Optimization detection method and device based on APP network flow and medium

Abstract

The invention discloses an optimization detection method and device based on APP network traffic, and a medium, belongs to the technical field of APP network detection, and is used for solving the technical problems that analysis and anomaly detection of an App network request are not comprehensive enough, the labor efficiency is low, key risk information is easy to miss, and many limitations exist in the prior art. The method comprises the following steps: performing version trust identification processing under related certificate verification on a user certificate to obtain a new user certificate; the method comprises the following steps: capturing an HTTPS network packet of an APP in Android equipment through a trust state of a new user certificate in a virtual machine; performing parallel aggregation detection under multiple attribute items on the HTTPS network packet to obtain a network packet detection result; performing cooperative detection processing on abnormal related data characteristics in the network packet detection result under a threshold rule to obtain a network potential performance problem result; and determining a problem optimization scheme based on the result of the potential performance problem of the network.

Description

Technical Field

[0001] The present application relates to the field of APP network detection, and in particular to an optimized detection method, device and medium based on APP network traffic. Background Art

[0002] At present, for the analysis of App network requests, developers usually use interface debugging tools commonly used in back-end development, such as Postman. These tools can view the basic information of interface requests and responses, which is convenient for developers to verify the functions and data exchanges of the interfaces. However, there are certain limitations in the way of using these tools for network request analysis. First, the efficiency is low, because developers need to manually check each request and response one by one, which makes it difficult to achieve batch processing and automated detection. Secondly, such tools are usually unable to automatically identify and process abnormal information, such as failure of network requests, timeouts, or long response times, which makes some potential problems easy to be overlooked.

[0003] Another common analysis method is to capture network packets of the App. This method can capture all network requests initiated by the App, including requests of different protocols, such as TCP, UDP, ICMP, etc., and can obtain more detailed network data. However, the captured data usually needs to be checked one by one according to the time sequence to analyze whether there is information to be optimized or abnormal. Since the amount of data generated by packet capture is large and complex, manual analysis is inefficient and there is a risk of missing key information.

[0004] Especially on the Android platform, since Android 7.0, the operating system no longer trusts user certificates by default, which brings additional difficulties to the parsing of network packets for the HTTPS protocol. To meet this challenge, there are currently two main solutions. One is to install the Magisk module to achieve a root-like effect, so that the system can trust user certificates and then perform HTTPS packet capture. However, this solution is complicated to operate and usually requires personnel with certain professional knowledge to implement. Another way is to capture packets by using an emulator with a version lower than Android 7, because versions before Android 7.0 trust user certificates by default, and HTTPS network requests can be captured more easily. However, this method is less applicable because the minimum supported version (minSdkVersion) of most apps is Android 7.0 or higher, so most applications cannot run on these low-version emulators.

[0005] In summary, the existing network request analysis and packet capture methods have certain limitations, and there is an urgent need for an efficient, automated solution that adapts to the requirements of the current operating system version. Summary of the invention

[0006] The embodiments of the present application provide an optimized detection method, device and medium based on APP network traffic, which are used to solve the following technical problems: the existing analysis and anomaly detection of App network requests are not comprehensive enough, and the manual efficiency is low, and key risk information is easily missed, and there are many limitations.

[0007] The present application embodiment adopts the following technical solutions:

[0008] On the one hand, an embodiment of the present application provides an optimization detection method based on APP network traffic, including: according to a virtual private network on an Android device, performing version trust identification processing on a user certificate under certificate verification to obtain a new user certificate; through the trust status of the new user certificate in the virtual machine, capturing the HTTPS network packet of the APP application in the Android device; performing parallel aggregation detection on the HTTPS network packet under multiple attribute items to obtain a network packet detection result; wherein the multiple attribute items include: network request and response duration item, network request frequency item, DNS resolution time item, network request and response packet type size item, and sensitive data item; through a preset network packet anomaly detection model, performing collaborative detection processing on the anomaly-related data features in the network packet detection result and under a threshold rule to obtain a network potential performance problem result; based on the network potential performance problem result, determining a problem optimization plan.

[0009] The embodiment of the present application provides a solution for capturing and parsing HTTPS packets on an Android platform. Since Android 7.0 and above no longer trust user certificates and thus cannot parse HTTPS packets, this solution can implement parsing of HTTPS packets in conjunction with a virtual machine. By analyzing the captured network packets, possible abnormal information of application network requests can be obtained, providing strong support for optimizing network requests and network security.

