Session key capture and security event analysis method and device, equipment and medium

Abstract

The invention discloses a session key capture and security event analysis method, device, equipment and medium, and relates to the technical field of network communication and information security, a data security protection system is established, a probe service is deployed at a security event monitoring end, and an eBPF technology is utilized to capture a TLS session key in a network stack of an operating system according to analysis of a TLS handshake message; and the probe service combines time features, session features and the captured secret key to generate a mapping relation, and the mapping relation is stored into a persistent file. According to the method, the HASH structure is used for storing the secret key file, the mapping relation between the quintuple and the session time point and the mapping relation between the quintuple and the session secret key are increased, searching and symmetric decryption of the mapping relation between the encrypted traffic and the session secret key can be efficiently completed at the decryption server end, the decryption performance is greatly improved, meanwhile, the session generation time and the session secret key are stored in the HASH value, and the decryption efficiency is improved. The method can solve the problem that the old connection is released and the quintuple of the new connection and the old connection is consistent in a high-concurrency scene, and can improve the decryption accuracy.

Description

Technical Field

[0001] The present invention relates to the field of network communication technology and information security technology, and in particular to a method, device, equipment and medium for capturing session keys and analyzing security events. Background Art

[0002] With the popularization of Internet communications and the enhancement of users' privacy awareness, HTTPS has become the mainstream encrypted transmission protocol. A large amount of traffic is encrypted using TLS (Transport Layer Security Protocol). According to the latest industry statistics, TLS 1.2 accounts for most of the HTTPS traffic, but the application ratio of TLS 1.3 is rising rapidly. TLS 1.3 introduces a number of optimizations, such as a faster handshake process, a stronger default encryption algorithm, and a more secure key negotiation mechanism. Compared with TLS 1.2, TLS1.3 deletes the RSA key exchange and fully adopts forward security-based key negotiation methods such as ECDHE, which significantly improves security, but also brings challenges to existing traffic decryption and analysis methods. Take the mainstream open source message analysis software wireshark as an example. When appropriate confidentiality is provided, Wireshark supports TLS decryption. The three available methods are: (1) Using a secret key log file for each session has the following disadvantages: it relies on application logs, is highly invasive, requires modifying server applications or relies on specific log configurations, is difficult to deploy uniformly in a complex distributed architecture, and generates and processes large-scale keylog files, which results in significant performance overhead. (2) Using RSA private key decryption has the following disadvantages: it relies on static key exchange, is only applicable to encryption suites other than ECDHE, and cannot support TLS1.3. The leakage of server private key may lead to large-scale decryption attacks, posing a serious threat to data security. (3) Use pre-shared key (PSK) decryption. Its disadvantages are: it can only work in the scenario where the pre-shared key is explicitly used in the TLS handshake. However, the PSK mode is not the mainstream of TLS communication, has a narrow scope of application, complex configuration, and lacks real-time performance and flexibility. Summary of the invention

[0003] The purpose of the present invention is to provide a method, device, equipment and medium for session key capture and security event analysis, decouple data capture and analysis through a distributed architecture, support decryption and deep security detection of TLS encryption protocols, improve the decryption efficiency, performance and security of the system, adapt to the traffic monitoring and security protection needs in large-scale distributed environments, and solve the problem of insufficient decryption and real-time security analysis capabilities of TLS encrypted traffic in the prior art.

[0004] In order to solve the above technical problems, the technical solution adopted by the present invention is: In the first aspect, a method for capturing session keys and analyzing security events includes the following steps: S1. Establish a data security protection system, deploy a probe service on the security event monitoring end, and use eBPF technology to capture the TLS session key by analyzing the TLS handshake message in the network stack of the operating system; S2. The probe service combines the time feature, session feature, and captured secret key to generate a mapping relationship and save it to disk as a persistent file. The session feature is the communication quintuple. S3. Use high-performance tools to capture the original encrypted traffic, save it as a file in pcap / pcapng format, and name it according to time characteristics; S4. Use the probe service as the gRPC client. When the persistence file reaches the preset threshold, the reporting mechanism is triggered, and the key persistence file and message persistence problem are transmitted to the gRPC server. The gRPC server is the data liquidity security management system. S5, based on the data flow security management system, using the five-tuple characteristics of the traffic message to assist in decrypting the original encrypted traffic; S6. Perform protocol field extraction and security analysis on the decrypted data to detect potential security threats and generate real-time alarms, which are then passed on to administrators to take appropriate measures.

