visiting HTTPS websites, they will not notice that the traffic is being analyzed, which improves the user experience and makes malware detection more convenient and efficient.

[0054] In the description provided herein, a large number of specific details are described. However, it is understood that embodiments of the present invention can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0055] Although the present invention has been described according to a limited number of embodiments, it will be apparent to those skilled in the art, with the benefit of the above description, that other embodiments may be envisioned within the scope of the invention thus described. In addition, it should be noted that the language used in this specification is selected primarily for readability and teaching purposes, rather than for explaining or defining the subject matter of the present invention. Therefore, many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the appended claims. The disclosure of the present invention is illustrative and not restrictive with respect to the scope of the present invention, and the scope of the present invention is defined by the appended claims.

Claims

1. A decryption analysis method for HTTPS encrypted traffic, characterized in that: include: Set up a dedicated Wi-Fi network and configure dynamic certificate replacement on its network devices; When a user device accesses an HTTPS website through the Wi-Fi network, implementing the dynamic certificate replacement mechanism; After the certificate replacement is completed, the HTTPS encrypted traffic is decrypted and data is analyzed to determine whether there is malware or abnormal behavior in the device.

2. The decryption analysis method for HTTPS encrypted traffic according to claim 1 is characterized in that: The steps of setting up a dedicated Wi-Fi network and configuring a dynamic certificate replacement mechanism on its network devices include: Setting up a dedicated Wi-Fi network through a Wi-Fi network device, wherein the Wi-Fi network is isolated from other networks; Configure Wi-Fi network equipment to intercept and decrypt HTTPS traffic; An intermediate certificate is generated, and the intermediate certificate is installed in the Wi-Fi network device and a user device connected to the Wi-Fi network.

3. The decryption analysis method for HTTPS encrypted traffic according to claim 2 is characterized in that: The steps of generating an intermediate certificate and installing the intermediate certificate in the Wi-Fi network device and a user device connected to the Wi-Fi network include: Use OpenSSL to generate the private key of the root certificate and create a self-signed root certificate; Use OpenSSL to generate the intermediate certificate private key, create a signing request for the intermediate certificate, and use the root certificate to sign the intermediate certificate; The intermediate certificate is installed in a Wi-Fi network device and a user device connected to the Wi-Fi network.

4. The decryption analysis method for HTTPS encrypted traffic according to claim 3 is characterized in that: When the user device accesses the HTTPS website through the Wi-Fi network, the step of implementing the dynamic certificate replacement mechanism includes: When a user device accesses an HTTPS website through the Wi-Fi network, the Wi-Fi network device intercepts the HTTPS request; Use the pre-created intermediate certificate to dynamically generate a new certificate and replace the target server's certificate with the dynamically generated intermediate certificate.

5. The decryption analysis method for HTTPS encrypted traffic according to claim 4 is characterized in that: When the user device accesses the HTTPS website through the Wi-Fi network, the step of implementing the dynamic certificate replacement mechanism also includes: Use OpenSSL to encrypt, store and back up the intermediate certificate private key; Monitor access to intermediate certificates and private keys, and renew intermediate certificates when loss or compromise is detected.

6. The decryption analysis method for HTTPS encrypted traffic according to claim 3 is characterized in that: After the certificate replacement is completed, the steps of decrypting and analyzing the HTTPS encrypted traffic to determine whether there is malware or abnormal behavior in the device include: Use the intermediate certificate private key to decrypt HTTPS encrypted traffic and convert the encrypted data into plaintext data; Extracting key fields from the plaintext data, the key fields including user credentials, session ID, HTTP method, and request parameters; Identify malware and anomalous behavior in the critical fields.

7. The decryption analysis method for HTTPS encrypted traffic according to claim 6 is characterized in that: The step of identifying malware and abnormal behavior in the key fields comprises: Analyze application behavior and network request patterns to identify abnormal traffic peaks and frequent connection requests; Identifies known malware and data collection software using a signature database of known malware and data collection software and matching against key fields.

8. A decryption and analysis device for HTTPS encrypted traffic, characterized in that: include: A configuration module, used to set up a dedicated Wi-Fi network and configure dynamic certificate replacement mechanism on its network devices; A certificate replacement module, used to implement the dynamic certificate replacement mechanism when the user device accesses the HTTPS website through the Wi-Fi network; The decryption analysis module is used to decrypt and analyze the HTTPS encrypted traffic after the certificate replacement is completed to determine whether there is malware or abnormal behavior in the device.

9. A computing device, characterized in that include: At least one processor and a memory storing program instructions, wherein the program instructions are configured to be suitable for being executed by the at least one processor, and the program instructions include instructions for executing the decryption analysis method of HTTPS encrypted traffic as described in any one of claims 1-7.

10. A readable storage medium storing program instructions, characterized in that: When the program instructions are read and executed by a computing device, the computing device executes the decryption and analysis method for HTTPS encrypted traffic as described in any one of claims 1-7.

Images