[0010] In a feasible implementation, based on the virtual private network on the Android device, the user certificate is processed for version trust identification under the certificate verification to obtain a new user certificate, which specifically includes: deploying the virtual private network on the Android device; setting properties for the virtual private network, and determining the virtual private network as a proxy server; generating a self-signed certificate based on the parsing code of the network packet; and obtaining the old version hash value of the self-signed certificate through the OpenSSL tool; converting the self-signed certificate to another format according to the old version hash value, and obtaining the new user certificate.

[0011] In a feasible implementation manner, the HTTPS network packet of the APP application in the Android device is captured through the trust status of the new user certificate in the virtual machine, specifically including: calibrating the new user certificate in the trust status through a virtual machine with root authority; and importing and / or migrating the new user certificate in the trust status into the system certificate directory of the virtual machine; and capturing the network traffic packet of the APP application in the Android device through the new user certificate in the virtual machine associated with the Android device to obtain the HTTPS network packet.

[0012] In a feasible implementation, parallel aggregation detection is performed on the HTTPS network packet under multiple attribute items to obtain a network packet detection result, which specifically includes: according to a preset request response time threshold, performing an abnormality judgment on the network request and response time items in the HTTPS network packet regarding the time threshold, and obtaining abnormal network request and response time information; and marking the abnormal network request and response time information to generate request response time abnormality marking information; according to a preset frequency threshold, performing an abnormality judgment on the network request frequency in the HTTPS network packet regarding the frequency threshold, and obtaining abnormal network request frequency information; and performing fragmented request merging processing on the HTTPS network packet corresponding to the abnormal network request frequency information; and performing an abnormality judgment on the DNS resolution time in the HTTPS network packet regarding the DNS time threshold according to a preset DNS time threshold. The abnormality judgment of the value is performed to obtain the DNS resolution time abnormality information; according to the preset network packet type and size threshold, the network request and response packet type size in the HTTPS network packet is judged as a sub-item abnormality to obtain the network request and response packet type size abnormality information; wherein, the sub-items include: request header, request body, response header and response body; according to the preset regular expression of sensitive data keywords, the sensitive data in the HTTPS network packet is detected and processed to obtain sensitive data abnormality information; and the sensitive data abnormality information is desensitized and annotated to obtain sensitive annotation information; wherein, the network packet detection result includes: the network request and response duration abnormality information, the network request frequency abnormality information, the DNS resolution time abnormality information, the network request and response packet type size abnormality information and the sensitive data abnormality information.

[0013] In a feasible implementation, before the abnormality-related data features in the network packet detection results are collaboratively detected and processed under threshold rules through a preset network packet anomaly detection model to obtain the results of potential network performance problems, it specifically includes: identifying and collecting the detection anomaly information in the network packet detection results; extracting the abnormality-related data features in the detection anomaly information; wherein the abnormality-related data features include: network delay features, frequency features, data packet features and content features; the network delay features are the request and response duration features of the HTTPS network packets; the frequency features are the number of requests per unit time of the HTTPS network packets; the data packet features include: the size of the request header, request body, response header and response body; the content features include: DNS resolution time features and sensitive information detection features; and the abnormality feature set corresponding to the abnormality-related data features is determined as the input end of the network packet anomaly detection model.

[0014] In a feasible implementation, a preset network packet anomaly detection model is used to perform collaborative detection processing on the anomaly-related data features in the network packet detection results and under threshold rules to obtain a network potential performance problem result, specifically including: performing model training and labeling on the anomaly feature set and the normal feature set through an unsupervised learning network to establish the network packet anomaly detection model; performing real-time anomaly detection on the current network packet detection results through the network packet anomaly detection model, and outputting the anomaly type and corresponding anomaly score in each current network packet detection result; based on the same anomaly type, the anomaly information in the current network packet detection result detected by the threshold rule and the anomaly score under the network packet anomaly detection model are used to perform a comprehensive evaluation of the network potential performance to obtain the network potential performance problem result;

[0015] The network potential performance problem results include: high-risk network potential performance problems, medium-risk network potential performance problems, and low-risk network potential performance problems.

