An HTTPS attack traffic restoration method and system

Abstract

The application discloses an HTTPS attack traffic restoration method and system, and belongs to the fields of computer network security and traffic analysis. The method comprises the following steps: establishing an attacker behavior knowledge base, wherein the attacker behavior knowledge base is used for describing system call behavior events that must be executed by an attacker to achieve an attack purpose; constructing a behavior event tree of each HTTPS request in HTTPS traffic; wherein the behavior event tree comprises an HTTPS request event, a system call behavior event and an HTTPS response event, and the data of the HTTPS request event and the HTTPS response event are respectively associated with the plaintext data of the HTTPS request and the HTTPS response; matching the system call behavior event in the attacker behavior knowledge base, and performing HTTPS traffic restoration of the HTTPS request based on the plaintext data of the HTTPS request and the HTTPS response when the matching is successful. The application can associate attack traffic with attack behavior, and then restore the attack traffic.

Description

Technical Field

[0001] This invention relates to the fields of computer network security and traffic analysis, specifically to a method and system for reconstructing HTTPS attack traffic. Background Technology

[0002] According to statistics from w3techs, the proportion of websites using HTTPS as their default protocol rose from 22.5% to 80% between 2017 and 2022. As of November 2023, 84.6% of all websites worldwide used HTTPS as their default protocol. With increasing awareness of cybersecurity and privacy protection, the number of websites using HTTPS as their default protocol has been rising year by year. However, while HTTPS protects user privacy, it also affects the ability of defenders to review traffic content. In the process of attack and defense, HTTPS has become a serious blind spot for traffic analysis devices. Traffic auditing devices deployed in the network environment are in the same situation as attackers, unable to recover data information, only able to obtain encrypted ciphertext from the traffic. Thanks to the security of modern encryption algorithms, eavesdroppers find it difficult to recover sufficiently useful information from the ciphertext.

[0003] In addition, thousands, even tens of thousands, of new web vulnerabilities are discovered every year. Conventional traffic analysis is mostly based on known rules and can only analyze known attacks. It is ineffective in detecting obfuscated or transformed attack payloads and has no ability to detect unknown zero-day vulnerabilities. Therefore, the ability to decrypt HTTPS traffic and correlate traffic detection with attack behavior to detect known attacks and discover unknown attacks is a major direction of current cybersecurity research. Summary of the Invention

[0004] To address the aforementioned issues, this invention proposes a method and system for restoring HTTPS attack traffic. It utilizes EBPF technology to instrument HTTPS servers, decrypts HTTPS traffic, and analyzes web application behavior to achieve the decryption of HTTPS traffic. Furthermore, by associating the attack traffic with the attack behavior, the attack traffic is restored.

[0005] To achieve the above objectives, the specific technical solutions adopted by the present invention include the following:

[0006] A method for restoring HTTPS attack traffic, the method comprising:

[0007] Establish an attacker behavior knowledge base, which describes the system call behavior events that an attacker will definitely execute to achieve their attack objectives.

[0008] Construct a behavior event tree for each HTTPS request in the HTTPS traffic; wherein the behavior event tree includes: HTTPS request events, system call behavior events, and HTTPS response events, and the data of the HTTPS request events and the HTTPS response events are respectively associated with the plaintext data of the HTTPS request and the HTTPS response;

[0009] The system call behavior events are matched against the attacker's behavior knowledge base. If a match is found, the HTTPS traffic of the HTTPS request is reconstructed based on the plaintext data of the HTTPS request and HTTPS response.

[0010] Furthermore, construct the behavior event tree for each HTTPS request in the HTTPS traffic, including:

[0011] Instrumentation of key functions for HTTPS traffic encryption and decryption using EBPF technology;

[0012] Instrumentation of critical system calls in the operating system kernel is performed using EBPF technology;

[0013] When the web server receives an HTTPS request, it creates a Span root node and marks the Span root node as active.

[0014] When the web server reads an HTTPS request, it creates an HTTPS request event based on the relevant hooks generated by EBPF technology and obtains the plaintext data of the HTTPS request. The HTTPS request event, the system call behavior event, and the HTTPS response event are described by metadata and attributes. The metadata includes: time, thread ID, the span node to which it belongs, and the event name. The attributes are the corresponding data obtained from the kernel's critical system calls. The time, thread ID, and event name are obtained according to the relevant hooks generated by EBPF technology.

