NAT local area network host detection method and system based on TLS flow

Abstract

The invention provides an NAT local area network host detection method and system based on TLS flow, and belongs to the field of equipment auditing, and the method comprises the steps: S1, collecting and analyzing a TLS data packet in a target network, and recording the access characteristics of a TLS protocol in a ClientHello data packet; s2, constructing a local feature library according to the inherent traffic frequency domain statistics of a known system in the analysis sample traffic and the corresponding relationship between the source IP and the equipment type and the SNI server domain name of the source IP and the equipment type; s3, analyzing frequency domain features of the to-be-detected traffic data and storing the frequency domain features in a log; s4, performing feature matching on the analysis result and a local feature library, and inferring the number of active devices in the target IP according to a matching result; judging whether the target network is an NAT local area network; and querying the local feature library to judge the equipment type of the host included in the target IP of the to-be-detected traffic. According to the method, the type of the host equipment in the local area network formed by the NAT equipment can be detected.

Description

Technical Field

[0001] The invention belongs to the field of equipment auditing, and in particular relates to a NAT local area network host detection method and system based on TLS traffic. Background Art

[0002] Network Address Translation (NAT) is a technology that alleviates the shortage of IP addresses and is widely used by mainstream operators. With NAT technology, a large number of host groups (usually within a local area network) can use a single or a limited set of public IP addresses to connect to the outside world, access the Internet and use public Internet services.

[0003] Therefore, NAT plays an important role in any network configuration. However, if used improperly, it may cause security issues. NAT technology increases the difficulty of detecting malicious hosts in the LAN, so there is a need for NAT device auditing. However, in some cases, traditional host identification and calculation technologies may not meet the needs and may lead to misjudgment. Therefore, how to identify and analyze network traffic while handling the huge overhead of calculation and data has become a problem that needs to be solved. Summary of the invention

[0004] To solve the above technical problems, the present invention provides a NAT local area network host detection method based on TLS traffic, comprising the following steps:

[0005] Step S1: Collect and parse TLS data packets in the target network, record the access features of the TLS protocol in the ClientHello data packet, including: SNI, source IP, destination IP, source port, destination port, time, protocol type, and store them in a local database; wherein the TLS data packet includes: analysis sample traffic data and traffic data to be detected;

[0006] Step S2: constructing a local feature library based on the inherent traffic frequency domain statistics of the known system in the analyzed sample traffic data, and the corresponding relationship between the source IP and device type in the access feature and its SNI server domain name;

[0007] Step S3: Analyze and obtain the frequency domain characteristics of the flow data to be detected, and store the analysis results in a log;

[0008] Step S4: perform feature matching on the analysis result and the local feature library, and infer the number of active devices in the target IP based on the matching result; if the number of active devices is greater than 1, it is confirmed that the target IP is a public network IP of a NAT gateway device, corresponding to a target NAT LAN; further query the local feature library to determine the device type of the host contained in the target IP address of the traffic data to be detected.

[0009] Beneficial effects:

[0010] 1. The present invention proposes a novel NAT local area network host detection method based on TLS traffic characteristics. By analyzing the frequency domain characteristics of the inherent traffic of the system and the device through frequency domain conversion, the problem of unclear traffic data packet characteristics in the time domain is solved. The frequency domain characteristics of the target IP are matched with the rules defined in the local feature library by using cosine similarity. It can detect and identify whether the target IP address is the external IP address used by the NAT device, and analyze the number and device types of hosts in the constructed local area network.