[0016] In a feasible implementation, the abnormal information detected by the threshold rule in the current network packet detection result and the abnormal score under the network packet anomaly detection model are used to perform a comprehensive evaluation of the network potential performance to obtain the network potential performance problem result, specifically including: if the abnormality-related data feature value of the abnormal information in the network packet detection result is greater than a first preset threshold, the abnormality-related data feature in the abnormal information is input into the network packet anomaly detection model, and the abnormality score corresponding to the abnormality-related data feature value is output; the abnormality score and the abnormal information are comprehensively decentralized to determine the network potential performance problem result.

[0017] In a feasible implementation, based on the network potential performance problem results, a problem optimization plan is determined, specifically including: labeling the abnormal network data items in the network potential performance problem results to determine the abnormal label information; performing interpretable analysis on the abnormal label information to obtain the maximum eigenvalue of the abnormal impact; wherein the maximum eigenvalue of the abnormal impact is the maximum abnormal data parameter that needs to be optimized in each of the abnormal label information; based on the maximum eigenvalue of the abnormal impact, the problem optimization plan for APP network traffic optimization is located and screened.

[0018] In the second aspect, an embodiment of the present application also provides an optimization detection device based on APP network traffic, the device comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, so that the at least one processor can execute an optimization detection method based on APP network traffic described in any of the above embodiments.

[0019] In the third aspect, an embodiment of the present application also provides a non-volatile computer storage medium, characterized in that the storage medium is a non-volatile computer-readable storage medium, and the non-volatile computer-readable storage medium stores at least one program, each of which includes instructions, and when the instructions are executed by the terminal, the terminal executes an optimized detection method based on APP network traffic described in any of the above embodiments.

[0020] The present application provides an optimization detection method, device and medium based on APP network traffic. Compared with the prior art, the embodiments of the present application have the following beneficial technical effects:

[0021] 1. Enhanced security: Through the virtual private network (VPN) and user certificate verification, the identification and verification of user identities are improved, and the security of the system is enhanced.

[0022] 2. Version trust identification: Version trust identification processing for new user certificates helps to identify and distinguish different versions of apps, thereby providing more refined detection and optimization for different versions of apps.

[0023] 3. Network traffic monitoring: It can capture the HTTPS network packets of APP applications in Android devices and monitor the network traffic, which helps to discover potential network problems.

[0024] 4. Multi-attribute parallel detection: Through parallel aggregation detection under multiple attributes, the performance of network packets can be comprehensively evaluated, including network request and response duration, request frequency, DNS resolution time, packet type and size, and sensitive data.

[0025] 5. Anomaly detection model: The preset network packet anomaly detection model can identify anomaly-related data features in the network packet detection results, thereby improving the accuracy and efficiency of detection.

[0026] 6. Collaborative detection and processing: Collaborative detection and processing under threshold rules can more accurately identify potential network performance issues and reduce false positives and missed negatives.

[0027] 7. Determination of optimization plan: Based on the results of potential network performance issues, a specific optimization plan can be determined to help developers or administrators solve problems in a targeted manner and improve the network performance of the APP.

[0028] 8. Improve user experience: By optimizing network performance, network latency can be reduced, data transmission efficiency can be improved, and user experience can be improved.

[0029] 9. Reduce operating costs: By promptly discovering and solving problems, the increase in operating costs caused by network problems can be reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0031] Figure 1 A flow chart of an optimized detection method based on APP network traffic provided in an embodiment of the present application;

[0032] Figure 2 A schematic diagram of the structure of an optimization detection device based on APP network traffic provided in an embodiment of the present application. DETAILED DESCRIPTION

[0033] In order to enable those skilled in the art to better understand the technical solutions in this application, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are only part of the embodiments of this application, not all of them. Based on the embodiments of this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this application.

[0034] It should be noted that with the rapid development of mobile Internet, the development technology of mobile applications (Apps) has become increasingly mature, especially in the development of applications on platforms such as Android, iOS, and Hongmeng. Today, a large number of mobile apps have emerged on the market, covering various fields such as life, work, and entertainment. In the development process of mobile apps, although the functions have been implemented, the development work does not end there. An important link is the request and optimization of the network interface.

