An APP network traffic-based optimization detection method, device and medium

Abstract

The application discloses an APP network flow-based optimization detection method and device and a medium, belongs to the APP network detection technical field, and is used for solving the technical problems that the existing analysis and abnormal detection of App network requests are not comprehensive enough, the artificial efficiency is low, key risk information is easy to be missed, and many limitations exist. The method comprises the following steps: performing version trust identification processing on a user certificate under certificate verification to obtain a new user certificate; capturing HTTPS network packets of an APP application in an Android device through a trust state of the new user certificate in a virtual machine; performing parallel aggregation detection on the HTTPS network packets under multiple attribute items to obtain network packet detection results; performing cooperative detection processing on abnormal related data features in the network packet detection results and threshold rules to obtain network potential performance problem results; and determining an optimization scheme for a problem based on the network potential performance problem results.

Description

Technical Field

[0001] This application relates to the field of APP network detection, and in particular to an optimized detection method, device and medium based on APP network traffic. Background Technology

[0002] Currently, for analyzing app network requests, developers typically use API debugging tools commonly used in backend development, such as Postman. These tools can view basic information about API requests and responses, making it convenient for developers to verify API functionality and data exchange. However, using these tools for network request analysis has certain limitations. First, it is inefficient because developers need to manually check each request and response individually, making batch processing and automated detection difficult. Second, these tools usually cannot automatically identify and handle abnormal information, such as network request failures, timeouts, or excessively long response times, causing some potential problems to be easily overlooked.

[0003] Another common analysis method is to capture network packets from the app. This method can capture all network requests initiated by the app, including requests using different protocols such as TCP, UDP, and ICMP, and can obtain more detailed network data. However, the captured data usually needs to be examined one by one in sequence to analyze whether there is any information that needs optimization or is abnormal. Due to the large amount and complexity of the data generated by packet capture, manual analysis is inefficient and carries the risk of missing key information.

[0004] Especially on the Android platform, since Android 7.0, the operating system no longer trusts user certificates by default, which brings additional difficulties to parsing network packets for HTTPS protocols. To address this challenge, there are currently two main solutions. One is to install the Magisk module to achieve a root-like effect, allowing the system to trust user certificates and thus capture HTTPS packets. However, this solution is complex and usually requires personnel with certain professional knowledge to implement. The other approach is to use an emulator running an Android version lower than 7, because versions of Android prior to 7.0 trust user certificates by default, making it relatively easy to capture HTTPS network requests. However, this method has limited applicability because most apps now support a minimum version (minSdkVersion) of Android 7.0 or higher, so most applications cannot run on these lower-version emulators.

[0005] In summary, existing network request analysis and packet capture methods have certain limitations, and there is an urgent need for an efficient, automated solution that is compatible with the requirements of current operating system versions. Summary of the Invention

[0006] This application provides an optimized detection method, device, and medium based on APP network traffic to solve the following technical problems: existing analysis and anomaly detection of APP network requests are not comprehensive enough, and manual methods are inefficient and prone to missing key risk information, thus having many limitations.

[0007] The embodiments of this application adopt the following technical solutions:

[0008] On one hand, this application provides an optimization detection method based on APP network traffic, including: performing version trust identification processing on user certificates under certificate verification based on the virtual private network on the Android device to obtain a new user certificate; capturing HTTPS network packets of the APP application on the Android device through the trust status of the new user certificate in the virtual machine; performing parallel aggregation detection on the HTTPS network packets under multiple attributes to obtain network packet detection results; wherein, the multiple attributes include: network request and response duration, network request frequency, DNS resolution time, network request and response packet type and size, and sensitive data; performing collaborative detection processing on the abnormal related data features in the network packet detection results and threshold rules through a preset network packet anomaly detection model to obtain potential network performance problem results; and determining an optimization scheme based on the potential network performance problem results.

[0009] This application provides a solution for capturing and parsing HTTPS packets on the Android platform. Since Android 7.0 and later versions no longer trust user certificates, making it impossible to parse HTTPS packets, this solution, in conjunction with a virtual machine, can achieve the parsing of HTTPS packets. Furthermore, by analyzing the captured network packets, potential anomalies in application network requests can be obtained, providing strong support for optimizing network requests and network security.

