NAT LAN host detection method and system based on TLS traffic

Abstract

The present invention proposes a NAT local area network (LAN) host detection method and system based on TLS traffic, belonging to the field of device auditing. The method comprises the following steps: S1: collecting and parsing TLS data packets in the target network, recording the access characteristics of the TLS protocol in the ClientHello data packets; S2: building a local feature library based on analyzing the inherent traffic frequency domain statistics of known systems in the sample traffic, as well as the correspondence between the source IP address, device type, and its SNI server domain name; S3: analyzing the frequency domain characteristics of the traffic data to be detected and storing them in a log; S4: performing feature matching on the analysis results with the local feature library, and inferring the number of active devices in the target IP address based on the matching results; determining whether the target network is a NAT LAN; and querying the local feature library to determine the device type of the host contained in the target IP address of the traffic to be detected. The method of the present invention can detect the device type of the host in the LAN formed by the NAT device.

Description

Technical Field

[0001] The present invention belongs to the field of equipment auditing, and in particular relates to a NAT local area network host detection method and system based on TLS traffic. Background Art

[0002] Network Address Translation (NAT) is a technology used by major carriers to alleviate IP address shortages. With NAT, a large number of hosts (typically within a local area network) can connect to the internet using a single or limited set of public IP addresses, allowing them to access the internet and utilize public internet services.

[0003] Therefore, NAT plays a crucial role in any network configuration. However, improper use can lead to security issues. NAT technology increases the difficulty of detecting malicious hosts within a local area network (LAN), leading to a need for NAT device auditing. However, in certain situations, traditional host identification and computation techniques may not meet these requirements, potentially leading to misjudgments. Therefore, how to identify and analyze network traffic while simultaneously handling the significant computational and data overhead becomes a pressing issue. Summary of the Invention

[0004] To solve the above technical problems, the present invention provides a NAT local area network host detection method based on TLS traffic, comprising the following steps:

[0005] Step S1: Collect and parse TLS data packets in the target network, record the access characteristics of the TLS protocol in the ClientHello data packet, including: SNI, source IP, destination IP, source port, destination port, time, protocol type, and store them in a local database; wherein, the TLS data packet includes: analysis sample traffic data and traffic data to be tested;

[0006] Step S2: constructing a local feature library based on the inherent traffic frequency domain statistics of the known system in the analyzed sample traffic data, and the correspondence between the source IP and device type in the access feature and its SNI server domain name;

[0007] Step S3: Analyze and obtain the frequency domain characteristics of the traffic data to be detected, and store the analysis results in a log;

[0008] Step S4: perform feature matching on the analysis result and the local feature library, and infer the number of active devices in the target IP based on the matching result; if the number of active devices is greater than 1, it is confirmed that the target IP is a public network IP of a NAT gateway device, corresponding to a target NAT local area network; by further querying the local feature library, determine the device type of the host contained in the target IP address of the traffic data to be detected.

[0009] Beneficial effects:

[0010] 1. The present invention proposes a novel NAT local area network host detection method based on TLS traffic characteristics. By analyzing the frequency domain characteristics of the inherent traffic of the system and the device through frequency domain conversion, the problem of unclear traffic data packet characteristics in the time domain is solved. The cosine similarity is used to match the frequency domain characteristics of the target IP with the rules defined in the local feature library. It can detect and identify whether the target IP address is the external IP address used by the NAT device, and analyze the number and device types of hosts in the constructed local area network.

[0011] 2. The present invention only uses the first message of the data packet to perform lightweight processing on the traffic, without the need to analyze more data packets. It can effectively reduce the overhead of data processing and the computational complexity, thereby solving problems such as network detection in high-bandwidth scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 A schematic flow chart of a NAT local area network host detection method based on TLS traffic according to the present invention;

[0013] Figure 2 The present invention is a structural block diagram of a NAT local area network host detection system based on TLS traffic. DETAILED DESCRIPTION

[0014] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only intended to illustrate the present invention and are not intended to limit the present invention. In addition, the technical features involved in the various embodiments of the present invention described below may be combined with each other as long as they do not conflict with each other.

