System and method for traffic decryption and analysis by bypass

Abstract

The invention discloses a bypass traffic decryption and analysis system and method, and belongs to the technical field of data communication, the system and method can realize relation extraction and automatic maintenance of a network analysis subsystem and a terminal analysis subsystem, the network analysis subsystem carries out full storage on target traffic and decrypts the target traffic after receiving key negotiation information, and the terminal analysis subsystem carries out decryption after receiving key negotiation information. According to the method, flow data loss under the condition that secret key negotiation information submission is lagged is prevented, the problem that quintuple information is inconsistent due to the fact that time difference exists between flow information of a terminal and a network end and scenes such as routing forwarding and port mapping can be effectively solved through a flow elastic identification mechanism, accurate matching of communication data flow is achieved, and the communication efficiency is improved. The terminal analysis subsystem can perform final key speculation by extracting a pre-master key or master key information so as to solve the problem that the final key information is inconvenient to directly send in part of terminal environments, simulation construction of plaintext traffic is realized through decrypted traffic content, and comprehensive reuse of a mature plaintext traffic analysis system technology is realized.

Description

Technical Field

[0001] The present invention belongs to the technical field of data communication, and in particular relates to a system and method for bypass traffic decryption and analysis. Background Art

[0002] With the deepening of information construction, the proportion of network traffic encryption has gradually increased. Except for a few basic protocols or special intranet environments, the application layer is almost fully encrypted. This change comes from the maturity of encrypted communication technology based on TLS protocol on the one hand, and from the further requirements of industry standards and network security laws and regulations on the other hand. In this context, traditional network security monitoring technology based on network traffic analysis is gradually becoming ineffective, which makes traffic encryption technology a double-edged sword. Although it makes direct end-to-end communication safer, from the perspective of security monitoring and security management, security risks are increasing. For example, network attacks and malicious program communications based on network encrypted traffic will become difficult to detect.

[0003] To solve the above problems, the following three technical solutions have gradually emerged in the industry: Solution 1: Transfer the network traffic encryption and decryption technology to a set of encryption and decryption gateway devices, and perform the analysis and detection of network traffic after decryption through the device. Although this solution achieves a balance between communication security and traffic monitoring to a certain extent, it has the following problems: 1. The deployment of a separate encryption and decryption gateway system requires the reconstruction of the business system architecture, which has high deployment costs. Especially for old systems or small systems, it is difficult to deploy or transform the architecture; 2. This encryption and decryption technology is only used for the server side of network communication. It cannot decrypt traffic for other terminals. Solution 2: For servers that need to be monitored for traffic analysis, import the TLS or SSL certificate and private key of their business system into the traffic analysis and detection system to decrypt and analyze the traffic. This solution does not require adjustment of the business system architecture and the cost is controllable, but it also has serious problems, mainly reflected in the following aspects: 1. This technical solution is only effective for a small number of insecure traffic encryption algorithms (for example, RSA-related encryption suites of TLS). The decryption rate is very low in the current network environment. With the further implementation of various security regulations, related traffic encryption algorithms will be completely eliminated, making it only a matter of time before this technical solution becomes completely ineffective. 2. This technical solution is also for the server side of network communication. It is impossible to decrypt the traffic for other terminals. Solution 3: Do not seek to decrypt traffic, but use artificial intelligence technology to analyze and detect encrypted traffic. Although this solution has a certain effect in a few security analysis scenarios, it also has obvious problems: 1. The missed alarm rate and false alarm rate of traffic detection are very high, which makes the actual application effect of this technical solution often very unsatisfactory; 2. It does not have the support capabilities for security evidence collection and result analysis, and is unable to analyze, confirm and handle traffic analysis and test results. Summary of the invention

[0004] In order to solve the problems raised in the above background technology, the present invention provides a system and method for bypass traffic decryption and analysis to solve the problems in the prior art such as high reconstruction cost, terminal limitations, low decryption rate, high missed alarm rate and false alarm rate, and lack of security forensics and result analysis.

[0005] To achieve the above object, the present invention provides the following technical solutions: A system for bypass traffic decryption and analysis, comprising: At least one network analysis subsystem; the network analysis subsystem includes a traffic cache module, a traffic decryption module, a traffic analysis module and a collaborative connection module, and the network analysis subsystem is used for traffic decryption and traffic analysis after decryption; At least one terminal analysis subsystem; the terminal analysis subsystem is arranged in the terminal, the terminal analysis subsystem is connected to the network analysis subsystem, the terminal analysis subsystem includes a key information extraction module, a process flow monitoring module, a data push module and a collaborative connection module, the terminal analysis subsystem is used to monitor the encrypted communication process and extract the key negotiation information in the communication process, and send the key negotiation information to the network analysis subsystem; Management and scheduling subsystem; the management and scheduling subsystem includes a connection management module, an association analysis module and an information transfer module. The management and scheduling subsystem is used for coverage relationship analysis of the network analysis subsystem and the terminal analysis subsystem.