[0010] In one feasible implementation, based on the virtual private network on the Android device, the user certificate undergoes version trust identification processing under certificate verification to obtain a new user certificate. Specifically, this includes: deploying the virtual private network to the Android device; setting attributes for the virtual private network and identifying it as a proxy server; generating a self-signed certificate based on the parsing code of network packets; obtaining the old version hash value of the self-signed certificate using the OpenSSL tool; and converting the self-signed certificate to a different format based on the old version hash value to obtain the new user certificate.

[0011] In one feasible implementation, the HTTPS network packets of the APP application in the Android device are captured by using the trust status of the new user certificate in the virtual machine. Specifically, this includes: marking the new user certificate in a trust status using a virtual machine with root privileges; importing and / or migrating the new user certificate in the trust status to the system certificate directory of the virtual machine; and capturing the network traffic packets of the APP application in the Android device using the new user certificate in the virtual machine associated with the Android device to obtain the HTTPS network packets.

[0012] In one feasible implementation, parallel aggregation detection of multiple attributes is performed on the HTTPS network packets to obtain network packet detection results. Specifically, this includes: performing anomaly judgment on the network request and response duration items in the HTTPS network packets based on a preset request-response duration threshold to obtain network request and response duration anomaly information; and labeling the network request and response duration anomaly information to generate request-response duration anomaly labeling information; performing anomaly judgment on the network request frequency in the HTTPS network packets based on a preset frequency threshold to obtain network request frequency anomaly information; and performing fragmented request merging processing on the HTTPS network packets corresponding to the network request frequency anomaly information; and performing DNS time thresholding on the DNS resolution time in the HTTPS network packets based on a preset DNS time threshold. The system performs anomaly detection on values ​​to obtain DNS resolution time anomaly information; based on preset network packet type and size thresholds, it performs anomaly detection on sub-items of network request and response packet type and size in the HTTPS network packet to obtain network request and response packet type and size anomaly information; wherein, the sub-items include: request header, request body, response header, and response body; based on preset sensitive data keyword regular expressions, it performs sensitive information detection processing on sensitive data in the HTTPS network packet to obtain sensitive data anomaly information; and the sensitive data anomaly information is then anonymized and labeled to obtain sensitive label information; wherein, the network packet detection results include: network request and response duration anomaly information, network request frequency anomaly information, DNS resolution time anomaly information, network request and response packet type and size anomaly information, and sensitive data anomaly information.

[0013] In one feasible implementation, before performing collaborative detection processing on the anomaly-related data features in the network packet detection results using a preset network packet anomaly detection model and threshold rules to obtain the results of potential network performance problems, the specific steps include: identifying and collecting detection anomaly information in the network packet detection results; extracting the anomaly-related data features from the detection anomaly information; wherein, the anomaly-related data features include: network latency features, frequency features, data packet features, and content features; the network latency features are the request and response duration features of HTTPS network packets; the frequency features are the number of requests per unit time of HTTPS network packets; the data packet features include: the size of the request header, request body, response header, and response body; the content features include: DNS resolution time features and sensitive information detection features; and determining the set of anomaly features corresponding to the anomaly-related data features as the input of the network packet anomaly detection model.

[0014] In one feasible implementation, a pre-defined network packet anomaly detection model is used to perform collaborative detection processing on anomaly-related data features in the network packet detection results under threshold rules to obtain the network potential performance problem results. Specifically, this includes: training and labeling the anomaly feature set and normal feature set using an unsupervised learning network to establish the network packet anomaly detection model; performing real-time anomaly detection on the current network packet detection results using the network packet anomaly detection model, outputting the anomaly type and corresponding anomaly score for each current network packet detection result; and, based on the same anomaly type, comprehensively evaluating the network potential performance by combining the anomaly information detected by threshold rules in the current network packet detection results with the anomaly score from the network packet anomaly detection model to obtain the network potential performance problem results.

[0015] The network potential performance issues include: high-risk network potential performance issues, medium-risk network potential performance issues, and low-risk network potential performance issues.