[0015] Example 1

[0016] like Figure 1 As shown, an embodiment of the present invention provides a NAT local area network host detection method based on TLS traffic, comprising the following steps:

[0017] Step S1: Collect and parse TLS data packets in the target network, record the access characteristics of the TLS protocol in the ClientHello data packet, including: SNI, source IP, destination IP, source port, destination port, time, protocol type, and store them in a local database; wherein, the TLS data packet includes: analysis sample traffic data and traffic data to be tested;

[0018] Step S2: Build a local feature library based on the inherent traffic frequency domain statistics of the known system in the analyzed sample traffic data, as well as the corresponding relationship between the source IP in the access feature and its SNI server domain name;

[0019] Step S3: Analyze and obtain the frequency domain characteristics of the traffic data to be detected, and store the analysis results in a log;

[0020] Step S4: Perform feature matching on the analysis results and the local feature library, and infer the number of active devices in the target IP based on the matching results; if the number of active devices is greater than 1, it is confirmed that the target IP is a public IP of a NAT gateway device, corresponding to a target NAT LAN; further query the local feature library to determine the device type of the host contained in the target IP address of the traffic data to be detected.

[0021] In one embodiment, the above step S1: collects and parses TLS data packets in the target network, records the access characteristics of the TLS protocol in the ClientHello data packet, including: SNI, source IP, destination IP, source port, destination port, time, protocol type, and stores them in a local database; wherein the TLS data packet includes: analyzing sample traffic data and traffic data to be tested, specifically including:

[0022] The embodiment of the present invention captures data packets and parses traffic data packets based on DPDK and BPF technologies: first, the IP version of the data packet is confirmed, and the source address and destination address are stored, and then the data packet is checked to see if it is a TCP data packet; if it is, the port number is recorded and the type of the TCP data packet is checked according to the setting of the TCP flag; if the data packet contains a data payload, the possible HTTP or HTTPS request is further parsed, and the destination port is checked to see if it is 80 or 443, and then the payload is further checked to see if it contains a valid HTTP header or TLS Client Hello message; if the check is successful, the HTTP Request or ClientHello is parsed according to the payload content; for TLS traffic, only the SNI field of its ClientHello message is analyzed; the SNI, source IP, destination IP, request time, and protocol type of the TLS protocol in the ClientHello data packet are recorded and stored in a local database.

[0023] In order to reduce the data complexity during the processing, the present invention does not select multiple fields in the data packet as features, but only processes the first TCP packet after SYN, parses the HTTP Request or TLS ClientHello, records the access features of the TLS protocol in the data packet and stores them in the local database; and judges whether timeout retransmission and other behaviors occur based on the same basic information in the request data packet within a short period of time, and screens and deduplicates the requests.

[0024] In one embodiment, step S2 above: constructing a local feature library based on analyzing the inherent traffic frequency domain statistics of a known system in the sample traffic data, and the correspondence between the source IP address and device type in the access feature and its SNI server domain name, specifically includes:

[0025] Step S21: A frequency domain conversion algorithm is used to extract frequency domain features from the analyzed sample traffic data, namely, the number of times a known system accesses the SNI server domain name in external inherent traffic requests per unit time is counted, and the amplitude is defined to represent the magnitude of the change in the traffic sequence, the period to represent the time interval of repetition in the traffic sequence, and the phase to represent the starting point of a specific period. Assuming that the traffic is sent out according to a specific period, the amplitude, period, and phase are traversed in sequence, and the difference between the constructed traffic sequence and the actual traffic sequence is compared. The cosine similarity is defined as a measure of the difference between the constructed traffic sequence and the actual traffic sequence. The amplitude, period, and phase with the maximum similarity value are then selected as the frequency domain feature value of the traffic sequence, including: the frequency, period, and delay time of the known type system accessing the specific domain name. To avoid timeout retransmission affecting the matching accuracy, the frequency domain feature also introduces a cooling time, namely, when a traffic feature is matched, the traffic sent to the same domain name within the next few minutes is ignored.