[0005] A further improvement of the technical solution of the present invention is that in S1, the process of capturing the TLS session key includes: Establish a data security protection system including a probe device and a remote security analysis device. The probe device is deployed on the server side that supports the TLS protocol. The TLS decrypted data is captured through eBPF. The remote security analysis device receives the decrypted message file transmitted by the probe device, performs in-depth analysis on the data, and generates security alerts. Deploy a probe service on the security event monitoring end that supports the TLS protocol. The eBPF program hooks into the network stack related functions of the operating system, intercepts data packets in the TLS handshake phase, and analyzes the encryption parameters and key exchange information contained in the handshake message. The probe service interacts with the kernel of the operating system through the eBPF technology to monitor the TLS traffic in the network stack. After the TLS handshake is completed, the session key generated by the encryption algorithm is captured. The specific capture methods include: kernel state capture and user state capture. Kernel state capture directly extracts the session key from the kernel memory through eBPF. User state capture uses eBPF uprobe HOOK user state process's TLS library function to capture the session key generated by the application.

[0006] A further improvement of the technical solution of the present invention is that in S2, the process of storing the persistent file on the disk includes: The probe service obtains the session key captured during the TLS handshake process, the timestamp of key generation, and session features, namely, the communication five-tuple information, from the memory as the key identifier of the session features. The communication five-tuple includes: source IP address, destination IP address, source port number, destination port number, and protocol type. The source IP address is the IP address of the device sending data, the destination IP address is the IP address of the device receiving data, the source port is the port number used for the session on the device sending data, the destination port is the port number used for the session on the device receiving data, and the protocol type is the network protocol used for the session. Associate the captured session key with the corresponding communication quintuple to create a mapping relationship table, where the Key is the communication quintuple, the Value is the session key and its generation time, and then generate a mapping relationship based on the time feature, the communication quintuple and the session key; Based on the generated mapping relationship, the probe service triggers the file storage operation, and then stores the generated mapping relationship as a persistent file and stores it on the disk in the form of a JSON file or a binary file.

[0007] A further improvement of the technical solution of the present invention is that in S3, the process of capturing the original encrypted traffic includes: Configure a high-performance packet capture tool and configure capture parameters according to requirements. The capture parameters include specifying the capture network interface, setting filtering rules, and defining the maximum file size or time interval. The packet capture tools include Wireshark, tcpdump, or Tshark. Enable the packet capture tool to capture the original encrypted traffic in the network, including the TLS handshake and data transmission phase traffic, to ensure that the captured data is complete and not tampered with, and retain all necessary metadata; Save the captured raw encrypted traffic as a file in standard pcap or pcapng format. The pcap / pcapng file has a standardized format and contains complete network packet information, including header and payload. Name the file according to the time characteristics of the captured packet and store the generated pcap / pcapng file in the specified directory.

[0008] A further improvement of the technical solution of the present invention is that in S4, the process of triggering the reporting mechanism includes: Initialize the gRPC client in the probe service, configure the gRPC client to connect to the address and port of the remote gRPC server, ensure that the gRPC server is started and listens to the specified address and port, and configure the gRPC server to receive persistent files from the probe service; Set the conditions for triggering the reporting mechanism in the probe service. When the persistent file reaches the time, size and other thresholds, the reporting mechanism is triggered, and then the persistent file containing the session key is read from the storage directory of the probe service, and the pcap / pcapng file containing the original encrypted traffic is read from the storage directory of the probe service. The probe service establishes a connection with the remote data liquidity security management system through the gRPC protocol, packages the key persistence file and the message persistence file into a gRPC message, and uses the streaming transmission function of gRPC to upload the file in blocks to ensure transmission efficiency and stability; After receiving the file, the gRPC server returns a confirmation message to the probe service. If the transmission is successful, the probe service deletes the local persistent file to free up storage space. If the transmission fails, the probe service records the error log and retries the upload.