[0006] A method for bypass traffic decryption and analysis, comprising the following steps: S1: All terminal analysis subsystems and network analysis subsystems establish initial registration connections with the management and scheduling subsystem. The management and scheduling subsystem records the network addresses of each terminal analysis subsystem and network analysis subsystem and allocates a unique identification code to each terminal analysis subsystem and network analysis subsystem; S2: All terminal analysis subsystems establish a heartbeat connection with the management and scheduling subsystem. The data content of the heartbeat connection includes a heartbeat flag, an asymmetric encrypted ciphertext of the terminal analysis subsystem identification code based on public key encryption, and a checksum of the signature information of the asymmetric encrypted ciphertext based on the heartbeat flag and the terminal analysis subsystem identification code. Each network analysis subsystem identifies and analyzes the entire traffic flow, identifies the heartbeat communication corresponding to itself in the entire traffic flow based on the asymmetric encryption algorithm calculated with a private key and the checksum signature algorithm, and sends the traffic summary information of the heartbeat communication to the management and scheduling subsystem. At the same time, the source IP of the corresponding heartbeat communication is marked as the target traffic IP, wherein the traffic summary information includes the identification code, time, communication five-tuple information of the corresponding network analysis subsystem, and the terminal analysis subsystem identification code; S3: The management and scheduling system analyzes the traffic summary information provided by each network analysis subsystem, and identifies the corresponding relationship between the terminal analysis subsystem and the network analysis subsystem, that is, whether the traffic of the terminal where the terminal analysis subsystem is located can be monitored by the network analysis subsystem; S4: The terminal analysis subsystem extracts the time information, five-tuple information, communication front packet sequence number combination hash, communication front packet identification code combination hash and key negotiation information of the terminal encryption communication through the hook encrypted communication interface function, and sends it to the management and scheduling subsystem; S5: The network analysis subsystem stores the entire encrypted traffic corresponding to the target traffic IP address marked in S2 and constructs a fast retrieval index through the time information, five-tuple information, the combined hash of the communication front packet sequence number, and the combined hash of the communication front packet identification code; S6: The management and scheduling subsystem forwards the information sent back by the terminal analysis subsystem to the corresponding network analysis subsystem based on the information received from the terminal analysis subsystem and the corresponding relationship between the terminal analysis subsystem and the network analysis subsystem analyzed in S3; S7: After receiving the encrypted communication related information sent back by the management and scheduling subsystem, the network analysis subsystem performs index elastic matching of the stored traffic. If the corresponding communication session traffic is found, it proceeds to S8. If not, it is deemed that the network analysis subsystem has not successfully saved the corresponding traffic, and the decryption process ends. S8: The network analysis subsystem combines the encryption negotiation process information in the communication session traffic and the key negotiation information sent by the terminal analysis subsystem to decrypt the corresponding traffic content; S9: Reconstruct plain text based on the decrypted traffic content and simulate the plain text communication data packets; S10: The network analysis subsystem analyzes and detects the decrypted and reconstructed traffic.

[0007] Preferably, the elastic matching process in S7 is specifically as follows: S7.1: extracting the time information of the communication-related information received from the terminal analysis subsystem within a specific range, and locking the time accuracy to a preset minute-level range of the precise time; S7.2: Based on the time range generated in S7.1, the traffic index query is performed in combination with the communication sequence number combined hash and the communication identification code combined hash returned by the terminal. If multiple communication records are found, the process proceeds to S7.3, otherwise, the process proceeds to S8; S7.3: Match the five-tuple information in the queried communication results with the five-tuple information returned by the terminal. The matching process is as follows: first try to match the entire five-tuple. If it hits, enter S8. Otherwise, exclude the source IP address of the five-tuple and match again. If it hits, enter S8. Otherwise, exclude the destination IP and destination port of the five-tuple and match again. If it hits, enter S8. Otherwise, only match from the source port of the five-tuple. If it hits, enter S8. Otherwise, it is considered a miss and the current decryption process ends.