[0026] Step S22: When the target IP has multiple different externally accessed SNI server domain names, the learned frequency features are tested on the training set, sorted according to the accuracy, and assigned priorities. The higher the accuracy, the higher the priority. For each different SNI server domain name, its frequency domain features are recorded and saved in the local feature library according to priority.

[0027] In this paper, system-specific external traffic is defined as normal requests for system updates, registration checks, and other requests sent by the system when no other operations are taking place. This method constructs a sequence of amplitude (number of transmissions, i.e., frequency), period, and phase (delay) within a certain range and performs cosine similarity matching with traffic sent by the device to identify the frequency domain characteristics of the system-specific traffic accessing a specific domain name.

[0028] An example of the frequency domain characteristics of a specific inherent flow is as follows:

[0029] System type: Windows 10

[0030] Priority: 100

[0031] Access domain name: download.windowsupdate.com

[0032] Cycle: 1440 minutes

[0033] Number of times sent: 2 times

[0034] Delay time: None

[0035] Cooling time: 10 minutes.

[0036] In one embodiment, the above step S3: analyzing and obtaining the frequency domain characteristics of the traffic data to be detected, and storing the analysis results in a log, specifically includes:

[0037] In the same manner as step S21 , frequency domain features of all different SNI server domain names in the traffic data to be detected are extracted.

[0038] In one embodiment, the above step S4: performing feature matching on the analysis result and the local feature library, and inferring the number of active devices in the target IP based on the matching result; if the number of active devices is greater than 1, it is confirmed that the target IP is a public network IP of a NAT gateway device, corresponding to a target NAT local area network; further querying the local feature library to determine the device type of the host contained in the target IP address of the traffic data to be detected, specifically including:

[0039] Step S41: Obtain the SNI server domain name accessed by the traffic to be analyzed in the local database, sequentially read the frequency domain features of the SNI server domain name in the log generated in step S3, match them with all rules defined in the configuration file of the local feature library, obtain the frequency domain features corresponding to the SNI server domain name, use the period in the frequency domain features as the time range, query the number of visits to the SNI server domain name in the traffic to be analyzed within this time range, and record the ratio of the number of visits to the feature value in the local feature library as the activity level of the SNI server domain name;

[0040] For example, if the traffic to be analyzed includes inherent traffic that accesses SNI server domain names such as download.windowsupdate.com, the frequency domain features of the SNI server domain names such as download.windowsupdate.com in the log generated in step S3 are read in sequence, and the corresponding SNI server domain name rules in the configuration file of the local feature library are queried in sequence. A similarity matching query is performed on the frequency domain features defined by the rules using cosine similarity. If a match is successful, the period of the frequency domain features is used as the time range, and the number of visits to SNI server domain names such as download.windowsupdate.com in the traffic to be analyzed within this time range is queried as t1. The amplitude of the corresponding SNI server domain names such as download.windowsupdate.com in the configuration file of the local feature library is recorded as t2 (number of transmissions). The ratio of t1 to t2 (t1 / t2) is calculated to obtain the activity corresponding to the download.windowsupdate.com domain name. If the match fails, the current SNI server domain name is skipped and the calculation of the next SNI server domain name in the configuration file of the local feature library continues.

[0041] Step S42: Calculate the activity of all SNI server domain names accessed in the traffic to be analyzed. If there are multiple different externally accessed SNI server domain names in the traffic to be analyzed, calculate them in order of priority. Based on this, determine whether the IP address is a NAT-translated address. If it is a NAT-translated address, proceed to step S43.

[0042] For example, if traffic initiated from a certain IP address includes both the download.windowsupdate.com field and motd.ubuntu.com, it is inferred that the IP address is the public IP address of a NAT gateway device; and the NAT LAN corresponding to the IP address contains at least a host running the Windows operating system and a host running the Ubuntu operating system.

[0043] Step S43: Based on the activity calculated for all SNI server domain names accessed in the traffic to be analyzed, the number of hosts corresponding to each SNI server domain name in the target network is further inferred. Subsequently, the number of hosts obtained in the above step is classified according to the device type corresponding to different SNI server domain names to obtain the device type and corresponding number corresponding to the NAT translation address. After all analyses are completed, the final analysis results are output.