[0016] In one feasible implementation, the network potential performance is comprehensively evaluated by combining the abnormal information detected by threshold rules in the current network packet detection result with the abnormal score under the network packet anomaly detection model to obtain the network potential performance problem result. Specifically, this includes: if the abnormal related data feature value of the abnormal information in the network packet detection result is greater than a first preset threshold, then the abnormal related data feature in the abnormal information is input into the network packet anomaly detection model, and the abnormal score corresponding to the abnormal related data feature value is output; the abnormal score and the abnormal information are comprehensively weighted to determine the network potential performance problem result.

[0017] In one feasible implementation, based on the results of the potential network performance problems, an optimization scheme is determined, specifically including: labeling the abnormal network data items in the results of the potential network performance problems to determine abnormal label information; performing interpretability analysis on the abnormal label information to obtain the maximum feature value of the abnormal impact; wherein, the maximum feature value of the abnormal impact is the largest abnormal data parameter that needs to be optimized in each of the abnormal label information; and based on the maximum feature value of the abnormal impact, locating and selecting the optimization scheme for APP network traffic optimization.

[0018] Secondly, embodiments of this application also provide an optimization detection device based on APP network traffic, the device comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, so that the at least one processor can execute an optimization detection method based on APP network traffic as described in any of the above embodiments.

[0019] Thirdly, embodiments of this application also provide a non-volatile computer storage medium, characterized in that the storage medium is a non-volatile computer-readable storage medium, the non-volatile computer-readable storage medium stores at least one program, each program includes instructions, and when the instructions are executed by a terminal, the terminal executes an optimized detection method based on APP network traffic as described in any of the above embodiments.

[0020] This application provides an optimized detection method, device, and medium based on APP network traffic. Compared with the prior art, the embodiments of this application have the following beneficial technical effects:

[0021] 1. Enhanced Security: By using Virtual Private Networks (VPNs) and verifying user certificates, the system improves the identification and verification of user identities, thereby enhancing system security.

[0022] 2. Version Trust Identification: Performing version trust identification processing on new user certificates helps to identify and differentiate different versions of the APP, thereby providing more refined detection and optimization for different versions of the APP.

[0023] 3. Network traffic monitoring: It can capture HTTPS network packets of APP applications on Android devices, monitor network traffic, and help discover potential network problems.

[0024] 4. Parallel detection of multiple attributes: Through parallel aggregation detection of multiple attributes, the performance of network packets can be comprehensively evaluated, including network request and response time, request frequency, DNS resolution time, packet type size and sensitive data, etc.

[0025] 5. Anomaly Detection Model: The preset network packet anomaly detection model can identify anomaly-related data features in the network packet detection results, improving the accuracy and efficiency of detection.

[0026] 6. Collaborative detection and processing: Through collaborative detection and processing under threshold rules, potential network performance problems can be identified more accurately, reducing false alarms and false negatives.

[0027] 7. Optimization Solution Determination: Based on the results of potential network performance issues, specific optimization solutions can be determined to help developers or administrators address the problems in a targeted manner and improve the network performance of the app.

[0028] 8. Improve user experience: By optimizing network performance, network latency can be reduced and data transmission efficiency can be improved, thereby enhancing the user experience.

[0029] 9. Reduce operating costs: By promptly identifying and resolving issues, the increase in operating costs caused by network problems can be reduced. Attached Figure Description

[0030] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. In the drawings:

[0031] Figure 1 A flowchart of an optimized detection method based on APP network traffic provided in an embodiment of this application;

[0032] Figure 2 This is a schematic diagram of the structure of an optimized detection device based on APP network traffic, provided in an embodiment of this application. Detailed Implementation

[0033] To enable those skilled in the art to better understand the technical solutions in this application, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this application.

[0034] It's worth noting that with the rapid development of the mobile internet, mobile application (App) development technology has matured significantly, especially on platforms like Android, iOS, and HarmonyOS. Today, a large number of mobile Apps have emerged in the market, covering various aspects of life, work, and entertainment. However, the development of a mobile App doesn't end once the functionality is implemented. A crucial step is the request and optimization of network interfaces.