[0035] Almost all modern apps involve network requests to communicate with remote servers. These requests may include the exchange of information such as user data, application settings, content updates, etc. However, as the frequency of app usage increases, how to effectively manage and optimize network requests has become an urgent problem to be solved. The frequency, content type, and data size of network requests may affect the performance, response speed, and user experience of the app. For example, high-frequency network requests may cause excessive server load, excessive data transmission may slow down the response speed, and different types of data may require different transmission methods.

[0036] In addition to performance optimization, the security of network requests is also an issue that cannot be ignored. The data in the App may include sensitive user information, such as personal privacy, payment information, etc. If the network communication process is not secure enough, it may cause data leakage or be attacked by a man-in-the-middle. Therefore, how to ensure the security of data during transmission is an important factor that App developers must consider.

[0037] In addition, exception handling related to network requests is also a key part of App development. Common exceptions include request failure, network timeout, long server response time, etc., which may lead to a decline in user experience. How to effectively detect, monitor and optimize these exceptions to ensure that the App can maintain stable and efficient operation in various network environments is a necessary means to improve App quality.

[0038] In summary, optimizing network request performance, security, and exception management in mobile apps is a key factor in improving app user experience, ensuring data security, and improving the overall quality of applications.

[0039] The present application embodiment provides an optimization detection method based on APP network traffic, such as Figure 1 As shown, the optimization detection method based on APP network traffic specifically includes steps S101-S105:

[0040] S101. According to the virtual private network on the Android device, a version trust identification process is performed on the user certificate under the certificate verification to obtain a new user certificate.

[0041] Specifically, firstly, the virtual private network needs to be deployed on the Android device, the properties of the virtual private network are set, and the virtual private network is determined as a proxy server.

[0042] Furthermore, a self-signed certificate is generated based on the parsing code of the network packet, and the old version hash value of the self-signed certificate is obtained through the OpenSSL tool.

[0043] Furthermore, according to the hash value of the old version, the self-signed certificate is converted to a different format and a new user certificate is obtained.

[0044] In one embodiment, by starting a VPN (virtual private network) service as a proxy server on an Android device, all network requests and responses are forwarded and received through the proxy server. This approach can fully capture HTTPS requests and responses.

[0045] In one embodiment, in the certificate verification solution, since Android 7.0 and above do not trust user certificates by default and cannot directly parse HTTPS network packets, it is necessary to solve the certificate verification problem. We generate a self-signed certificate (such as certificate.pem) through code, and then use the OpenSSL tool to obtain the old version hash value of the certificate. The command is as follows: openssl x509-subject_hash_old-in.\certificate.pem. Assuming that the hash value obtained is b1c3f6a1, save this certificate as b1c3f6a1.0 file, which is the new user certificate. The use of the old version hash value ensures that the Android device can recognize and trust the new user certificate.

[0046] S102: Capture the HTTPS network packet of the APP application in the Android device through the trust status of the new user certificate in the virtual machine.

[0047] Specifically, the new user certificate is calibrated in a trusted state through a virtual machine with root authority, and the new user certificate in a trusted state is imported and / or migrated to the system certificate directory of the virtual machine.

[0048] Furthermore, the network traffic packets of the APP application in the Android device are captured and processed through the new user certificate in the virtual machine associated with the Android device to obtain the HTTPS network packets.

[0049] In one embodiment, during the certificate installation process, since Android 7.0 and above cannot trust self-signed certificates in a common way, we process it through a virtual machine (usually with root privileges). Import the generated b1c3f6a1.0 certificate file (new user certificate) into the virtual machine and migrate it to the system certificate directory system / etc / security / cacerts of the virtual machine. In this way, the application in the virtual machine can trust the certificate and successfully capture its HTTPS network packet.

[0050] As a feasible implementation method, in order to simplify the operation of certificate export and migration, we can send the .0 certificate file through the server and automatically migrate the certificate to the certificate directory of the target device. This not only simplifies the operation, but also facilitates the subsequent certificate update and expiration processing.

[0051] S103, performing parallel aggregation detection on the HTTPS network packet under multiple attribute items to obtain the network packet detection result, wherein the multiple attribute items include: network request and response duration item, network request frequency item, DNS resolution time item, network request and response packet type and size item, and sensitive data item.

[0052] Specifically, 1) according to the preset request response time threshold, the network request and response time items in the HTTPS network packet are judged as abnormal in relation to the time threshold, and the network request and response time abnormal information is obtained. The network request and response time abnormal information is annotated and processed to generate request response time abnormal annotation information.