[0011] 2. The present invention only uses the first message of the data packet to perform lightweight processing on the traffic, without analyzing more data packets, which can effectively reduce the data processing overhead and the computational complexity, thereby solving problems such as network detection in high-bandwidth scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 A schematic flow chart of a NAT local area network host detection method based on TLS traffic of the present invention;

[0013] Figure 2 The present invention is a structural block diagram of a NAT local area network host detection system based on TLS traffic. DETAILED DESCRIPTION

[0014] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0015] Embodiment 1

[0016] like Figure 1 As shown, a NAT local area network host detection method based on TLS traffic provided by an embodiment of the present invention includes the following steps:

[0017] Step S1: Collect and parse TLS data packets in the target network, record the access features of the TLS protocol in the ClientHello data packet, including: SNI, source IP, destination IP, source port, destination port, time, protocol type, and store them in a local database; wherein the TLS data packet includes: analysis sample traffic data and traffic data to be detected;

[0018] Step S2: construct a local feature library based on the inherent traffic frequency domain statistics of the known system in the analyzed sample traffic data, and the corresponding relationship between the source IP in the access feature and its SNI server domain name;

[0019] Step S3: Analyze and obtain the frequency domain characteristics of the traffic data to be detected, and store the analysis results in a log;

[0020] Step S4: Perform feature matching on the analysis results and the local feature library, and infer the number of active devices in the target IP based on the matching results; if the number of active devices is greater than 1, it is confirmed that the target IP is a public IP of a NAT gateway device, corresponding to a target NAT LAN; further query the local feature library to determine the device type of the host contained in the target IP address of the traffic data to be detected.

[0021] In one embodiment, the above step S1: collects and parses TLS data packets in the target network, records the access characteristics of the TLS protocol in the ClientHello data packet, including: SNI, source IP, destination IP, source port, destination port, time, protocol type, and stores them in a local database; wherein the TLS data packet includes: analyzing sample traffic data and traffic data to be detected, specifically including:

[0022] The embodiment of the present invention captures data packets and parses traffic data packets based on DPDK and BPF technologies: first, the IP version of the data packet is confirmed, and the source address and destination address are stored, and then the data packet is checked whether it belongs to a TCP data packet; if it does, the port number is recorded and the type of the TCP data packet is checked according to the setting of the TCP flag; if the data packet contains a data payload, the possible HTTP or HTTPS request is further parsed, and the target port is checked to see if it is 80 or 443, and then the payload is further checked to see whether it contains a valid HTTP header or TLS Client Hello message; if the check is successful, the HTTP Request or ClientHello is parsed according to the payload content; for TLS traffic, only the SNI field of its ClientHello message is analyzed; the SNI, source IP, destination IP, request time, and protocol type of the TLS protocol in the ClientHello data packet are recorded and stored in a local database.

[0023] In order to reduce the data complexity in the processing process, the present invention does not select multiple fields in the data packet as features, but only processes the first TCP packet after SYN, parses the HTTP Request or TLS ClientHello, records the access features of the TLS protocol in the data packet and stores them in the local database; and determines whether timeout retransmission and other behaviors occur based on the same basic information in the request data packet within a short period of time, and screens and deduplicates the requests.

[0024] In one embodiment, the above step S2: constructing a local feature library based on the inherent traffic frequency domain statistics of the known system in the analysis sample traffic data, and the corresponding relationship between the source IP and device type in the access feature and its SNI server domain name, specifically includes:

[0025] Step S21: frequency domain conversion algorithm is used to extract frequency domain features in the analysis sample traffic data, that is, the number of times the known system accesses the SNI server domain name in the external inherent traffic request within a unit time is counted, and the amplitude is defined to represent the amplitude of the traffic sequence change, the period represents the time interval of repeated occurrence in the traffic sequence, and the phase represents the starting point of a specific period; assuming that the traffic is sent out according to a specific period, the amplitude, period and phase are traversed in turn, and the difference between the constructed traffic sequence and the actual traffic sequence is compared, and the cosine similarity is defined as a measure of the difference between the constructed traffic sequence and the actual traffic sequence, and then the amplitude, period and phase with the maximum similarity value are selected as the frequency domain feature value of the traffic sequence, including: the frequency, period and delay time of the known type system accessing the specific domain name; in order to avoid timeout retransmission affecting the matching accuracy, the frequency domain feature also introduces a cooling time, that is, when a certain traffic feature is matched, the traffic sent to the same domain name within a few minutes thereafter is ignored;

[0026] Step S22: When the target IP has multiple different externally accessed SNI server domain names, the training set is tested with the learned frequency features, sorted according to the accuracy, and assigned priorities. The higher the accuracy, the higher the priority. The frequency domain features of each different SNI server domain name are recorded and saved in the local feature library according to the priority.