[0015] Using the time and thread ID in the HTTPS request event as an index, find the currently active Span root node, associate the HTTPS request event with the found Span root node, and update the Span node to which the HTTPS request event belongs based on the Span root node.

[0016] When the web server processes HTTPS requests, based on the relevant hooks generated in EBPF technology according to the system call behavior, system call behavior events and Span nodes are created, and the Span node is marked as active;

[0017] Using the time, thread ID, and attributes in the system call behavior event as indexes, the Span node to which the system call behavior event belongs is found. After associating the system call behavior event with the found Span node, the Span node to which the HTTPS request event belongs is updated based on the Span node.

[0018] For a Span node that is already associated with a system call behavior event, use the time and thread ID in the system call behavior event as an index to find the Span root node or Span node to generate the parent-child relationship in the behavior event tree.

[0019] When the web server finishes processing the HTTPS request, an HTTPS response event is created based on the relevant hooks generated in the eBPF technology, and the plaintext data of the HTTPS response is obtained.

[0020] Using the time and thread ID in the HTTPS response event as an index, find the currently active Span root node, associate the HTTPS response event with the found Span root node, and update the Span node to which the HTTPS response event belongs based on the Span root node.

[0021] After the HTTPS request is completed, mark the Span root node and all Span nodes under that Span root node as inactive.

[0022] Furthermore, using the time, thread ID, and attributes of the system call behavior event as indexes, the Span node to which the system call behavior event belongs is located, including:

[0023] Using the time, thread ID, and attributes in the system call behavior event as indexes, search for active Span nodes;

[0024] If a corresponding Span node is found among the active Span nodes, then that Span node is taken as the Span node to which the system call behavior event belongs.

[0025] If no corresponding Span node is found among the active Span nodes, a new Span node is created and designated as the Span node to which the system call behavior event belongs.

[0026] Furthermore, system call behavior events are matched within the attacker behavior knowledge base, including:

[0027] Obtain a list of rules for system call events that an attacker will definitely execute to achieve their attack objectives;

[0028] Match the attributes of the system call behavior event in the rule list.

[0029] Furthermore, if a match is successful, the HTTPS traffic of the HTTPS request is reconstructed based on the plaintext data of the HTTPS request and HTTPS response, including:

[0030] Retrieve the Span node to which the system call behavior event belongs;

[0031] Based on the behavior event tree, obtain the root node of the Span corresponding to the Span node to which it belongs;

[0032] Retrieve the plaintext data of the HTTPS request and HTTPS response corresponding to the root node of the Span;

[0033] Reconstruct the HTTPS traffic of the HTTPS request based on the plaintext data of the HTTPS request and HTTPS response.

[0034] An HTTPS attack traffic recovery system, the system comprising:

[0035] The knowledge base construction module is used to build an attacker behavior knowledge base, which describes the system call behavior events that an attacker will definitely execute to achieve their attack objectives.

[0036] The behavior event tree construction module is used to construct the behavior event tree for each HTTPS request in HTTPS traffic; wherein, the behavior event tree includes: HTTPS request events, system call behavior events and HTTPS response events, and the data of the HTTPS request events and the HTTPS response events are respectively associated with the plaintext data of the HTTPS request and the HTTPS response;

[0037] The HTTPS traffic restoration module is used to match system call behavior events in the attacker behavior knowledge base, and if the match is successful, restore the HTTPS traffic of the HTTPS request based on the plaintext data of the HTTPS request and HTTPS response.

[0038] An electronic device includes: a processor and a memory storing computer program instructions; the processor, when executing the computer program instructions, implements the HTTPS attack traffic restoration method described above.

[0039] A computer-readable storage medium storing computer program instructions that, when executed by a processor, implement the HTTPS attack traffic restoration method described above.

[0040] A computer program product, characterized in that, when the computer program product is run on a computer device, it causes the computer device to execute any of the above-described HTTPS attack traffic restoration methods.

[0041] Compared with the prior art, the present invention has at least the following beneficial effects.