[0008] Preferably, S8 is as follows: first, the final key is calculated based on the key negotiation process of the encrypted traffic. If the terminal analysis subsystem provides a pre-master key, the calculation process is to first calculate the master key through the pre-master key, and then calculate the final key through the master key. If the terminal analysis subsystem provides the master key, the final key is calculated directly. After obtaining the final key, the content of the encrypted traffic is decrypted based on the final key.

[0009] Preferably, in S10, the traffic analysis and detection operations include traffic protocol parsing, traffic correlation, traffic reassembly, load characteristic analysis, communication behavior analysis, and file restoration analysis operations.

[0010] Compared with the prior art, the present invention has the following beneficial effects: 1. For the terminal traffic deployed with the terminal analysis subsystem, full decryption analysis can be achieved, which is effective not only for the server but also for the client; 2. No modification is required to the existing network architecture, the deployment cost is very low, and it has better application value; 3. It is not limited to TLS RSA-related algorithms or TLS protocols, but is effective for traffic that uses a similar TLS negotiation encryption process (e.g. SSH protocol traffic), and the technical coverage is very wide; 4. It realizes the comprehensive reuse of traditional traffic analysis and detection technologies, giving full play to the relevant value of existing technology accumulation, without the need to separately implement analysis and detection technology after decryption of encrypted traffic. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 This is a flowchart of the application; Figure 2This is a diagram of the data structure of the heartbeat connection content. DETAILED DESCRIPTION

[0012] In order to facilitate those skilled in the art to understand the technical content of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific examples. It should be understood that the specific examples described herein are only used to explain the present invention and are not used to limit the present invention.

[0013] Some of the terms involved in this application are now explained: TLS protocol: Transport Layer Security Protocol, is an encrypted communication protocol that works at the transport layer and has become the standard communication encryption protocol for various business scenarios.

[0014] Data packet: A data format in computer networks. It is the basic unit of data transmission. In computer network communications, a data packet usually consists of multiple parts, including a frame header, data, and a frame tail.

[0015] TCP sequence number: A field in a TCP (Transmission Control Protocol) segment that identifies the order of data in the segment.

[0016] TCP acknowledgment number: An important field in the TCP (Transmission Control Protocol) segment, used to confirm that the receiver has successfully received the data.

[0017] Packet Identification Code: The packet identification code in the IP protocol header, which is used to uniquely identify the relevant terminal within a specific time range; Packet checksum: a checksum mechanism that is set up during data transmission to ensure the integrity and accuracy of data. It generates a checksum or checksum by performing a specific algorithm calculation on the data in the packet and appends it to the end of the packet or a specific location. After receiving the packet, the receiver will use the same algorithm to calculate the data and compare the result with the checksum provided by the sender to verify whether any error occurred during the data transmission process.

[0018] Pre-master secret: intermediate information in the SSL / TLS protocol key negotiation process, which is an important intermediate value information for calculating and generating the master key and the final communication key.

[0019] Master key: intermediate information in the SSL / TLS protocol key negotiation process, generated by the pre-master key calculation, and is an important intermediate value information for calculating the final communication key; Hook technology: a technology that intervenes and replaces the underlying function call, through which the parameter information of the underlying function can be obtained; Heartbeat connection: A communication technology for periodic data transmission, mainly used to maintain communication status or periodically transmit data information.

[0020] A system for bypass traffic decryption and analysis, comprising: At least one network analysis subsystem; the network analysis subsystem includes a traffic cache module, a traffic decryption module, a traffic analysis module and a collaborative connection module. The network analysis subsystem is used for traffic decryption and traffic analysis after decryption, wherein the traffic cache module mainly implements the storage of undecrypted traffic; the traffic decryption module mainly implements key calculation, traffic decryption and traffic simulation based on the key information from the terminal analysis subsystem; the traffic analysis module is mainly responsible for the extraction of traffic communication information and the analysis and detection of decrypted traffic; the collaborative connection module mainly implements and manages the initial registration of the scheduling subsystem and other connections; At least one terminal analysis subsystem; the terminal analysis subsystem is arranged in the terminal, the terminal analysis subsystem is connected to the network analysis subsystem, the terminal analysis subsystem includes a key information extraction module, a process flow monitoring module, a data push module and a collaborative connection module, the terminal analysis subsystem is used to monitor the encrypted communication process and extract the key negotiation information in the communication process, and send the key negotiation information to the network analysis subsystem, wherein the key information extraction module mainly realizes the extraction of process-related key information based on the hook technology; the process flow monitoring module mainly realizes the association between process information and communication flow data and extracts the relevant hash value for identifying the communication flow; the data push module mainly realizes the integration of key information, process information and flow information and pushes it to the management and scheduling system; the collaborative connection module mainly realizes and maintains the initial registration and heartbeat connection communication of the management and scheduling subsystem; Management and scheduling subsystem; the management and scheduling subsystem includes a connection management module, an association analysis module and an information transfer module. The management and scheduling subsystem is used for coverage relationship analysis of the network analysis subsystem and the terminal analysis subsystem, wherein the connection management module mainly implements registration management and heartbeat connection management with the terminal analysis subsystem and the network analysis subsystem; the association analysis module mainly implements the analysis of the corresponding relationship between the network and the terminal based on the uploaded relevant information to determine the network analysis subsystem node to which the relevant key information should be sent; the information transfer module mainly implements the reception of data uploaded by the terminal analysis subsystem and the network analysis subsystem and the forwarding of key related information.