[0027] In the present invention, the system's external inherent traffic is defined as normal request traffic such as system updates and registration checks sent out by the system in a normal state without any operation. The present invention constructs a sequence of amplitude (number of transmissions, i.e. frequency), period and phase (delay time) within a certain range, and performs cosine similarity matching with the traffic sent by the device to identify the frequency domain characteristics of the inherent traffic of a known system accessing a specific domain name.

[0028] An example of the frequency domain characteristics of a specific inherent flow is as follows:

[0029] System type: Windows 10

[0030] Priority: 100

[0031] Visit domain name: download.windowsupdate.com

[0032] Cycle: 1440 minutes

[0033] Number of times sent: 2 times

[0034] Delay time: None

[0035] Cooling time: 10 minutes.

[0036] In one embodiment, the above step S3: analyzing and obtaining the frequency domain characteristics of the flow data to be detected, and storing the analysis results in a log, specifically includes:

[0037] In the same manner as step S21, frequency domain features of all different SNI server domain names in the traffic data to be detected are extracted.

[0038] In one embodiment, the above step S4: feature matching the analysis result with the local feature library, and inferring the number of active devices in the target IP according to the matching result; if the number of active devices is greater than 1, it is confirmed that the target IP is a public network IP of a NAT gateway device, corresponding to a target NAT local area network; further querying the local feature library to determine the device type of the host contained in the target IP address of the traffic data to be detected, specifically including:

[0039] Step S41: Get the SNI server domain name accessed by the traffic to be analyzed in the local database, read the frequency domain features of the SNI server domain name in the log generated in step S3 in turn, match and query it with all the rules defined in the configuration file of the local feature library, obtain the frequency domain features corresponding to the SNI server domain name, and query the number of visits to the SNI server domain name in the traffic to be analyzed within this time range according to the period in the frequency domain features as the time range, and the ratio of the number of visits to the SNI server domain name to the feature value in the local feature library is recorded as the activity of the SNI server domain name;

[0040] For example, if there is inherent traffic accessing SNI server domain names such as download.windowsupdate.com in the traffic to be analyzed, the frequency domain features of the SNI server domain names such as download.windowsupdate.com in the log generated in step S3 are read in turn, and the corresponding SNI server domain name rules in the configuration file of the local feature library are queried in turn. The frequency domain features defined by the rules are matched with each other using cosine similarity. If the match is successful, the period of the frequency domain features is used as the time range, and the number of visits to the SNI server domain names such as download.windowsupdate.com in the traffic to be analyzed within this time range is queried as t1, and the amplitude of the corresponding SNI server domain names such as download.windowsupdate.com in the configuration file of the local feature library is recorded as t2 (number of transmissions). The ratio of t1 to t2 (t1 / t2) is calculated to obtain the activity corresponding to the download.windowsupdate.com domain name; if the match fails, the current SNI server domain name is skipped, and the next SNI server domain name in the configuration file of the local feature library is calculated.

[0041] Step S42: Calculate the activity of all SNI server domain names accessed in the traffic to be analyzed; when there are multiple different externally accessed SNI server domain names in the traffic to be analyzed, calculate them in order of priority; and determine whether the IP address is a NAT translation address; if it is a NAT translation address, go to step S43;

[0042] For example, if the traffic initiated by a certain IP address includes both the download.windowsupdate.com field and motd.ubuntu.com, it is inferred that the IP address is the public IP of a NAT gateway device; and the NAT LAN corresponding to the IP address contains at least a host of the Windows operating system and a host of the Ubuntu operating system.

[0043] Step S43: For the activity calculated for all SNI server domain names visited in the traffic to be analyzed, further infer the number of hosts corresponding to each SNI server domain name in the target network; then, by classifying the number of hosts obtained in the above steps according to the device types corresponding to different SNI server domain names, the device type corresponding to the NAT conversion address and its corresponding number are obtained; after all analyses are completed, the final analysis results are output.