[0035] Almost all modern apps involve network requests to communicate with remote servers. These requests may include the exchange of user data, application settings, content updates, and other information. However, with the increasing frequency of app use, effectively managing and optimizing network requests has become a pressing issue. The frequency, content type, and data size of network requests can all affect app performance, response speed, and user experience. For example, high-frequency network requests may overload the server, excessive data transmission can slow down response times, and different types of data may require different transmission methods.

[0036] Besides performance optimization, network request security is another crucial issue. Data within an app may include sensitive user information, such as personal privacy details and payment information. Insecure network communication can lead to data breaches or man-in-the-middle attacks. Therefore, ensuring data security during transmission is a critical factor that app developers must consider.

[0037] Furthermore, handling network request-related exceptions is also a crucial part of app development. Common exceptions include request failures, network timeouts, and excessively long server response times, all of which can degrade the user experience. Effectively detecting, monitoring, and optimizing these exceptions to ensure stable and efficient app operation under various network environments is essential for improving app quality.

[0038] In conclusion, optimizing network request performance, security, and anomaly management in mobile apps is a key factor in improving user experience, ensuring data security, and enhancing overall application quality.

[0039] This application provides an optimized detection method based on APP network traffic, such as... Figure 1 As shown, the optimized detection method based on APP network traffic specifically includes steps S101-S105:

[0040] S101. Based on the virtual private network on the Android device, perform version trust identification processing on the user certificate under certificate verification to obtain a new user certificate.

[0041] Specifically, the first step is to deploy the VPN on the Android device. Configure the VPN's properties and designate it as a proxy server.

[0042] Furthermore, a self-signed certificate is generated based on the parsing code of the network packets. Then, the hash value of the older version of the self-signed certificate is obtained using the OpenSSL tool.

[0043] Furthermore, based on the old version hash value, the self-signed certificate is converted to a new format and a new user certificate is obtained.

[0044] In one embodiment, by starting a VPN (Virtual Private Network) service on the Android device as a proxy server, all network requests and responses are forwarded and received through this proxy server. This method can comprehensively capture HTTPS requests and their responses.

[0045] In one embodiment, in the certificate verification solution, since Android 7.0 and above do not trust user certificates by default and cannot directly parse HTTPS network packets, a certificate verification problem needs to be solved. We generate a self-signed certificate (such as certificate.pem) through code, and then use the OpenSSL tool to obtain the old version hash value of the certificate, with the following command: openssl x509-subject_hash_old-in.\certificate.pem. Assuming the obtained hash value is b1c3f6a1, this certificate is saved as a file named b1c3f6a1.0, which is the new user certificate. The use of the old version hash value ensures that the Android device can recognize and trust the new user certificate.

[0046] S102. Capture HTTPS network packets of the APP application on the Android device by using the trust status of the new user certificate in the virtual machine.

[0047] Specifically, using a virtual machine with root privileges, the new user certificate is marked as being in a trusted state. The new user certificate in the trusted state is then imported and / or migrated to the virtual machine's system certificate directory.

[0048] Furthermore, by using a new user certificate in the virtual machine associated with the Android device, network traffic packets of the APP application on the Android device are captured and processed to obtain HTTPS network packets.

[0049] In one embodiment, during certificate installation, since Android 7.0 and above cannot trust self-signed certificates through normal means, we handle it using a virtual machine (usually with root privileges). The generated b1c3f6a1.0 certificate file (new user certificate) is imported into the virtual machine and moved to the virtual machine's system certificate directory system / etc / security / cacerts. This allows applications within the virtual machine to trust the certificate and successfully capture its HTTPS network packets.

[0050] As a feasible implementation method, to simplify certificate export and migration, we can distribute .0 certificate files from the server and automatically migrate the certificates to the target device's certificate directory. This not only simplifies the operation but also facilitates subsequent certificate updates and expiration handling.

[0051] S103. Perform parallel aggregation detection on HTTPS network packets under multiple attributes to obtain network packet detection results. These multiple attributes include: network request and response duration, network request frequency, DNS resolution time, network request and response packet type and size, and sensitive data.

[0052] Specifically, 1) Based on a preset request-response duration threshold, perform anomaly detection on the network request and response duration items in the HTTPS network packet to obtain network request and response duration anomaly information. Then, annotate the network request and response duration anomaly information to generate request-response duration anomaly annotation information.