[0021] A method for bypassing traffic decryption and analysis, such as Figure 1 As shown, the following steps are included: 1. System preparation stage: S1: The terminal analysis subsystem and the network analysis subsystem respectively establish initial registration connections with the management and scheduling subsystem. The management and scheduling subsystem records the network addresses of each subsystem and allocates unique identification codes to the terminal analysis subsystem and the network analysis subsystem respectively. S2: The terminal analysis subsystem establishes a heartbeat connection with the management and scheduling subsystem, such as Figure 2 As shown, the data content of the heartbeat connection is a combination of a heartbeat flag, a terminal analysis subsystem identification code asymmetric encryption ciphertext (public key encryption) and a check value (signature information based on the heartbeat flag and the terminal identification code ciphertext). The network analysis subsystem identifies and analyzes the entire traffic flow, identifies the corresponding heartbeat communication based on the same asymmetric encryption algorithm (private key calculation) and check value signature algorithm, and sends the traffic summary information of the heartbeat communication to the management and scheduling subsystem. At the same time, the source IP of the corresponding communication is marked as the target traffic IP, wherein the traffic summary information includes the current network analysis subsystem identification code, time, communication five-tuple information (source IP, destination IP, source port, destination port, transport layer protocol), and a combination of the terminal analysis subsystem identification code in the traffic flow; S3: The management and scheduling system analyzes the traffic summary information provided by each network analysis subsystem, and identifies the corresponding relationship between the terminal analysis subsystem and the network analysis subsystem, that is, whether the traffic of the terminal where the terminal analysis subsystem is located can be monitored by the network analysis subsystem.

[0022] 2. Encrypted traffic monitoring stage: S4: The terminal analysis subsystem monitors the encrypted traffic key negotiation process in its terminal, and extracts the encrypted communication time information, five-tuple information (source IP, destination IP, source port, destination port, transport layer protocol), the communication front packet sequence number (TCP protocol sequence number) combined hash (combined by the sequence numbers of the first few data packets of the communication, and then the hash value is generated by the hash algorithm), the communication front packet identification code (IP protocol Identification field) combined hash (combined by the identification codes of the first few data packets of the communication, and then the hash value is generated by the hash algorithm) and key negotiation information (one of the pre-master key, master key or final key) through the hook encrypted communication interface function and sends it to the management and scheduling subsystem; S5: The network analysis subsystem stores the entire encrypted traffic corresponding to the target traffic IP address marked by S2 and constructs a fast retrieval index through the hash combination of time information, five-tuple information, communication front packet sequence number, and communication front packet identification code (Identification field of IP protocol); S6: The management and scheduling subsystem forwards the terminal analysis subsystem return information to the corresponding network analysis subsystem based on the received terminal analysis subsystem return information and the correspondence between the terminal analysis subsystem and the network analysis subsystem analyzed in S3; S7: After receiving the encrypted communication related information indirectly sent back by the terminal analysis subsystem, the network analysis subsystem performs elastic matching of the index of the stored traffic to find the corresponding communication session traffic. The following is the specific process of elastic matching: S7.1: Extract the time information of the communication-related information received from the terminal analysis subsystem in a specific range, and lock the time accuracy to the 10-minute range corresponding to the precise time (remove the second-level accuracy, and take 5 minutes before and after), that is: if the received time is 2024-11-1112:05:06, the corresponding time range is 2024-11-1112:00:00~2024-11-1112:10:00; S7.2: Based on the time range generated in S7.1, the traffic index query is performed in combination with the communication sequence number combined hash and the communication identification code combined hash returned by the terminal. If multiple communication records are found, the process proceeds to S7.3, otherwise, the process proceeds to S8; S7.3: Match the five-tuple information in the queried communication results with the five-tuple information returned by the terminal. The matching process is as follows: first try to match the entire five-tuple. If it hits, enter S8, otherwise exclude the source IP address of the five-tuple for matching (to deal with the situation where the source IP changes due to NAT routing conversion). If it hits, enter S8, otherwise exclude the destination IP and destination port of the five-tuple for matching (to deal with the situation of NAT routing port mapping). If it hits, enter S8, otherwise only match from the source port of the five-tuple. If it hits (to deal with the situation where there is both source IP conversion and port mapping in NAT mode), enter S8, otherwise it is deemed to be a miss (that is, the network analysis subsystem did not successfully save the corresponding traffic), and the current decryption process ends.