[0009] A further improvement of the technical solution of the present invention is that in S5, the process of decrypting the original encrypted traffic includes: The data flow security management system is used to capture traffic packets in the network, and the packet header information is extracted from the captured traffic packets. The session key is searched in the key file based on the five-tuple feature of the traffic packet. The session key saves data in a HASH structure, and the key is a five-tuple feature, which makes the search more efficient. The extracted five-tuple features are stored in a five-tuple flow table to record the traffic information of each flow, and the traffic features in the five-tuple flow table are analyzed to identify the type of encrypted traffic and potential security threats, and the extracted five-tuple features are matched with known traffic features in a traffic feature library to identify the application type or protocol of the encrypted traffic; The corresponding decryption algorithm and key are selected according to the matching result, and then the decryption algorithm and key are applied to decrypt the original encrypted traffic to obtain the plaintext traffic data.

[0010] A further improvement of the technical solution of the present invention is that in S6, the process of generating a real-time alarm includes: Parse the decrypted traffic and extract key fields in the protocol, including but not limited to the request method, URL path and query parameters, header information, request body content, response status code, response header information and response body content, and store the extracted fields in a structured format for subsequent analysis; Perform a validity check on the extracted fields, verify whether the field format and value range comply with the protocol specifications, identify and mark abnormal field values, search for sensitive information in the request / response body, mark and record the sensitive information found, analyze the header fields and request / response body content, and detect potential security threats; According to business needs and security policies, configure alarm rules based on field legitimacy check results, sensitive information detection results, and threat detection results. When the data meets the alarm rules, the alarm mechanism is triggered and alarm information is generated, including alarm time, alarm type, triggering rules, and related data; Deliver the generated alarm information to the administrator via email, SMS and instant messaging tools to ensure the accuracy and timeliness of the alarm information, and display the alarm information on the visualization platform, providing detailed alarm details and related data; After receiving the alarm information, the administrator analyzes the alarm cause and triggering rules, and determines whether there is indeed a security threat based on the analysis results. If it is confirmed that there is a security threat, the administrator needs to take countermeasures including blocking the attack, repairing vulnerabilities, and strengthening security protection, and record the processing process and results for subsequent audit and review.

[0011] In a second aspect, a probe device for implementing the session key capture and security event analysis method is used to implement the session key capture and security event analysis method, including an eBPF program module, a storage module, a packet capture module and a communication module, wherein the modules are connected by electrical signals; The eBPF program module is used to capture session key data of TLS traffic; The storage module stores the session key, generation time, and session quintuple information as a persistent file according to a HASH data structure; The packet capture module is used to capture original data messages; The communication module is used to send the persistent file to the remote security analysis system through the gRPC protocol.

[0012] In a third aspect, a remote security analysis device is provided, which is a probe device for implementing a session key capture and security event analysis method, comprising a receiving module, a decryption module, an analysis module, and an alarm module, wherein the modules are connected by electrical signals; The receiving module is used to receive a persistent message file transmitted by the probe device; The decryption module efficiently obtains the session key in the key file according to the five-tuple information of the encrypted traffic and performs traffic decryption and restoration; The analysis module is used to extract fields and conduct in-depth analysis on message files to detect potential security threats; The alarm module is used to generate security event alarm information.

[0013] In a fourth aspect, a computer-readable storage medium stores a computer program, which, when executed by a processor, implements the session key capture and security event analysis method as described above.