[0053] As a feasible implementation method, network request and response duration detection: First complete the duration threshold setting: set the duration threshold for each request and response, and the requests and responses that exceed the threshold will be marked. Then optimize the basis: through the marking results, it is possible to clearly identify which requests have too long response time, which may be caused by insufficient server processing power or network transmission bottlenecks. To optimize performance, you can consider increasing cache, compressing data, or optimizing server-side processing.

[0054] 2) According to the preset frequency threshold, the network request frequency in the HTTPS network packet is judged to be abnormal in relation to the frequency threshold, and network request frequency abnormality information is obtained. The HTTPS network packet corresponding to the network request frequency abnormality information is subjected to fragmentation request merging processing.

[0055] As a feasible implementation method, network request frequency detection: first set the frequency threshold: set the frequency threshold of network requests, and the requests exceeding the threshold will be marked. Then optimize the basis: according to business needs, for requests that are too frequent, you can consider merging fragmented requests or caching the results of the first request, so as to reduce the number of repeated requests and improve efficiency.

[0056] 3) According to the preset DNS time threshold, the DNS resolution time in the HTTPS network packet is judged as abnormal in relation to the DNS time threshold, and the DNS resolution time abnormality information is obtained.

[0057] As a feasible implementation method, DNS resolution time detection: First, set the DNS time threshold: set the DNS resolution time threshold, and mark the requests that exceed the threshold. Then optimize the basis: when the DNS resolution time is too long, you can reduce the resolution time and improve the efficiency of network requests through DNS pre-resolution or cache optimization.

[0058] 4) According to the preset network packet type and size threshold, the network request and response packet type size in the HTTPS network packet is judged as abnormal by sub-item, and the abnormal information of the network request and response packet type size is obtained. Among them, the sub-items include: request header, request body, response header and response body.

[0059] As a feasible implementation method, the network request and response packet type and size detection: first set the packet type and size thresholds: set size thresholds for the request header, request body, response header, and response body. For example, the size of the request header in the sub-item can be set to 10KB, and it will be marked when it exceeds the threshold. For image request bodies, it can be set to 1MB. If it exceeds, it will prompt for compression or data compression (such as GZIP). Then optimize the basis: if the request header is detected to be too large (such as too many cookies or long fields), the request may fail. If the response body is too large, the amount of data transmission can be reduced by compression and other means.

[0060] 5) According to the regular expression of the preset sensitive data keyword, the sensitive data in the HTTPS network packet is detected and processed to obtain abnormal sensitive data information. The abnormal sensitive data information is desensitized and annotated to obtain sensitive annotated information.

[0061] As a feasible implementation method, sensitive data detection: First, define the sensitive data keywords: define sensitive data keywords (such as phone number, IMEI, ID number, etc.), and write regular expressions for matching. Then mark sensitive data: once a network packet containing sensitive information (such as phone number, identity information, etc.) is detected, the system will mark it and remind the developer that the data needs to be encrypted or desensitized to ensure the security of data transmission.

[0062] Among them, the network packet detection results include: abnormal information on network request and response duration, abnormal information on network request frequency, abnormal information on DNS resolution time, abnormal information on network request and response packet type and size, and abnormal information on sensitive data.

[0063] S104: Using a preset network packet anomaly detection model, perform collaborative detection processing on anomaly-related data features in the network packet detection results under threshold rules to obtain results of potential network performance issues.

[0064] Specifically, the detection anomaly information in the network packet detection results is identified and collected. The anomaly-related data features in the detection anomaly information are extracted. Among them, the anomaly-related data features include: network delay features, frequency features, data packet features, and content features. That is, all network request and response data are collected during the packet capture process, including timestamp, request path, request method, request body size, response body size, response time, DNS resolution time, request frequency, etc. Then, the anomaly-related data features are extracted from the collected data.

[0065] As a feasible implementation method, the network delay feature is the request and response duration feature of the HTTPS network packet. The frequency feature is the number of requests per unit time of the HTTPS network packet. The data packet features include: the size of the request header, request body, response header, and response body. The content features include: DNS resolution time features and sensitive information detection features.

[0066] Furthermore, an abnormal feature set corresponding to the abnormality-related data features is determined as an input end of the network packet anomaly detection model.