[0053] As a feasible implementation method, network request and response time detection involves: first, setting time thresholds: setting a time threshold for each request and response, and marking requests and responses exceeding the threshold. Then, optimization criteria: the marking results clearly identify which request response times are too long, which may be caused by insufficient server processing capacity or network transmission bottlenecks. To optimize performance, consider adding caching, compressing data, or optimizing server-side processing.

[0054] 2) Based on a preset frequency threshold, perform anomaly detection on the network request frequency in HTTPS network packets to obtain network request frequency anomaly information. Then, perform fragmented request merging processing on the HTTPS network packets corresponding to the network request frequency anomaly information.

[0055] As a feasible implementation method, network request frequency detection involves: first, setting a frequency threshold: setting a frequency threshold for network requests, and marking requests exceeding the threshold. Then, optimization is based on business needs: for excessively frequent requests, consider merging fragmented requests or caching the result of the first request, thereby reducing the number of repeated requests and improving efficiency.

[0056] 3) Based on the preset DNS time threshold, perform anomaly detection on the DNS resolution time in HTTPS network packets to obtain DNS resolution time anomaly information.

[0057] As a feasible implementation method, DNS resolution time detection involves: first, setting a DNS time threshold; then, marking requests exceeding the threshold. Next, optimization is based on the following: when DNS resolution time is too long, DNS pre-resolution or caching optimization can be used to reduce resolution time and improve network request efficiency.

[0058] 4) Based on preset network packet type and size thresholds, perform anomaly checks on the network request and response packet types and sizes in HTTPS network packets to obtain anomaly information. These anomalies include: request headers, request body, response headers, and response body.

[0059] As a feasible implementation method, network request and response packet type and size detection is implemented as follows: First, packet type and size thresholds are set: size thresholds are set for request headers, request bodies, response headers, and response bodies. For example, the size of the request header in a sub-item can be set to 10KB, and a flag is displayed when it exceeds the threshold. For image request bodies, it can be set to 1MB, and if it exceeds this, a prompt is made to compress or use data compression (such as GZIP). Then, optimization is based on the following: if the detected request header is too large (such as too many cookies or long fields), it may cause the request to fail; if the response body is too large, the amount of data transmitted can be reduced through compression or other methods.

[0060] 5) Based on the predefined regular expressions for sensitive data keywords, perform sensitive information detection processing on sensitive data in HTTPS network packets to obtain sensitive data anomaly information. Then, perform de-identification and annotation processing on the sensitive data anomaly information to obtain sensitive annotation information.

[0061] As a feasible implementation method, sensitive data detection involves: first, defining sensitive data keywords (such as phone numbers, IMEI numbers, ID card numbers, etc.) and writing regular expressions for matching. Then, labeling sensitive data: once a network packet containing sensitive information (such as phone numbers, identity information, etc.) is detected, the system will label it, reminding the developer that the data needs to be encrypted or de-identified to ensure the security of data transmission.

[0062] The network packet detection results include: abnormal information on network request and response duration, abnormal information on network request frequency, abnormal information on DNS resolution time, abnormal information on network request and response packet type and size, and abnormal information on sensitive data.

[0063] S104. Using a preset network packet anomaly detection model, perform collaborative detection processing on the anomaly-related data features in the network packet detection results and under threshold rules to obtain the results of potential network performance problems.

[0064] Specifically, the process involves identifying and collecting anomaly information from network packet detection results. Anomaly-related data features are then extracted from this information. These features include network latency characteristics, frequency characteristics, packet characteristics, and content characteristics. In other words, all network request and response data is collected during packet capture, including timestamps, request paths, request methods, request body size, response body size, response time, DNS resolution time, and request frequency. Anomaly-related data features are then extracted from the collected data.

[0065] As a feasible implementation method, network latency characteristics are defined as the request and response duration characteristics of HTTPS network packets. Frequency characteristics are defined as the number of requests per unit time of HTTPS network packets. Packet characteristics include: request header, request body, response header, and response body size. Content characteristics include: DNS resolution time characteristics and sensitive information detection characteristics.