[0014] Due to the adoption of the above technical solution, the present invention has the following technical advances compared with the prior art: The present invention provides a method, device, equipment and medium for capturing session keys and analyzing security events. The HASH structure is used to save the key file, and a mapping relationship between a five-tuple and a session time point and a session key is added. The mapping relationship between the encrypted traffic and the session key can be efficiently searched on the decryption server side, and symmetric decryption can be performed, which greatly improves the decryption performance. At the same time, the HASH value stores the session generation time and the session key, which can solve the problem of releasing the old connection in a high-concurrency scenario, and the scenario where the new connection is consistent with the old link five-tuple, and the decryption accuracy can be improved.

[0015] The present invention provides a method, apparatus, device and medium for capturing session keys and analyzing security events. eBPF operates in kernel state and does not rely on any changes to a specific protocol stack or application layer when capturing TLS traffic and session data. In particular, it is more flexible to deploy in a dynamically expanding distributed system without modifying the application code. It can deploy probe services with low cost and no intrusive impact, decouple the capture and analysis functions, and adopt a distributed architecture design, thereby reducing dependence on local performance and improving scalability and flexibility.

[0016] The present invention provides a method, apparatus, device and medium for capturing session keys and analyzing security events. Data is transmitted through gRPC, which avoids direct exposure of sensitive information (such as session keys or plaintext), improves the security and compliance of the system, supports distributed architecture, can flexibly adapt to cloud-native environments and large-scale deployments, and provides higher scalability than traditional stand-alone or local solutions. Data is transmitted through gRPC, which avoids direct reliance on decryption buffers and supports deployment requirements in multi-tenant and distributed environments.

[0017] The present invention provides a method, device, equipment and medium for session key capture and security event analysis, covering the complete process from traffic capture, decryption to field extraction and security event alarm, and can adapt to multiple scenario requirements such as traffic analysis, threat detection and compliance auditing. Compared with traditional technologies that are limited to traffic capture, it has increased practical value. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0019] Figure 1 It is a schematic diagram of the workflow of the present invention. DETAILED DESCRIPTION