[0023] S8: The network analysis subsystem combines the encryption negotiation process information (encryption suite, random number, etc.) in the communication session traffic and the key negotiation information sent by the terminal analysis subsystem to decrypt the corresponding traffic content. This link first calculates the final key based on the key negotiation process of the encrypted traffic. If the terminal analysis subsystem provides a pre-master key (Pre-MasterKey), the calculation process is to first calculate the master key (MasterKey) through the pre-master key, and then calculate the final key through the master key. If the terminal analysis subsystem provides a master key, the final key is directly calculated. After obtaining the final key, the encrypted traffic content is decrypted based on the key; S9: Based on the decrypted traffic content, the simulation construction of plain text communication is mainly aimed at the length distribution of the decrypted plain text content (i.e., the length distribution of each data packet), and the TCP sequence number (SEQ value), TCP confirmation number (ACK value) and checksum value of each data packet are recalculated to achieve the plain text reconstruction of the entire data flow and the simulation of the plain text communication data packet; S10: The network analysis subsystem analyzes and detects the traffic after decryption and reconstruction. This part is consistent with the technical process related to traditional traffic analysis and detection, including traffic protocol analysis, traffic correlation, traffic reorganization, load feature analysis, communication behavior analysis, file restoration analysis and other related links, which can all achieve capability upgrades based on the traffic decryption process.

[0024] In this embodiment, the present application realizes the relationship extraction and automatic maintenance between the network analysis subsystem and the terminal analysis subsystem through the design of the central collaboration of the management scheduling subsystem and the heartbeat connection of the terminal analysis subsystem. The network analysis subsystem stores the target traffic in full and decrypts it after receiving the key negotiation information to prevent the loss of traffic data in the case of delayed reporting of the key negotiation information. The traffic elasticity identification mechanism constructed based on the time range, the communication data packet sequence number combination hash, the communication data packet identification code combination hash and the communication five-tuple information can effectively deal with the time difference between the terminal and the network traffic information and the five-tuple information inconsistency caused by the scenarios such as routing forwarding and port mapping, and realize accurate matching of communication data traffic. The terminal analysis subsystem can extract the pre-master key or master key information to infer the final key instead of directly extracting the final key, which can solve the problem that it is inconvenient to directly pass the final key information in some terminal environments. The simulation construction of plaintext traffic is realized through the decrypted traffic content, and the comprehensive reuse of mature plaintext traffic analysis system technology is realized.

[0025] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A system for bypass traffic decryption and analysis, characterized in that: include: at least one network analysis subsystem; The network analysis subsystem includes a traffic cache module, a traffic decryption module, a traffic analysis module and a collaborative connection module. The network analysis subsystem is used for traffic decryption and traffic analysis after decryption. at least one terminal analysis subsystem; The terminal analysis subsystem is set in the terminal and connected to the network analysis subsystem. The terminal analysis subsystem includes a key information extraction module, a process flow monitoring module, a data push module and a collaborative connection module. The terminal analysis subsystem is used to monitor the encrypted communication process and extract the key negotiation information in the communication process, and send the key negotiation information to the network analysis subsystem; Management and scheduling subsystem; the management and scheduling subsystem includes a connection management module, an association analysis module and an information transfer module. The management and scheduling subsystem is used for coverage relationship analysis of the network analysis subsystem and the terminal analysis subsystem.