[0067] Furthermore, through the unsupervised learning network, model training and labeling are performed on the abnormal feature set and the normal feature set to establish a network packet anomaly detection model.

[0068] As a feasible implementation method, model training and deployment are also required: Model selection: Common anomaly detection algorithms are used, such as supervised learning (SVM, random forest, etc.) or unsupervised learning (Isolation Forest, DBSCAN, Autoencoder, etc.). Label annotation: By analyzing the historical anomaly feature set, normal and abnormal samples are labeled to build a training data set. For unsupervised learning, unlabeled data is used for training. Model training: The model is trained using feature data, and the model can learn the behavior patterns of normal network requests and identify abnormal patterns. Model deployment: The trained network packet anomaly detection model is embedded in the packet capture system to analyze the captured network request data in real time. The network packet anomaly detection model can automatically identify potential performance problems in network requests (such as latency bottlenecks, frequency anomalies, etc.) and provide suggestions for possible optimization points. In sensitive data detection, the network packet anomaly detection model can discover sensitive information transmission behaviors of undefined keywords and improve data security. Through the adaptive ability of machine learning, the network packet anomaly detection model can reduce the false alarm rate and missed alarm rate based on static threshold detection, especially in complex network environments.

[0069] Furthermore, the network packet anomaly detection model is used to perform real-time anomaly detection on the current network packet detection results, and the anomaly type and corresponding anomaly score in each current network packet detection result are output.

[0070] As a feasible implementation, real-time anomaly detection: Model inference: After the captured network packets are aggregated, the features are input into the model for inference, and the anomaly score and anomaly type of each request are output. Dynamic update: The model is updated regularly by continuously collecting new data to ensure that the model adapts to the new version of the network request pattern and potential anomaly types.

[0071] Furthermore, based on the same anomaly type, the anomaly information detected by the threshold rule in the current network packet detection result and the anomaly score under the network packet anomaly detection model are used to comprehensively evaluate the network potential performance, and the network potential performance problem results are obtained. Among them, the network potential performance problem results include: high-risk network potential performance problems, medium-risk network potential performance problems, and low-risk network potential performance problems.

[0072] In one embodiment, if the abnormality-related data feature value of the abnormal information in the network packet detection result is greater than the first preset threshold value, the abnormality-related data feature in the abnormal information is input into the network packet abnormality detection model, and the abnormality score corresponding to the abnormality-related data feature value is output. The abnormality score and the abnormal information are then subjected to comprehensive and decentralized processing to determine the results of potential network performance problems. For example, for the request and response time, assuming that the threshold is set to 1000 milliseconds, since a single network request is affected by multiple factors such as network fluctuations, a certain request may be 1200 milliseconds, but this network interface is actually normal, but it is only occasionally slow. According to the threshold detection, it will be identified as abnormal, but it can be re-evaluated in combination with the machine learning model, but the weight of the threshold detection of some detection items will be greater, that is, the abnormality score after model evaluation and the abnormal information after threshold detection can be subjected to comprehensive and decentralized processing to comprehensively judge the results of potential network performance problems (such as delay bottlenecks, frequency anomalies, etc.).

[0073] S105. Determine a problem optimization solution based on the results of potential network performance problems.

[0074] Specifically, abnormal network data items in the network potential performance problem results are labeled to determine abnormal label information.

[0075] Furthermore, interpretability analysis is performed on the abnormal label information to obtain the maximum abnormal impact eigenvalue, wherein the maximum abnormal impact eigenvalue is the maximum abnormal data parameter that needs to be optimized in each abnormal label information.

[0076] Furthermore, based on the maximum eigenvalue of the abnormal impact, the problem optimization solution for APP network traffic optimization is located and screened out.

[0077] In one embodiment, the interpretability analysis of abnormal label information is combined with the feature value that has the greatest impact on abnormal request annotation to help developers quickly locate problems. When managers click on the icon in the results of potential network performance problems, they can be prompted with solutions, such as suggesting to perform a stress test on the network request to check whether it is a server problem or use cache, etc.