[0020] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0021] Embodiment 1, as Figure 1 As shown, the present invention provides a method for capturing session keys and analyzing security events, comprising the following steps: S1. Establish a data security protection system, deploy a probe service at the security event monitoring end, and use eBPF technology to capture the TLS session key in the network stack of the operating system based on the analysis of the TLS handshake message, and establish a data security protection system including a probe device and a remote security analysis device, wherein the probe device is deployed on the server side that supports the TLS protocol, and the TLS decrypted data is captured through eBPF. The remote security analysis device receives the decrypted message file transmitted by the probe device, performs in-depth analysis on the data, and generates a security alarm. The probe service is deployed at the security event monitoring end that supports the TLS protocol, and the eBPF program is HOOKed to the network stack related functions of the operating system (t cp_sendmsg (kernel state function), udp_sendmsg (kernel state function), SSL_write_key (user state function)), intercept the data packets in the TLS handshake phase, and analyze the encryption parameters and key exchange information contained in the handshake message. The probe service interacts with the kernel of the operating system through the eBPF technology to monitor the TLS traffic in the network stack. After the TLS handshake is completed, the session key generated by the encryption algorithm is captured. The specific capture methods include: kernel state capture and user state capture. The kernel state capture directly extracts the session key from the kernel memory through eBPF, and the user state capture uses the TLS library function of the eBPF uprobe HOOK user state process to capture the session key generated by the application. S2. The probe service combines time features, session features, and captured secret keys to generate a mapping relationship and save it to a persistent file. The session features are the communication quintuple. The probe service obtains the session key captured during the TLS handshake process and the timestamp and session features of the generated key, that is, the communication quintuple information, from the memory as the key identifier of the session features. The communication quintuple includes: source IP address, target IP address, source port number, target port number, and protocol type. The source IP address is the IP address of the device sending data, the destination IP address is the IP address of the device receiving data, and the source port is the IP address of the device sending data. The port number used for the session on the device, the destination port is the port number used for the session on the device receiving the data, the protocol type is the network protocol used by the session, the captured session key is associated with the corresponding communication quintuple, and a mapping relationship table is created, where: Key is the communication quintuple, Value is the session key and its generation time, and then a mapping relationship is generated based on the time feature, the communication quintuple and the session key. Based on the generated mapping relationship, the probe service triggers the file storage operation, and then the generated mapping relationship is stored as a persistent file and stored on the disk in the form of a JSON file or a binary file; S3. Use high-performance tools to capture the original encrypted traffic, save it as a file in pcap / pcapng format, and name it according to time characteristics. Configure a high-performance packet capture tool and configure capture parameters according to requirements. The capture parameters include specifying the capture network interface, setting filtering rules, and defining the maximum file size or time interval for automatic segmentation saving. The packet capture tools include Wireshark, tcpdump or Tshark, etc. Enable the packet capture tool to capture the original encrypted traffic in the network, including the TLS handshake and data transmission stage traffic, ensure that the captured data is complete and not tampered with, retain all necessary metadata, and save the captured original encrypted traffic as a file in standard pcap or pcapng format. The pcap / pcapng file has a standardized format, which is convenient for subsequent analysis tools to parse, and contains complete network data packet information, including headers and payloads. Name the file according to the time characteristics of the captured packet to ensure that the file name is unique and easy to identify, and store the generated pcap / pcapng file in the specified directory; S4. Use the probe service as the gRPC client. When the persistent file reaches the preset threshold, the reporting mechanism is triggered, and the key-holding persistent file and message persistence issues are transmitted to the gRPC server. The gRPC server is the data liquidity security management system. Initialize the gRPC client in the probe service, configure the gRPC client to connect to the address and port of the remote gRPC server, ensure that the gRPC server is started and listens to the specified address and port, and configure the gRPC server to receive persistent files from the probe service. Set the conditions for triggering the reporting mechanism in the probe service. When the persistent file reaches the time, size and other thresholds, the reporting mechanism is triggered, and then Read the persistent file containing the session key from the storage directory of the probe service, and read the pcap / pcapng file containing the original encrypted traffic from the storage directory of the probe service. The probe service establishes a connection with the remote data liquidity security management system through the gRPC protocol, packages the persistent file holding the secret key and the persistent file of the message into a gRPC message, and uses the streaming transmission function of gRPC to upload the file in blocks to ensure transmission efficiency and stability. After receiving the file, the gRPC server returns a confirmation message to the probe service. If the transmission is successful, the probe service deletes the local persistent file to free up storage space. If the transmission fails, the probe service records the error log and retries the upload. S5, based on the data flow security management system, using the five-tuple characteristics of the traffic message to assist in decrypting the original encrypted traffic; S6. Perform protocol field extraction and security analysis on the decrypted data to detect potential security threats and generate real-time alarms, and then pass the alarm information to the administrator to take corresponding measures. By deploying a probe service on the server side of the TLS encryption application, the eBPF technology is used to obtain the key for saving TLS, and the session key is saved in a persistent file according to the five-tuple session characteristics and time slice characteristics. At the same time, the original encrypted traffic is collected by capturing packets to generate a persistent file. The probe service transmits the persistent file to the remote data liquidity security management system through the gRPC protocol. The remote security system extracts and deeply analyzes the message content to detect potential security threats and generate security event alarms. According to the session key and the five-tuple and time characteristics of the message, the key is matched with the message. The remote security system can quickly and efficiently complete remote decryption and security event analysis, which solves the problem of low efficiency of local processing in the existing solution. By capturing the session key for deep field extraction, more complete traffic context information is provided for security analysis, which improves the detection capability of complex attack scenarios.