[0066] Furthermore, the set of abnormal features corresponding to the abnormal data features is determined as the input of the network packet anomaly detection model.

[0067] Furthermore, an unsupervised learning network is used to train and label the abnormal feature set and the normal feature set, thus establishing a network packet anomaly detection model.

[0068] As a feasible implementation, model training and deployment are also required: Model selection: Employ common anomaly detection algorithms, such as supervised learning (SVM, Random Forest, etc.) or unsupervised learning (Isolation Forest, DBSCAN, Autoencoder, etc.). Labeling: Analyze historical anomaly feature sets to label normal and anomalous samples, constructing a training dataset. For unsupervised learning, unlabeled data is used for training. Model training: Train the model using feature data, enabling it to learn the behavior patterns of normal network requests and identify anomalous patterns. Model deployment: Embed the trained network packet anomaly detection model into the packet capture system, analyzing captured network request data in real time. The network packet anomaly detection model can automatically identify potential performance issues in network requests (such as latency bottlenecks, frequency anomalies, etc.) and provide suggestions for possible optimization points. In sensitive data detection, the network packet anomaly detection model can discover the transmission behavior of sensitive information without defined keywords, improving data security. Through the adaptive capabilities of machine learning, the network packet anomaly detection model can reduce the false positive and false negative rates of static threshold-based detection, especially in complex network environments.

[0069] Furthermore, the network packet anomaly detection model is used to perform real-time anomaly detection on the current network packet detection results, and outputs the anomaly type and corresponding anomaly score for each current network packet detection result.

[0070] As a feasible implementation method, real-time anomaly detection involves: Model inference: After aggregating captured network packets, the features are input into the model for inference, outputting an anomaly score and anomaly type for each request. Dynamic updates: The model is periodically updated by continuously collecting new data to ensure that it adapts to new network request patterns and potential anomaly types.

[0071] Furthermore, based on the same anomaly type, the anomaly information detected by threshold rules in the current network packet detection results is combined with the anomaly score under the network packet anomaly detection model to comprehensively evaluate the network's potential performance, resulting in the network potential performance problem results. These results include: high-risk network potential performance problems, medium-risk network potential performance problems, and low-risk network potential performance problems.

[0072] In one embodiment, if the anomaly-related data feature value of the anomaly information in the network packet detection result is greater than a first preset threshold, the anomaly-related data feature value in the anomaly information is input into the network packet anomaly detection model, and the anomaly score corresponding to the anomaly-related data feature value is output. Then, the anomaly score and the anomaly information are comprehensively weighted to determine the potential network performance problem. For example, regarding request and response times, assuming a threshold of 1000 milliseconds is set, due to the influence of network fluctuations and other factors on a single network request, a request might take 1200 milliseconds. However, the network interface is actually normal; it's just an occasional slowdown. According to the threshold detection, this would be identified as an anomaly. However, combined with a machine learning model, it can be re-evaluated. For some detection items, the threshold detection weight will be greater. That is, the anomaly score after model evaluation and the anomaly information after threshold detection can be comprehensively weighted to determine the potential network performance problem (such as latency bottlenecks, frequency anomalies, etc.).

[0073] S105. Based on the results of potential network performance problems, determine the optimization plan for the problems.

[0074] Specifically, abnormal network data items in the results of potential network performance problems are labeled to determine the abnormal label information.

[0075] Furthermore, interpretability analysis is performed on the anomaly label information to obtain the feature value with the greatest anomaly impact. This feature value represents the largest anomaly data parameter in each anomaly label information that requires optimization.

[0076] Furthermore, based on the feature value with the greatest impact of anomalies, problem optimization solutions for APP network traffic optimization are identified and selected.

[0077] In one embodiment, interpretability analysis of anomaly tag information, combined with the feature values ​​that have the greatest impact on anomaly request labeling, helps developers quickly locate problems. Administrators can click on the identifier in the results of potential network performance issues to receive suggested solutions, such as stress testing the network request to investigate whether it's a server problem or using caching, etc.