[0044] Embodiment 2

[0045] like Figure 2As shown, the embodiment of the present invention provides a NAT local area network host detection system based on TLS traffic, including the following modules:

[0046] The traffic collection module 51 is used to collect and parse TLS data packets in the target network, record the access characteristics of the TLS protocol in the ClientHello data packet, including: SNI, source IP, destination IP, source port, destination port, time, protocol type, and store them in the local database; wherein the TLS data packet includes: analysis sample traffic data and traffic data to be detected;

[0047] A local feature library building module 52 is used to build a local feature library based on the inherent traffic frequency domain statistics of a known system in the analysis sample traffic data, and the corresponding relationship between the source IP and device type in the access feature and its SNI server domain name;

[0048] The frequency domain feature acquisition module 53 is used to analyze and obtain the frequency domain features of the flow data to be detected, and store the analysis results in a log;

[0049] The analysis module 54 is used to perform feature matching between the analysis results and the local feature library, and infer the number of active devices in the target IP based on the matching results; if the number of active devices is greater than 1, it is confirmed that the target IP is a public network IP of a NAT gateway device, corresponding to a target NAT local area network; by further querying the local feature library, the device type of the host contained in the target IP address of the traffic data to be detected is determined.

Claims

1. A NAT local area network host detection method based on TLS traffic, characterized in that: include: Step S1: Collect and parse TLS data packets in the target network, record the access features of the TLS protocol in the ClientHello data packet, including: SNI, source IP, destination IP, source port, destination port, time, protocol type, and store them in a local database; wherein the TLS data packet includes: analysis sample traffic data and traffic data to be detected; Step S2: constructing a local feature library based on the inherent traffic frequency domain statistics of the known system in the analyzed sample traffic data, and the corresponding relationship between the source IP and device type in the access feature and its SNI server domain name; Step S3: Analyze and obtain the frequency domain characteristics of the flow data to be detected, and store the analysis results in a log; Step S4: feature match the analysis result with the local feature library, and infer the number of active devices in the target IP based on the matching result; if the number of active devices is greater than 1, it is confirmed that the target IP is a public network IP of a NAT gateway device, corresponding to a target NAT local area network; by further querying the local feature library, determine the device type of the host contained in the target IP address of the traffic data to be detected.

2. The NAT local area network host detection method based on TLS traffic according to claim 1 is characterized in that: Step S1: collect and parse TLS data packets in the target network, record the access features of the TLS protocol in the ClientHello data packet, including: SNI, source IP, destination IP, source port, destination port, time, protocol type, and store them in a local database; wherein the TLS data packet includes: analyzing sample traffic data and traffic data to be detected, specifically including: Parse traffic data packets: first confirm the IP version of the data packet, store the source address and destination address, and then check whether the data packet is a TCP data packet; if it is, record the port number and check the type of TCP data packet according to the setting of the TCP flag; if the data packet contains a data payload, further parse the possible HTTP or HTTPS request, check whether the target port is 80 or 443, and then further check the payload to confirm whether it contains a valid HTTP header or TLS Client Hello message; if the check is successful, parse the HTTP Request or ClientHello according to the payload content; for TLS traffic, only analyze the SNI field of its ClientHello message; record the SNI, source IP, destination IP, request time, and protocol type of the TLS protocol in the ClientHello data packet and store them in the local database.