[0078] In addition, the embodiment of the present application also provides an optimization detection device based on APP network traffic, such as Figure 2 As shown, the optimization detection device 200 based on APP network traffic specifically includes:

[0079] At least one processor 201. And a memory 202 in communication with the at least one processor 201. The memory 202 stores instructions that can be executed by the at least one processor 201, so that the at least one processor 201 can execute:

[0080] According to the virtual private network on the Android device, the user certificate is processed for version trust identification under the certificate verification to obtain a new user certificate;

[0081] Capture the HTTPS network packets of the APP application in the Android device through the trust status of the new user certificate in the virtual machine;

[0082] Perform parallel aggregation detection on HTTPS network packets under multiple attribute items to obtain network packet detection results; wherein the multiple attribute items include: network request and response duration item, network request frequency item, DNS resolution time item, network request and response packet type and size item, and sensitive data item;

[0083] Through the preset network packet anomaly detection model, the anomaly-related data features in the network packet detection results are processed in a collaborative manner under the threshold rules to obtain the results of potential network performance problems;

[0084] Based on the results of potential network performance issues, determine the problem optimization solution.

[0085] This application provides a solution for capturing and parsing HTTPS packets on the Android platform. Since Android 7.0 and above no longer trust user certificates and cannot parse HTTPS packets, this solution can be used with a virtual machine to parse HTTPS packets. By analyzing the captured network packets, you can obtain possible abnormal information about the application network request, providing strong support for optimizing network requests and network security.

[0086] Each embodiment in this application is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device and non-volatile computer storage medium embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.

[0087] The devices and media provided in the embodiments of the present application correspond one-to-one to the methods. Therefore, the devices and media also have similar beneficial technical effects as the corresponding methods. Since the beneficial technical effects of the methods have been described in detail above, the beneficial technical effects of the devices and media will not be repeated here.

[0088] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0089] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0090] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0091] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0092] The above describes specific embodiments of the present application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0093] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the embodiments of the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the embodiments of the present application should be included in the scope of the specification of the present application.

Claims

1. An optimization detection method based on APP network traffic, characterized in that: The method comprises: According to the virtual private network on the Android device, the user certificate is processed for version trust identification under the certificate verification to obtain a new user certificate; Capture the HTTPS network packet of the APP application in the Android device through the trust status of the new user certificate in the virtual machine; Performing parallel aggregation detection on the HTTPS network packet under multiple attribute items to obtain a network packet detection result; wherein the multiple attribute items include: network request and response duration item, network request frequency item, DNS resolution time item, network request and response packet type and size item, and sensitive data item; Through the preset network packet anomaly detection model, the anomaly-related data features in the network packet detection results are processed in a collaborative manner under the threshold rules to obtain the results of potential network performance problems; Based on the potential performance problem results of the network, an optimization solution for the problem is determined.

2. According to the optimization detection method based on APP network traffic according to claim 1, it is characterized in that: According to the virtual private network on the Android device, the user certificate is processed for version trust identification under the certificate verification to obtain a new user certificate, specifically including: Deploy the virtual private network on the Android device; Setting properties of the virtual private network and determining the virtual private network as a proxy server; Generate a self-signed certificate based on the parsing code of the network packet; and obtain the old version hash value of the self-signed certificate through the OpenSSL tool; According to the old version hash value, the self-signed certificate is converted into a save-as-format and the new user certificate is obtained.

3. According to the optimization detection method based on APP network traffic according to claim 1, it is characterized in that: By using the trust status of the new user certificate in the virtual machine, the HTTPS network packet of the APP application in the Android device is captured, specifically including: Through a virtual machine with root privileges, the new user certificate is calibrated in a trusted state; and the new user certificate in the trusted state is imported and / or migrated to a system certificate directory of the virtual machine; The network traffic packet of the APP application in the Android device is captured and processed by using the new user certificate in the virtual machine associated with the Android device to obtain the HTTPS network packet.