[0022] Embodiment 2, as Figure 1 As shown, based on Example 1, the present invention provides a technical solution: Preferably, in S5, the process of decrypting the original encrypted traffic includes: The data flow security management system is used to capture the traffic packets in the network, and the packet header information is extracted from the captured traffic packets. The session key is searched in the key file in combination with the five-tuple feature of the traffic packet. The session key saves data in a HASH structure, and the Key is a five-tuple feature, which has higher search efficiency. The extracted five-tuple feature is stored in the five-tuple flow table to record the traffic information of each flow, and the traffic features in the five-tuple flow table are analyzed to identify the type of encrypted traffic and potential security threats. The extracted five-tuple feature is matched with the known traffic features in the traffic feature library to identify the application type or protocol of the encrypted traffic. The corresponding decryption algorithm and key are selected according to the matching result, and then the decryption algorithm and key are applied to decrypt the original encrypted traffic to obtain the plaintext traffic data. This solves the pain point problem that the existing technology needs to match the traffic packet with the session key one by one, which has low execution efficiency and high resource occupation. At the same time, the HASH value saves the session generation time and the session key, which can solve the scenario where the old connection is released in a high concurrency scenario and the new connection is consistent with the old connection five-tuple, which can improve the decryption accuracy. In S6, the process of generating a real-time alarm includes: Parse the decrypted traffic and extract key fields in the protocol, including request method, URL path and query parameters, header information, request body content, response status code, response header information and response body content, etc., but not limited to these. Store the extracted fields in a structured format for subsequent analysis, perform a legitimacy check on the extracted fields, verify whether the field format, value range, etc. comply with the protocol specifications, identify and mark abnormal field values, search for sensitive information in the request / response body, mark and record the sensitive information found, analyze the header fields and request / response body content, detect potential security threats, and configure the results based on the field legitimacy check, sensitive information detection results, and threats according to business needs and security policies. The alarm rules of the detection results, when the data meets the alarm rules, the alarm mechanism is triggered and the alarm information is generated, including the alarm time, alarm type, triggering rules and related data, etc. The generated alarm information is delivered to the administrator via email, SMS and instant messaging tools to ensure the accuracy and timeliness of the alarm information, and the alarm information is displayed on the visualization platform, providing detailed alarm details and related data. After receiving the alarm information, the administrator analyzes the alarm cause and triggering rules, and determines whether there is indeed a security threat based on the analysis results. If a security threat is confirmed, the administrator needs to take countermeasures including blocking attacks, repairing vulnerabilities, and strengthening security protection, and record the processing process and results for subsequent audits and replays.

[0023] Embodiment 3, as Figure 1As shown, on the basis of Embodiment 1-2, the present invention further provides a probe device for implementing a session key capture and security event analysis method, including an eBPF program module, a storage module, a packet capture module, and a communication module, wherein the modules are electrically connected by signals; eBPF program module for capturing session key data of TLS traffic; The storage module stores the session key, generation time, and session five-tuple information as a persistent file according to the HASH data structure; Packet capture module, used to capture original data packets; The communication module is used to send persistent files to the remote security analysis system through the gRPC protocol; Furthermore, a remote security analysis device is provided, which is a probe device for implementing a session key capture and security event analysis method, comprising a receiving module, a decryption module, an analysis module, and an alarm module, wherein the modules are connected by electrical signals; A receiving module, used for receiving a persistent message file transmitted by a probe device; The decryption module efficiently obtains the session key from the key file based on the five-tuple information of the encrypted traffic and performs traffic decryption and restoration; The analysis module is used to extract fields and conduct in-depth analysis on message files to detect potential security threats; An alarm module is used to generate security event alarm information; In addition, a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a method for capturing session keys and analyzing security events; Generally speaking, the computer instructions for implementing the method of the present invention can be carried by any combination of one or more computer-readable storage media. The computer-readable storage medium can include any computer-readable medium except the signal itself that is temporarily propagating.

[0024] Computer readable storage media can be, for example, but not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or components, or any combination thereof. More specific examples (non-exhaustive list) of computer readable storage media include: an electrical connection with one or more conductors, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In this document, a computer readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, device, or device.

[0025] Computer program codes for performing the operations of the present invention may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages, in particular, Python suitable for neural network computing and platform frameworks based on TensorFlow, PyTorch, etc. may be used. The program code may be executed entirely on the user's computer, partially on the user's computer, as an independent software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer, or to an external computer (e.g., connected via the Internet using an Internet service provider) through any type of network, including a local area network (LAN) or a wide area network (WAN).