[0042] Due to the widespread adoption of HTTPS, network defenders are unable to effectively analyze attack payloads within encrypted traffic, leaving many HTTPS devices as blind spots in defense. Conventional attack detection based on traffic rules can only address known risks and cannot effectively prevent undisclosed attacks. This invention addresses this problem by proposing a method for HTTPS attack traffic reconstruction, enabling the decryption of HTTPS traffic and the detection of unknown network attack behaviors. This method can effectively reconstruct the plaintext of HTTPS encrypted traffic and discover attack behaviors within web services, improving the speed of network attack detection and response in HTTPS environments, and achieving the goal of detecting HTTPS attack traffic. Attached Figure Description

[0043] Figure 1 This is a system architecture diagram of the present invention.

[0044] Figure 2 This is an algorithm flowchart describing HTTPS requests using Span / Event.

[0045] Figure 3 This is a flowchart of the algorithm for associating Span with Event.

[0046] Figure 4 It is an algorithm flowchart that associates attack behavior with attack traffic.

[0047] In the diagram, 210, 220, 230, 240, 250, 260, 270, 280, 290, 310, 320, 330, 340, 410, 420, 430, and 440 represent steps. Detailed Implementation

[0048] To enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, and to make the objectives, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments.

[0049] This invention provides an HTTPS attack traffic recovery system, the system architecture of which is as follows: Figure 1As shown, it is mainly divided into three modules: knowledge base construction module, behavior event tree construction module, and HTTPS traffic restoration module. These three modules involve four parts: user-mode processing program, kernel-mode instrumentation program, attacker behavior knowledge base, and behavior event database.

[0050] The attacker behavior knowledge base records attacker behaviors in real-world attack scenarios summarized by experts. It describes the corresponding actions that attackers will take when carrying out attacks, thus characterizing attacks from a behavioral perspective.

[0051] The kernel instrumentation program is responsible for instrumenting OpenSSL and kernel system calls, and sends the events generated by the instrumentation to the user-space handlers via ebpfmap for processing, so as to achieve the observation of events during the HTTPS traffic processing.

[0052] The user-space program is responsible for processing data output from kernel space, establishing a correlation between HTTPS traffic and web application behavior, and storing the correlated data in a behavior event database. Specifically, the user-space event handler analyzes EBPF instrumentation events and correlates HTTPS traffic with web application behavior. This program loads the EBPF kernel program, configures the EBPF program using ebpfmap, and receives events output from the kernel's EBPF instrumentation. It standardizes the EBPF instrumentation events to obtain Events; orchestrates Events using time and thread ID as indices to obtain Spans; establishes parent-child relationships between Spans based on these relationships; obtains the mapping between HTTPS traffic and web application behavior based on the Span relationships; and matches this mapping with an attack behavior knowledge base to obtain the plaintext of the HTTPS attack traffic and the corresponding attack behavior.

[0053] The event database records the Span and Event data from the above observation process, as well as the data that has been correlated, and compares it with the attacker behavior knowledge base to discover attack behaviors.

[0054] The HTTPS attack traffic restoration method disclosed in this invention includes the following steps 1 to 3.

[0055] Step 1: Establish an attacker behavior knowledge base.

[0056] Although attackers may use different payloads for different vulnerability types, their attack objectives remain consistent. Therefore, analyzing the attacker's objectives and describing their behavior can effectively detect attacks. Based on the above, this invention can model attacker intent in a real-world environment and establish an attacker behavior knowledge base. This knowledge base describes the system call behaviors that attackers will inevitably execute to achieve their attack objectives.

[0057] Step 2: Construct the behavior event tree for each HTTPS request in the HTTPS traffic.

[0058] The process of constructing the behavior event tree for HTTPS requests primarily involves: first, instrumenting the OpenSSL library using EBPF technology to obtain the corresponding plaintext data by instrumenting key functions for HTTPS traffic encryption and decryption, thus enabling HTTPS traffic decryption; next, instrumenting critical system calls in the operating system kernel using EBPF technology to monitor the behavior of web services from aspects such as network, file, process, and I / O; then, using ebpfmap to facilitate communication between the EBPF instrumentation and user space, with the EBPF instrumentation reporting instrumentation-triggered data to the user space via ebpfmap, and the user space program dynamically distributing configurations to the EBPF instrumentation through ebpfmap; finally, the user space program constructs the behavior event tree for each HTTPS request by receiving events generated by the EBPF instrumentation program, thereby obtaining the behavior sequence of the web service, and establishing a behavioral description of the web service process by defining Span and Event.