4. According to claim 1, an optimization detection method based on APP network traffic is characterized in that: Perform parallel aggregation detection on the HTTPS network packet under multiple attributes to obtain network packet detection results, including: According to the preset request response time threshold, the network request and response time items in the HTTPS network packet are judged as abnormal in relation to the time threshold, and abnormal network request and response time information is obtained; and the abnormal network request and response time information is marked and processed to generate abnormal request response time marking information; According to a preset frequency threshold, the network request frequency in the HTTPS network packet is judged to be abnormal in relation to the frequency threshold, and network request frequency abnormality information is obtained; and the HTTPS network packet corresponding to the network request frequency abnormality information is processed by fragmentation request merging; According to a preset DNS time threshold, an abnormality judgment is performed on the DNS resolution time in the HTTPS network packet regarding the DNS time threshold, and DNS resolution time abnormality information is obtained; According to the preset network packet type and size threshold, the network request and response packet type size in the HTTPS network packet are judged as abnormal sub-items to obtain abnormal network request and response packet type size information; wherein the sub-items include: request header, request body, response header and response body; According to the regular expression of the preset sensitive data keyword, the sensitive data in the HTTPS network packet is subjected to sensitive information detection processing to obtain sensitive data abnormal information; and the sensitive data abnormal information is subjected to desensitization and annotation processing to obtain sensitive annotation information; Among them, the network packet detection results include: the abnormal information of the network request and response duration, the abnormal information of the network request frequency, the abnormal information of the DNS resolution time, the abnormal information of the network request and response packet type and size, and the abnormal information of the sensitive data.

5. According to claim 1, the optimization detection method based on APP network traffic is characterized in that: Before obtaining the result of potential network performance problems by using a preset network packet anomaly detection model to perform collaborative detection processing on the anomaly-related data features in the network packet detection result and under the threshold rule, the following steps are specifically included: Identifying and collecting detection anomaly information in the network packet detection result; Extracting the anomaly-related data features in the detected anomaly information; wherein the anomaly-related data features include: network delay features, frequency features, data packet features, and content features; The network delay feature is the request and response duration feature of the HTTPS network packet; the frequency feature is the number of requests per unit time of the HTTPS network packet; the data packet feature includes: the size of the request header, request body, response header, and response body; the content feature includes: DNS resolution time feature and sensitive information detection feature; An abnormal feature set corresponding to the abnormality-related data features is determined as an input end of the network packet anomaly detection model.

6. According to claim 5, an optimization detection method based on APP network traffic is characterized in that: Through the preset network packet anomaly detection model, the anomaly-related data features in the network packet detection results are processed in a collaborative manner under the threshold rules to obtain the results of potential network performance problems, specifically including: Through an unsupervised learning network, model training and labeling are performed on the abnormal feature set and the normal feature set to establish the network packet anomaly detection model; Through the network packet anomaly detection model, real-time anomaly detection is performed on the current network packet detection results, and the anomaly type and corresponding anomaly score in each of the current network packet detection results are output; Based on the same anomaly type, the anomaly information detected by the threshold rule in the current network packet detection result and the anomaly score under the network packet anomaly detection model are used to perform a comprehensive evaluation of the network potential performance to obtain the network potential performance problem result; The network potential performance problem results include: high-risk network potential performance problems, medium-risk network potential performance problems, and low-risk network potential performance problems.

7. According to claim 6, an optimization detection method based on APP network traffic is characterized in that: Comprehensively evaluating the potential performance of the network by using the abnormal information detected by the threshold rule in the current network packet detection result and the abnormal score under the network packet abnormality detection model to obtain the potential performance problem result of the network, specifically including: If the anomaly-related data feature value of the anomaly information in the network packet detection result is greater than a first preset threshold, the anomaly-related data feature in the anomaly information is input into the network packet anomaly detection model, and an anomaly score corresponding to the anomaly-related data feature value is output; The abnormal score and the abnormal information are comprehensively and decentralizedly processed to determine the result of the potential performance problem of the network.

8. According to claim 1, the optimization detection method based on APP network traffic is characterized in that: Based on the potential network performance problem results, determine the problem optimization solution, including: Labeling abnormal network data items in the network potential performance problem results to determine abnormal label information; Perform interpretability analysis on the abnormal label information to obtain the maximum abnormal impact eigenvalue; wherein the maximum abnormal impact eigenvalue is the maximum abnormal data parameter that needs to be optimized in each abnormal label information; Based on the maximum characteristic value of the abnormal impact, the problem optimization solution for APP network traffic optimization is located and screened out.

9. An optimization detection device based on APP network traffic, characterized in that: The device comprises: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, so that the at least one processor can execute an optimized detection method based on APP network traffic according to any one of claims 1-8.

10. A non-volatile computer storage medium, characterized in that: The storage medium is a non-volatile computer-readable storage medium, and the non-volatile computer-readable storage medium stores at least one program, each of which includes instructions, and when the instructions are executed by the terminal, the terminal executes an optimization detection method based on APP network traffic according to any one of claims 1-8.

Images