[0044] Example 2

[0045] like Figure 2As shown, an embodiment of the present invention provides a NAT local area network host detection system based on TLS traffic, including the following modules:

[0046] Traffic collection module 51 is used to collect and parse TLS data packets in the target network, record the access characteristics of the TLS protocol in the ClientHello data packet, including: SNI, source IP, destination IP, source port, destination port, time, protocol type, and store them in a local database; wherein, the TLS data packet includes: analysis sample traffic data and traffic data to be tested;

[0047] A local feature library building module 52 is used to build a local feature library based on the inherent traffic frequency domain statistics of the known system in the analysis sample traffic data, and the correspondence between the source IP and device type in the access feature and its SNI server domain name;

[0048] The frequency domain feature acquisition module 53 is used to analyze and obtain the frequency domain features of the flow data to be detected, and store the analysis results in a log;

[0049] The analysis module 54 is used to perform feature matching between the analysis results and the local feature library, and infer the number of active devices in the target IP based on the matching results; if the number of active devices is greater than 1, it is confirmed that the target IP is a public network IP of a NAT gateway device, corresponding to a target NAT local area network; by further querying the local feature library, the device type of the host contained in the target IP address of the traffic data to be detected is determined.

Claims

1. A NAT local area network host detection method based on TLS traffic, characterized in that: include: Step S1: Collect and parse TLS data packets in the target network, record the access characteristics of the TLS protocol in the ClientHello data packet, including: SNI, source IP, destination IP, source port, destination port, time, protocol type, and store them in a local database; wherein, the TLS data packet includes: analysis sample traffic data and traffic data to be tested; Step S2: constructing a local feature library based on the inherent traffic frequency domain statistics of the known system in the analyzed sample traffic data, and the correspondence between the source IP and device type in the access feature and its SNI server domain name; Step S3: Analyze and obtain the frequency domain characteristics of the traffic data to be detected, and store the analysis results in a log; Step S4: perform feature matching on the analysis result and the local feature library, and infer the number of active devices in the target IP based on the matching result; if the number of active devices is greater than 1, it is confirmed that the target IP is a public network IP of a NAT gateway device, corresponding to a target NAT local area network; by further querying the local feature library, determine the device type of the host contained in the target IP address of the traffic data to be detected.

2. The NAT local area network host detection method based on TLS traffic according to claim 1, characterized in that: Step S1: Collect and parse TLS data packets in the target network, record the access characteristics of the TLS protocol in the ClientHello data packet, including: SNI, source IP, destination IP, source port, destination port, time, protocol type, and store them in a local database; wherein, the TLS data packet includes: analyzing sample traffic data and traffic data to be tested, specifically including: Parsing traffic data packets: First, confirm the IP version of the data packet and store the source and destination addresses, then check whether the data packet is a TCP data packet; if it is, record the port number and check the type of TCP data packet according to the setting of the TCP flag; if the data packet contains a data payload, further parse the possible HTTP or HTTPS request, check whether the destination port is 80 or 443, and then further check the payload to confirm whether it contains a valid HTTP header or TLS Client Hello message; if the check is successful, parse the HTTP Request or Client Hello according to the payload content; for TLS traffic, only analyze the SNI field of its Client Hello message; record the SNI, source IP, destination IP, request time, and protocol type of the TLS protocol in the Client Hello data packet and store them in the local database.