[0059] In this behavior event tree, an Event is defined as an action triggered by EBPF instrumentation. It describes an action that occurs within a specific behavior of the web service process, such as opening a file, creating a process, or initiating a network connection. An Event is described by two parts: metadata and attributes. The metadata consists of a four-tuple of time, thread ID, span, and event name, describing the Event's general properties. Attributes describe the unique parameters for different Event behaviors.

[0060] An Attribute is defined as a property whose value is the corresponding data obtained from the kernel when the EBPF instrumentation is triggered. Different Events have different Attributes. The Attribute is serialized into JSON format to achieve unified storage of Attributes.

[0061] A span is defined as the time span of an action, describing a period of time during which a web service process performs a certain type of action. Examples of actions include: performing a remote network communication, the creation and destruction of a child process, and the time it takes to open and read a file. A span is composed of events, and a span can contain one or more events. Spans have parent-child relationships; a child span describes the subordinate actions generated during the action of its parent span. By associating spans, a complete description of the web service process's behavior can be achieved.

[0062] In one embodiment, the user-space program constructs a behavior event tree for each HTTPS request by receiving events generated by the ebpf instrumentation program, such as... Figure 2 As shown, it includes the following steps 210 to 290.

[0063] Step 210: When the web server receives an HTTPS request, it creates a root span and marks it as active. This root span describes the entire behavioral flow of the web server from accepting the current HTTPS request to completing the response. During the request processing and response process, the spans used to describe the remaining ancillary behaviors caused by the request are all child spans of the root span.

[0064] Step 220: The web server reads the HTTPS request, triggers the HTTPS traffic decryption hook in ebpf, obtains the plaintext traffic of the HTTPS request, and creates an HTTPS request event.

[0065] Step 230: Obtain the time and thread ID from the HTTPS request Event metadata as an index, find the currently active root Span, and associate the HTTPS request Event with the found Span.

[0066] Step 240: During the processing of HTTPS requests, the web server performs a series of actions, triggering other ebpfhooks, generating corresponding child spans, and marking them as active.

[0067] Step 250: Similar to step 240, the creation of a Span also corresponds to the generation of a related Event.

[0068] Step 260: For different Span types, use the time, thread ID, and additional attributes in the Event metadata as indexes to find the Span to which the Event belongs, and associate it with the current Event.

[0069] Step 270: Process the Spans generated in HTTPS requests and associate them with the root Span using time and thread ID as indexes. In this step, there may be cases where the current Span has lower-level child Spans. The child Spans can be associated with the parent Span using the method described in Step 260 or Step 270, depending on their type.

[0070] Step 280: After the HTTPS request is processed, the web server writes an HTTPS response, triggering EBPF. The hook retrieves the plaintext traffic of the response and creates an HTTPS response event. This is then associated with the root span in the same way as in step 230.

[0071] Step 290: After the HTTPS request is completed, it means that the processing of the current HTTPS request is finished. Remove the current root span and all its child spans from the active spans, and use the root span as a complete description of the behavior during the HTTPS request process.

[0072] Specifically, when discussing the association between Span and Event in steps 230, 260, and 280, the following can be applied: Figure 3 The algorithm for the association between Span and Event specifically includes the following steps 310 to 340.

[0073] Step 310: When ebpfhook is triggered, a corresponding event will be generated according to the hook type. The event attributes are different depending on the hook, but all events contain metadata consisting of a four-tuple of time, thread ID, span, and event name.

[0074] Step 320: Generate the corresponding index using the event's metadata and attributes. Figure 2 Steps 230, 260, and 280 all involve generating an index in this step to find the Span.

[0075] Step 330: Use the generated index to check if a corresponding active Span exists. If the search is successful, use the existing Span; otherwise, create the corresponding Span and mark it as active.

[0076] Step 340: Update the Span field in the current event metadata to complete the addition of the event to the subsequent attack behavior and attack traffic matching algorithm.