[0026] The above-mentioned computer-readable storage medium can refer to the implementation content and beneficial effects of the method mentioned above, which will not be repeated here.

[0027] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. Session key capture and security event analysis method, characterized in that: The following steps are involved: S1. Establish a data security protection system, deploy a probe service on the security event monitoring end, and use eBPF technology to capture the TLS session key by analyzing the TLS handshake message in the network stack of the operating system; S2. The probe service combines the time feature, session feature, and captured secret key to generate a mapping relationship and save it to disk as a persistent file. The session feature is the communication quintuple. S3. Use high-performance tools to capture the original encrypted traffic, save it as a file in pcap / pcapng format, and name it according to time characteristics; S4. Use the probe service as the gRPC client. When the persistence file reaches the preset threshold, the reporting mechanism is triggered, and the key persistence file and message persistence problem are transmitted to the gRPC server. The gRPC server is the data liquidity security management system. S5, based on the data flow security management system, using the five-tuple characteristics of the traffic message to assist in decrypting the original encrypted traffic; S6. Perform protocol field extraction and security analysis on the decrypted data to detect potential security threats and generate real-time alarms, which are then passed on to administrators to take appropriate measures.

2. The method for capturing session keys and analyzing security events according to claim 1, characterized in that: In S1, the process of capturing the TLS session key includes: Establish a data security protection system including a probe device and a remote security analysis device. The probe device is deployed on the server side that supports the TLS protocol. The TLS decrypted data is captured through eBPF. The remote security analysis device receives the decrypted message file transmitted by the probe device, performs in-depth analysis on the data, and generates security alerts. Deploy a probe service on the security event monitoring end that supports the TLS protocol. The eBPF program hooks into the network stack related functions of the operating system, intercepts data packets in the TLS handshake phase, and analyzes the encryption parameters and key exchange information contained in the handshake message. After the TLS handshake is completed, the session key generated by the encryption algorithm is captured. The specific capture methods include: kernel state capture and user state capture. Kernel state capture directly extracts the session key from the kernel memory through eBPF. User state capture uses eBPF uprobe HOOK user state process's TLS library function to capture the session key generated by the application.

3. The method for capturing session keys and analyzing security events according to claim 2, characterized in that: In S2, the process of storing persistent files on disk includes: The probe service obtains the session key captured during the TLS handshake process, the timestamp of the key generation, and the session features, namely, the communication five-tuple information, from the memory as the key identifier of the session features. The communication five-tuple includes: source IP address, target IP address, source port number, target port number, and protocol type. Associate the captured session key with the corresponding communication quintuple to create a mapping relationship table, where the Key is the communication quintuple, the Value is the session key and its generation time, and then generate a mapping relationship based on the time feature, the communication quintuple and the session key; Based on the generated mapping relationship, the probe service triggers the file storage operation, and then stores the generated mapping relationship as a persistent file and stores it on the disk in the form of a JSON file or a binary file.

4. The method for capturing session keys and analyzing security events according to claim 3, characterized in that: In the S3, the process of capturing the original encrypted traffic includes: Configure a high-performance packet capture tool and configure capture parameters according to requirements. The capture parameters include specifying the capture network interface, setting filtering rules, and defining the maximum file size or time interval. The packet capture tool includes Wireshark, tcpdump, or Tshark. Enable the packet capture tool to capture the original encrypted traffic in the network, including the TLS handshake and data transmission phase traffic; Save the captured raw encrypted traffic as a file in standard pcap or pcapng format; Name the file according to the time characteristics of the captured packet and store the generated pcap / pcapng file in the specified directory.