[0078] In addition, this application also provides an optimization detection device based on APP network traffic, such as... Figure 2 As shown, the APP network traffic optimization detection device 200 specifically includes:

[0079] At least one processor 201. And a memory 202 communicatively connected to the at least one processor 201. The memory 202 stores instructions executable by the at least one processor 201, enabling the at least one processor 201 to execute:

[0080] Based on the virtual private network on the Android device, the user certificate is processed for version trust identification under certificate verification to obtain a new user certificate;

[0081] Capture HTTPS network packets of Android devices' apps by leveraging the trust status of new user certificates in the virtual machine;

[0082] Parallel aggregation detection of HTTPS network packets under multiple attributes is performed to obtain network packet detection results. The multiple attributes include: network request and response duration, network request frequency, DNS resolution time, network request and response packet type and size, and sensitive data.

[0083] By using a pre-defined network packet anomaly detection model, the abnormal data features in the network packet detection results are processed collaboratively with threshold rules to obtain the results of potential network performance problems.

[0084] Based on the results of potential network performance issues, optimization solutions were determined.

[0085] This application provides a solution for capturing and parsing HTTPS packets on the Android platform. Since Android 7.0 and above no longer trust user certificates, making it impossible to parse HTTPS packets, this solution, in conjunction with a virtual machine, can achieve the parsing of HTTPS packets. Furthermore, by analyzing the captured network packets, potential anomalies in application network requests can be obtained, providing strong support for optimizing network requests and network security.

[0086] The various embodiments in this application are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the embodiments for devices and non-volatile computer storage media are basically similar to the method embodiments, so the descriptions are relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0087] The devices and media provided in this application are one-to-one with the methods. Therefore, the devices and media also have similar beneficial technical effects as their corresponding methods. Since the beneficial technical effects of the methods have been described in detail above, the beneficial technical effects of the devices and media will not be repeated here.

[0088] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0089] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0090] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0091] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0092] The foregoing has described specific embodiments of this application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired results. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0093] The above description is merely an embodiment of this application and is not intended to limit this application. For those skilled in the art, various modifications and variations can be made to the embodiments of this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of the embodiments of this application should be included within the scope of this specification.

Claims

1. An optimization detection method based on APP network traffic, characterized in that, The method includes: Based on the virtual private network on the Android device, the user certificate undergoes version trust identification processing under certificate verification to obtain a new user certificate, specifically including: Deploy the virtual private network onto the Android device; Configure the properties of the virtual private network and designate the virtual private network as a proxy server; A self-signed certificate is generated based on the parsing code of HTTPS network packets; and the old version hash value of the self-signed certificate is obtained through the OpenSSL tool; wherein the old version in the old version hash value is a version prior to Android 7.0; Based on the old version hash value, the self-signed certificate is converted to a new format and the new user certificate is obtained. By leveraging the trust status of the new user certificate within the virtual machine, the HTTPS network packets of the APP application on the Android device are captured, specifically including: Using a virtual machine with root privileges, the new user certificate is marked as being in a trusted state; and the new user certificate in the trusted state is imported and / or migrated to the system certificate directory of the virtual machine. By using the new user certificate in the virtual machine associated with the Android device, the network traffic packets of the APP application in the Android device are captured and processed to obtain the HTTPS network packets; The HTTPS network packets are subjected to parallel aggregation detection under multiple attributes to obtain network packet detection results; wherein, the multiple attributes include: network request and response duration, network request frequency, DNS resolution time, network request and response packet type and size, and sensitive data. By using a preset network packet anomaly detection model, collaborative detection processing based on threshold rules is performed on the anomaly-related data features in the network packet detection results to obtain the results of potential network performance problems. Based on the results of the potential network performance issues, an optimization plan was determined.