[0077] Step 3: Match system call behavior events in the attacker behavior knowledge base, and if the match is successful, restore the HTTPS traffic of the HTTPS request based on the plaintext data of the HTTPS request and HTTPS response.

[0078] This step first uses the attack behavior and attack traffic matching algorithm proposed in this invention to match the attack behavior and attack traffic, and then restores the HTTPS attack traffic based on the plaintext data corresponding to the matching results.

[0079] in, Figure 4 The algorithm for matching attack behavior with attack traffic is explained in detail below:

[0080] Step 410: For each behavior generated in the web service, compare the generated Event with the attack behaviors in the knowledge base to determine if it is an attack behavior. If an attack entry is matched, further processing is performed; otherwise, it is considered a normal behavior and ignored. It should be noted that the knowledge base not only contains rule matching for single events, but also for event groups consisting of multiple events in a time series.

[0081] Step 420: Search upwards through the span in the Event metadata until the root span describing the entire HTTPS request is found.

[0082] Step 430: Locate HTTPS request and HTTPS response events in the root Span, and extract the plaintext traffic of the HTTPS requests and responses from the events.

[0083] Step 440: The attack behavior matched with the knowledge base is associated with the specific plaintext traffic, and the attack behavior and attack traffic matching algorithm ends.

[0084] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail using examples, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for restoring HTTPS attack traffic, characterized in that, The method includes: Establish an attacker behavior knowledge base, which describes the system call behavior events that an attacker will definitely execute to achieve their attack objectives. Construct a behavior event tree for each HTTPS request in the HTTPS traffic; wherein the behavior event tree includes: HTTPS request events, system call behavior events, and HTTPS response events, and the data of the HTTPS request events and the HTTPS response events are respectively associated with the plaintext data of the HTTPS request and the HTTPS response; The system call behavior events are matched in the attacker behavior knowledge base, and if the match is successful, the HTTPS traffic of the HTTPS request is restored based on the plaintext data of the HTTPS request and HTTPS response. The construction of the behavior event tree for each HTTPS request in the HTTPS traffic includes: Instrumentation of key functions for HTTPS traffic encryption and decryption using EBPF technology; Instrumentation of critical system calls in the operating system kernel is performed using EBPF technology; When the web server receives an HTTPS request, it creates a Span root node and marks the Span root node as active. When the web server reads an HTTPS request, it creates an HTTPS request event based on the relevant hooks generated by EBPF technology and obtains the plaintext data of the HTTPS request. The HTTPS request event, the system call behavior event, and the HTTPS response event are described by metadata and attributes. The metadata includes: time, thread ID, the span node to which it belongs, and the event name. The attributes are the corresponding data obtained from the kernel's critical system calls. The time, thread ID, and event name are obtained according to the relevant hooks generated by EBPF technology. Using the time and thread ID in the HTTPS request event as an index, find the currently active Span root node, associate the HTTPS request event with the found Span root node, and update the Span node to which the HTTPS request event belongs based on the Span root node. When the web server processes HTTPS requests, based on the relevant hooks generated in EBPF technology according to the system call behavior, system call behavior events and Span nodes are created, and the Span node is marked as active; Using the time, thread ID, and attributes in the system call behavior event as indexes, the Span node to which the system call behavior event belongs is found. After associating the system call behavior event with the found Span node, the Span node to which the HTTPS request event belongs is updated based on the Span node. For a Span node that is already associated with a system call behavior event, use the time and thread ID in the system call behavior event as an index to find the Span root node or Span node to generate the parent-child relationship in the behavior event tree. When the web server finishes processing the HTTPS request, an HTTPS response event is created based on the relevant hooks generated in the eBPF technology, and the plaintext data of the HTTPS response is obtained. Using the time and thread ID in the HTTPS response event as an index, find the currently active Span root node, associate the HTTPS response event with the found Span root node, and update the Span node to which the HTTPS response event belongs based on the Span root node. After the HTTPS request is completed, mark the Span root node and all Span nodes under that Span root node as inactive.

2. The method according to claim 1, characterized in that, Using the time, thread ID, and attributes of the system call event as indexes, find the Span node to which the system call event belongs, including: Using the time, thread ID, and attributes in the system call behavior event as indexes, search for active Span nodes; If a corresponding Span node is found among the active Span nodes, then that Span node is taken as the Span node to which the system call behavior event belongs. If no corresponding Span node is found among the active Span nodes, a new Span node is created and designated as the Span node to which the system call behavior event belongs.