2. A method for bypass traffic decryption and analysis, applied to a bypass traffic decryption and analysis system as claimed in claim 1, characterized in that: The following steps are involved: S1: All terminal analysis subsystems and network analysis subsystems establish initial registration connections with the management and scheduling subsystem. The management and scheduling subsystem records the network addresses of each terminal analysis subsystem and network analysis subsystem and allocates a unique identification code to each terminal analysis subsystem and network analysis subsystem; S2: All terminal analysis subsystems establish a heartbeat connection with the management and scheduling subsystem. The data content of the heartbeat connection includes a heartbeat flag, an asymmetric encrypted ciphertext of the terminal analysis subsystem identification code based on public key encryption, and a checksum of the signature information of the asymmetric encrypted ciphertext based on the heartbeat flag and the terminal analysis subsystem identification code. Each network analysis subsystem identifies and analyzes the entire traffic flow, identifies the heartbeat communication corresponding to itself in the entire traffic flow based on the asymmetric encryption algorithm calculated with a private key and the checksum signature algorithm, and sends the traffic summary information of the heartbeat communication to the management and scheduling subsystem. At the same time, the source IP of the corresponding heartbeat communication is marked as the target traffic IP, wherein the traffic summary information includes the identification code, time, communication five-tuple information of the corresponding network analysis subsystem, and the terminal analysis subsystem identification code; S3: The management and scheduling system analyzes the traffic summary information provided by each network analysis subsystem, and identifies the corresponding relationship between the terminal analysis subsystem and the network analysis subsystem, that is, whether the traffic of the terminal where the terminal analysis subsystem is located can be monitored by the network analysis subsystem; S4: The terminal analysis subsystem extracts the time information, five-tuple information, communication front packet sequence number combination hash, communication front packet identification code combination hash and key negotiation information of the terminal encryption communication through the hook encrypted communication interface function, and sends it to the management and scheduling subsystem; S5: The network analysis subsystem stores the entire encrypted traffic corresponding to the target traffic IP address marked in S2 and constructs a fast retrieval index through the time information, five-tuple information, the combined hash of the communication front packet sequence number, and the combined hash of the communication front packet identification code; S6: The management and scheduling subsystem forwards the information sent back by the terminal analysis subsystem to the corresponding network analysis subsystem based on the information received from the terminal analysis subsystem and the corresponding relationship between the terminal analysis subsystem and the network analysis subsystem analyzed in S3; S7: After receiving the encrypted communication related information sent back by the management and scheduling subsystem, the network analysis subsystem performs index elastic matching of the stored traffic. If the corresponding communication session traffic is found, it proceeds to S8. If not, it is deemed that the network analysis subsystem has not successfully saved the corresponding traffic, and the decryption process ends. S8: The network analysis subsystem combines the encryption negotiation process information in the communication session traffic and the key negotiation information sent by the terminal analysis subsystem to decrypt the corresponding traffic content; S9: Reconstruct plain text based on the decrypted traffic content and simulate the plain text communication data packets; S10: The network analysis subsystem analyzes and detects the decrypted and reconstructed traffic.

3. The method for bypassing traffic decryption and analysis according to claim 2, characterized in that: The elastic matching process in S7 is as follows: S7.1: extracting the time information of the communication-related information received from the terminal analysis subsystem within a specific range, and locking the time accuracy to a preset minute-level range of the precise time; S7.2: Based on the time range generated in S7.1, the traffic index query is performed in combination with the communication sequence number combined hash and the communication identification code combined hash returned by the terminal. If multiple communication records are found, the process proceeds to S7.3, otherwise, the process proceeds to S8; S7.3: Match the five-tuple information in the queried communication results with the five-tuple information returned by the terminal. The matching process is as follows: first try to match the entire five-tuple. If it hits, enter S8. Otherwise, exclude the source IP address of the five-tuple and match again. If it hits, enter S8. Otherwise, exclude the destination IP and destination port of the five-tuple and match again. If it hits, enter S8. Otherwise, only match from the source port of the five-tuple. If it hits, enter S8. Otherwise, it is considered a miss and the current decryption process ends.

4. The method for bypassing traffic decryption and analysis according to claim 2, characterized in that: Specifically in S8: First, the final key is calculated based on the key negotiation process of the encrypted traffic. If the terminal analysis subsystem provides a pre-master key, the calculation process is to first calculate the master key through the pre-master key, and then calculate the final key through the master key. If the terminal analysis subsystem provides a master key, the final key is calculated directly. After obtaining the final key, the content of the encrypted traffic is decrypted based on the final key.

5. The method for bypassing traffic decryption and analysis according to claim 2, characterized in that: In S10, the traffic analysis and detection operations include traffic protocol analysis, traffic correlation, traffic reassembly, load feature analysis, communication behavior analysis, and file restoration analysis operations.

Images