3. The NAT local area network host detection method based on TLS traffic according to claim 2 is characterized in that: The step S2: constructing a local feature library based on the inherent traffic frequency domain statistics of the known system in the analyzed sample traffic data, and the corresponding relationship between the destination IP and device type in the access feature and its SNI server domain name, specifically includes: Step S21: frequency domain conversion algorithm is used to extract frequency domain features in the analysis sample traffic data, that is, the number of times the known system accesses the SNI server domain name in the external inherent traffic request within a unit time is counted, and the amplitude is defined to represent the amplitude of the traffic sequence change, the period represents the time interval of repeated occurrence in the traffic sequence, and the phase represents the starting point of a specific period; assuming that the traffic is sent out according to a specific period, the amplitude, period and phase are traversed in turn, and the difference between the constructed traffic sequence and the actual traffic sequence is compared, and the cosine similarity is defined as a measure of the difference between the constructed traffic sequence and the actual traffic sequence, and then the amplitude, period and phase with the maximum similarity value are selected as the frequency domain feature value of the traffic sequence, including: the frequency, period and delay time of the known type system accessing the specific domain name; in order to avoid timeout retransmission affecting the matching accuracy, the frequency domain feature also introduces a cooling time, that is, when a certain traffic feature is matched, the traffic sent to the same domain name within a few minutes thereafter is ignored; Step S22: When the target IP has multiple different externally accessed SNI server domain names, the training set is tested with the learned frequency features, sorted according to the accuracy, and assigned priorities. The higher the accuracy, the higher the priority. The frequency domain features of each different SNI server domain name are recorded and saved in the local feature library according to the priority.

4. The NAT local area network host detection method based on TLS traffic according to claim 3 is characterized in that: The step S3: analyzing and obtaining the frequency domain characteristics of the flow data to be detected, and storing the analysis results in a log, specifically includes: In the same manner as step S21, frequency domain features of all different SNI server domain names in the traffic data to be detected are extracted.

5. The NAT LAN host detection method based on TLS traffic according to claim 4 is characterized in that: Step S4: feature matching the analysis result with the local feature library, and inferring the number of active devices in the target IP according to the matching result; if the number of active devices is greater than 1, it is confirmed that the target IP is a public network IP of a NAT gateway device, corresponding to a target NAT local area network; further querying the local feature library to determine the device type of the host contained in the target IP address of the traffic data to be detected, specifically including: Step S41: Get the SNI server domain name accessed by the traffic to be analyzed in the local database, read the frequency domain features of the SNI server domain name in the log generated in step S3 in sequence, match and query it with all the rules defined in the configuration file of the local feature library, obtain the frequency domain features corresponding to the SNI server domain name, and query the number of visits to the SNI server domain name in the traffic to be analyzed within this time range according to the period in the frequency domain features as the time range, and the ratio of the number of visits to the SNI server domain name to the feature value in the local feature library is recorded as the activity of the SNI server domain name; Step S42: Calculate the activity of all SNI server domain names accessed in the traffic to be analyzed; and when there are multiple different externally accessed SNI server domain names in the traffic to be analyzed, calculate them in sequence according to the priority; and determine whether the IP address is a NAT translation address; if it is a NAT translation address, go to step S43; Step S43: For the activity calculated for all SNI server domain names visited in the traffic to be analyzed, further infer the number of hosts corresponding to each SNI server domain name in the target network; then, by classifying the number of hosts obtained in the above steps according to the device types corresponding to different SNI server domain names, the device type corresponding to the NAT conversion address and its corresponding number are obtained; after all analyses are completed, the final analysis result is output.

6. A NAT LAN host detection system based on TLS traffic, characterized in that: Includes the following modules: The traffic collection module is used to collect and parse TLS data packets in the target network, record the access characteristics of the TLS protocol in the ClientHello data packet, including: SNI, source IP, destination IP, source port, destination port, time, protocol type, and store them in the local database; wherein, the TLS data packet includes: analysis sample traffic data and traffic data to be detected; A local feature library module is constructed, which is used to construct a local feature library based on the inherent traffic frequency domain statistics of the known system in the analysis sample traffic data, and the corresponding relationship between the source IP and device type in the access feature and its SNI server domain name; A frequency domain feature acquisition module is used to analyze and obtain the frequency domain features of the flow data to be detected, and store the analysis results in a log; The analysis module is used to perform feature matching between the analysis result and the local feature library, and infer the number of active devices in the target IP according to the matching result; if the number of active devices is greater than 1, it is confirmed that the target IP is a public network IP of a NAT gateway device, corresponding to a target NAT local area network; by further querying the local feature library, the device type of the host contained in the target IP address of the traffic data to be detected is determined.

Images