3. The method according to claim 1, characterized in that, Matching system call behavior events in the attacker behavior knowledge base, including: Obtain a list of rules for system call behavior events that an attacker will definitely execute to achieve their attack objectives; Match the attributes of the system call behavior event in the rule list.

4. The method according to claim 1, characterized in that, If a match is successful, the HTTPS traffic of the HTTPS request is reconstructed based on the plaintext data of the HTTPS request and HTTPS response, including: Retrieve the Span node to which the system call behavior event belongs; Based on the behavior event tree, obtain the root node of the Span corresponding to the Span node to which it belongs; Retrieve the plaintext data of the HTTPS request and HTTPS response corresponding to the root node of the Span; Reconstruct the HTTPS traffic of the HTTPS request based on the plaintext data of the HTTPS request and HTTPS response.

5. A system for restoring HTTPS attack traffic, characterized in that, The system includes: The knowledge base construction module is used to build an attacker behavior knowledge base, which describes the system call behavior events that an attacker will definitely execute to achieve the attack objective. The behavior event tree construction module is used to construct the behavior event tree for each HTTPS request in HTTPS traffic; wherein, the behavior event tree includes: HTTPS request events, system call behavior events and HTTPS response events, and the data of the HTTPS request events and the HTTPS response events are respectively associated with the plaintext data of the HTTPS request and the HTTPS response; The HTTPS traffic restoration module is used to match system call behavior events in the attacker behavior knowledge base, and if the match is successful, restore the HTTPS traffic of the HTTPS request based on the plaintext data of the HTTPS request and HTTPS response. The construction of the behavior event tree for each HTTPS request in the HTTPS traffic includes: Instrumentation of key functions for HTTPS traffic encryption and decryption using EBPF technology; Instrumentation of critical system calls in the operating system kernel is performed using EBPF technology; When the web server receives an HTTPS request, it creates a Span root node and marks the Span root node as active. When the web server reads an HTTPS request, it creates an HTTPS request event based on the relevant hooks generated by EBPF technology and obtains the plaintext data of the HTTPS request. The HTTPS request event, the system call behavior event, and the HTTPS response event are described by metadata and attributes. The metadata includes: time, thread ID, the span node to which it belongs, and the event name. The attributes are the corresponding data obtained from the kernel's critical system calls. The time, thread ID, and event name are obtained according to the relevant hooks generated by EBPF technology. Using the time and thread ID in the HTTPS request event as an index, find the currently active Span root node, associate the HTTPS request event with the found Span root node, and update the Span node to which the HTTPS request event belongs based on the Span root node. When the web server processes HTTPS requests, based on the relevant hooks generated in EBPF technology according to the system call behavior, system call behavior events and Span nodes are created, and the Span node is marked as active; Using the time, thread ID, and attributes in the system call behavior event as indexes, the Span node to which the system call behavior event belongs is found. After associating the system call behavior event with the found Span node, the Span node to which the HTTPS request event belongs is updated based on the Span node. For a Span node that is already associated with a system call behavior event, use the time and thread ID in the system call behavior event as an index to find the Span root node or Span node to generate the parent-child relationship in the behavior event tree. When the web server finishes processing the HTTPS request, an HTTPS response event is created based on the relevant hooks generated in the eBPF technology, and the plaintext data of the HTTPS response is obtained. Using the time and thread ID in the HTTPS response event as an index, find the currently active Span root node, associate the HTTPS response event with the found Span root node, and update the Span node to which the HTTPS response event belongs based on the Span root node. After the HTTPS request is completed, mark the Span root node and all Span nodes under that Span root node as inactive.

6. An electronic device, characterized in that, The electronic device includes: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, it implements the HTTPS attack traffic restoration method as described in any one of claims 1-4.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions, which, when executed by a processor, implement the HTTPS attack traffic restoration method as described in any one of claims 1-4.

8. A computer program product, characterized in that, When the computer program product is run on a computer device, the computer device performs the HTTPS attack traffic restoration method as described in any one of claims 1-4.

Images