5. The method for capturing session keys and analyzing security events according to claim 4, characterized in that: In S4, the process of triggering the reporting mechanism includes: Initialize the gRPC client in the probe service, configure the address and port of the gRPC client to connect to the remote gRPC server, and configure the gRPC server to receive persistent files from the probe service; Set the conditions for triggering the reporting mechanism in the probe service. When the persistent file reaches the time and size threshold, the reporting mechanism is triggered, and then the persistent file containing the session key is read from the storage directory of the probe service, and the pcap / pcapng file containing the original encrypted traffic is read from the storage directory of the probe service. The probe service establishes a connection with the remote data liquidity security management system through the gRPC protocol, packages the key persistence file and the message persistence file into a gRPC message, and uses the streaming function of gRPC to upload the file in blocks; After receiving the file, the gRPC server returns a confirmation message to the probe service. If the transmission is successful, the probe service deletes the local persistent file to free up storage space. If the transmission fails, the probe service records the error log and retries the upload.

6. The method for capturing session keys and analyzing security events according to claim 5, characterized in that: In S5, the process of decrypting the original encrypted traffic includes: The data flow security management system is used to capture the traffic packets in the network, and the packet header information is extracted from the captured traffic packets. The session key is searched in the key file in combination with the five-tuple feature of the traffic packet. The session key saves data in a HASH structure, and the key is a five-tuple feature. The extracted five-tuple features are stored in the five-tuple flow table to record the traffic information of each flow, and the traffic features in the five-tuple flow table are analyzed, and the extracted five-tuple features are matched with the known traffic features in the traffic feature library to identify the application type or protocol of the encrypted traffic; The corresponding decryption algorithm and key are selected according to the matching result, and then the decryption algorithm and key are applied to decrypt the original encrypted traffic to obtain the plaintext traffic data.

7. The method for capturing session keys and analyzing security events according to claim 6, characterized in that: In S6, the process of generating a real-time alarm includes: Parse the decrypted traffic and extract key fields in the protocol, including request method, URL path and query parameters, header information, request body content, response status code, response header information and response body content, and store the extracted fields in a structured format; Perform a validity check on the extracted fields, verify whether the field format and value range comply with the protocol specifications, identify and mark abnormal field values, search for sensitive information in the request / response body, mark and record the sensitive information found, analyze the header fields and request / response body content, and detect potential security threats; According to business needs and security policies, configure alarm rules based on field legitimacy check results, sensitive information detection results, and threat detection results. When the data meets the alarm rules, the alarm mechanism is triggered and alarm information is generated, including alarm time, alarm type, triggering rules, and related data; Deliver the generated alarm information to the administrator via email, SMS and instant messaging tools, and display the alarm information on the visualization platform, providing detailed alarm details and related data; After receiving the alarm information, the administrator analyzes the alarm cause and triggering rules, and determines whether there is indeed a security threat based on the analysis results. If it is confirmed that there is a security threat, the administrator needs to take countermeasures including blocking the attack, repairing vulnerabilities, and strengthening security protection, and record the processing process and results.

8. A probe device for implementing the method for capturing session keys and analyzing security events, used to implement the method for capturing session keys and analyzing security events as described in any one of claims 1 to 7, characterized in that: It includes an eBPF program module, a storage module, a packet capture module, and a communication module, wherein the modules are connected by electrical signals; The eBPF program module is used to capture session key data of TLS traffic; The storage module stores the session key, generation time, and session quintuple information as a persistent file according to a HASH data structure; The packet capture module is used to capture original data messages; The communication module is used to send the persistent file to the remote security analysis system through the gRPC protocol.

9. A remote security analysis device, used to implement the probe device for implementing the session key capture and security event analysis method as claimed in claim 8, characterized in that: It includes a receiving module, a decryption module, an analysis module and an alarm module, wherein the modules are connected by electrical signals; The receiving module is used to receive a persistent message file transmitted by the probe device; The decryption module efficiently obtains the session key in the key file according to the five-tuple information of the encrypted traffic and performs traffic decryption and restoration; The analysis module is used to extract fields and conduct in-depth analysis on message files to detect potential security threats; The alarm module is used to generate security event alarm information.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the session key capture and security event analysis method as described in any one of claims 1 to 7 is implemented.

Images