2. The method of claim 1, wherein, The HTTPS network packets are subjected to parallel aggregation detection under multiple attribute items to obtain network packet detection results, specifically including: Based on a preset request-response duration threshold, anomalies related to the duration threshold are determined for the network request and response duration items in the HTTPS network packet to obtain network request and response duration anomaly information; and the network request and response duration anomaly information is annotated to generate request-response duration anomaly annotation information. Based on a preset frequency threshold, anomalies in the network request frequency of the HTTPS network packets are determined to obtain network request frequency anomaly information; and the HTTPS network packets corresponding to the network request frequency anomaly information are then processed by fragmented request merging. Based on a preset DNS time threshold, anomaly detection is performed on the DNS resolution time in the HTTPS network packet to obtain DNS resolution time anomaly information. Based on preset network packet type and size thresholds, anomaly detection is performed on the network request and response packet type and size sub-items in the HTTPS network packet to obtain network request and response packet type and size anomaly information; wherein, the sub-items include: request header, request body, response header and response body; Based on the regular expression of preset sensitive data keywords, sensitive information detection processing is performed on sensitive data in the HTTPS network packet to obtain sensitive data abnormal information; and the sensitive data abnormal information is then de-identified and labeled to obtain sensitive label information. The network packet detection results include: abnormal information on network request and response duration, abnormal information on network request frequency, abnormal information on DNS resolution time, abnormal information on network request and response packet type and size, and abnormal information on sensitive data.

3. The method of claim 1, wherein the method comprises: Before obtaining the results of potential network performance problems by performing collaborative detection processing based on threshold rules on the anomaly-related data features in the network packet detection results using a preset network packet anomaly detection model, the specific steps include: Identify and collect abnormal detection information from the network packet detection results; Extract the anomaly-related data features from the detected anomaly information; wherein, the anomaly-related data features include: network latency features, frequency features, data packet features, and content features; The network latency characteristic is the request and response duration characteristic of HTTPS network packets; the frequency characteristic is the number of requests per unit time of HTTPS network packets; the data packet characteristics include: request header, request body, response header, and response body size; the content characteristics include: DNS resolution time characteristics and sensitive information detection characteristics; The set of abnormal features corresponding to the abnormal data features is determined as the input of the network packet anomaly detection model.

4. The method of claim 3, wherein the method comprises: By using a pre-defined network packet anomaly detection model, collaborative detection processing based on threshold rules is performed on the anomaly-related data features in the network packet detection results to obtain results of potential network performance problems, specifically including: The network packet anomaly detection model is established by training and labeling the abnormal feature set and the normal feature set through an unsupervised learning network. The network packet anomaly detection model is used to perform real-time anomaly detection on the current network packet detection results, and outputs the anomaly type and corresponding anomaly score for each current network packet detection result. Based on the same anomaly type, the detection anomaly information obtained by threshold rule detection in the current network packet detection result and the anomaly score output by the network packet anomaly detection model are used to comprehensively evaluate the potential network performance and obtain the result of the potential network performance problem. The network potential performance issues include: high-risk network potential performance issues, medium-risk network potential performance issues, and low-risk network potential performance issues.

5. The method of claim 4, wherein the method further comprises: The network potential performance is comprehensively evaluated by combining the anomaly information obtained from the current network packet detection results through threshold rule detection with the anomaly score output by the network packet anomaly detection model, resulting in the network potential performance problem result, specifically including: If the abnormality-related data feature value of the detected abnormal information in the network packet detection result is greater than the first preset threshold, then the abnormality-related data feature in the detected abnormal information is input into the network packet abnormal detection model, and the abnormal score corresponding to the abnormality-related data feature value is output. The anomaly score and the detected anomaly information are combined and weighted to determine the results of the potential network performance problems.

6. The method of claim 1, wherein, Based on the results of the potential network performance issues, an optimization plan was determined, specifically including: The abnormal network data items in the results of the potential network performance problems are labeled to determine the abnormal label information; The anomaly label information is subjected to interpretability analysis to obtain the feature value with the greatest anomaly impact; wherein, the feature value with the greatest anomaly impact is the largest abnormal data parameter in each of the anomaly label information that needs to be optimized; Based on the feature value with the greatest impact of the anomaly, the optimization solutions for the problem of APP network traffic optimization are located and selected.

7. An optimization detection device based on APP network traffic, characterized in that, The device includes: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions executable by the at least one processor, enabling the at least one processor to execute an optimized detection method for APP network traffic according to any one of claims 1-6.

8. A non-transitory computer storage medium, comprising, The storage medium is a non-volatile computer-readable storage medium that stores at least one program, each program including instructions that, when executed by a terminal, cause the terminal to perform an optimized detection method for APP network traffic according to any one of claims 1-6.

Images