3. The NAT local area network host detection method based on TLS traffic according to claim 2, characterized in that: Step S2: constructing a local feature library based on the inherent traffic frequency domain statistics of the known system in the analyzed sample traffic data, and the correspondence between the destination IP and device type in the access feature and its SNI server domain name, specifically includes: Step S21: A frequency domain conversion algorithm is used to extract frequency domain features from the analyzed sample traffic data, namely, the number of times a known system accesses the SNI server domain name in external inherent traffic requests per unit time is counted, and the amplitude is defined to represent the magnitude of the change in the traffic sequence, the period to represent the time interval of repetition in the traffic sequence, and the phase to represent the starting point of a specific period. Assuming that the traffic is sent out according to a specific period, the amplitude, period, and phase are traversed in sequence, and the difference between the constructed traffic sequence and the actual traffic sequence is compared. The cosine similarity is defined as a measure of the difference between the constructed traffic sequence and the actual traffic sequence. The amplitude, period, and phase with the maximum similarity value are then selected as the frequency domain feature value of the traffic sequence, including: the frequency, period, and delay time of the known type system accessing the specific domain name. To avoid timeout retransmission affecting the matching accuracy, the frequency domain feature also introduces a cooling time, namely, when a traffic feature is matched, the traffic sent to the same domain name within the next few minutes is ignored. Step S22: When the target IP has multiple different externally accessed SNI server domain names, the learned frequency features are tested on the training set, sorted according to the accuracy, and assigned priorities. The higher the accuracy, the higher the priority. For each different SNI server domain name, its frequency domain features are recorded and saved in the local feature library according to priority.

4. The NAT local area network host detection method based on TLS traffic according to claim 3 is characterized in that: The step S3: analyzing and obtaining the frequency domain characteristics of the flow data to be detected, and storing the analysis results in a log, specifically includes: In the same manner as step S21 , frequency domain features of all different SNI server domain names in the traffic data to be detected are extracted.

5. The NAT local area network host detection method based on TLS traffic according to claim 4 is characterized in that: Step S4: matching the analysis result with the local feature library, and inferring the number of active devices in the target IP based on the matching result; if the number of active devices is greater than 1, it is confirmed that the target IP is a public network IP of a NAT gateway device, corresponding to a target NAT local area network; further querying the local feature library to determine the device type of the host contained in the target IP address of the traffic data to be detected, specifically including: Step S41: Obtain the SNI server domain name accessed by the traffic to be analyzed in the local database, sequentially read the frequency domain features of the SNI server domain name in the log generated in step S3, match them with all rules defined in the configuration file of the local feature library, obtain the frequency domain features corresponding to the SNI server domain name, use the period in the frequency domain features as the time range, query the number of visits to the SNI server domain name in the traffic to be analyzed within this time range, and record the ratio of the number of visits to the feature value in the local feature library as the activity level of the SNI server domain name; Step S42: Calculate the activity of all SNI server domain names accessed in the traffic to be analyzed. If there are multiple different externally accessed SNI server domain names in the traffic to be analyzed, calculate them in order of priority. Determine whether the IP address is a NAT-translated address. If it is a NAT-translated address, proceed to step S43. Step S43: Based on the calculated activity of all SNI server domain names accessed in the traffic to be analyzed, the number of hosts corresponding to each SNI server domain name in the target network is further inferred. Subsequently, the number of hosts obtained in the above step is classified according to the device type corresponding to different SNI server domain names to obtain the device type and corresponding number corresponding to the NAT conversion address. After all analyses are completed, the final analysis results are output.

6. A NAT local area network host detection system based on TLS traffic, characterized in that: Includes the following modules: The traffic collection module is used to collect and parse TLS data packets in the target network, record the access characteristics of the TLS protocol in the ClientHello data packet, including: SNI, source IP, destination IP, source port, destination port, time, protocol type, and store them in the local database; wherein, the TLS data packet includes: analysis sample traffic data and traffic data to be tested; A local feature library module is constructed, which is used to construct a local feature library based on the inherent traffic frequency domain statistics of the known system in the analyzed sample traffic data, and the correspondence between the source IP and device type in the access feature and its SNI server domain name; A frequency domain feature acquisition module is used to analyze and obtain the frequency domain features of the flow data to be detected, and store the analysis results in a log; The analysis module is used to perform feature matching between the analysis results and the local feature library, and infer the number of active devices in the target IP based on the matching results; if the number of active devices is greater than 1, it is confirmed that the target IP is a public network IP of a NAT gateway device, corresponding to a target NAT local area network; by further querying the local feature library, the device type of the host contained in the target IP address of the traffic data to be detected is determined.

Images