Encrypted traffic capture and security event analysis method and device, equipment and medium

Abstract

The invention discloses an encrypted traffic capture and security event analysis method, device, equipment and medium, and relates to the technical field of network communication and information security, a data security protection system is constructed, a probe service is deployed at a server side of a TLS encryption application, and an eBPF technology is utilized to capture TLS encrypted traffic in a network stack of an operating system; the probe service obtains the decrypted data from the memory and generates the decrypted data into a persistent file; and taking the probe service as a gRPC client, triggering a reporting mechanism when the persistent file reaches a preset standard, and transmitting the persistent file to a remote data mobility security management system through a gRPC protocol. The TLS decryption problem is solved through non-intrusive deployment, the eBPF does not depend on any change of a specific protocol stack or an application layer when operating and capturing TLS flow and session data in a kernel mode, and particularly, deployment in a dynamically expanded distributed system is more flexible, application codes do not need to be modified, and probe services without intrusive influence are deployed at low cost.

Description

Technical Field

[0001] The present invention relates to the field of network communication technology and information security technology, and in particular to a method, device, equipment and medium for capturing encrypted traffic and analyzing security events. Background Art

[0002] With the popularization of Internet communication and the enhancement of users' privacy awareness, HTTPS has become the mainstream encrypted transmission protocol. A large amount of traffic is encrypted using TLS (Transport Layer Security). According to statistics, TLS 1.2 accounts for most of the HTTPS traffic, but the application ratio of TLS 1.3 is rising rapidly. TLS 1.3 introduces a number of optimizations, such as a faster handshake process, a stronger default encryption algorithm, and a more secure key negotiation mechanism. Compared with TLS 1.2, TLS 1.3 deletes the RSA key exchange and fully adopts forward-secrecy-based key negotiation methods such as ECDHE, which significantly improves security. However, it also brings challenges to existing traffic decryption and analysis methods. Taking the mainstream open source packet analysis software Wireshark as an example, when appropriate confidentiality is provided, Wireshark supports TLS decryption. The three available methods are: (1) using the key log file of each session secret; (2) decrypting using the RSA private key; and (3) decrypting using the pre-shared key (PSK).

[0003] In the prior art, the data decryption and analysis modules are integrated, but there is a lack of effective coordination between the decryption and subsequent analysis processes. The work is mainly focused on the security event client (such as HTTPS server), and there are the following defects: 1. Single function: limited to plaintext message parsing and completing a single specific function. All work is focused on the client, which consumes the client's computing resources and is not conducive to iteration and expansion, and has a limited scope of use; 2. Lack of systematic security analysis and response capabilities: Existing technologies usually only focus on the capture and decryption of traffic, lack in-depth analysis of decrypted data and security incident response mechanisms. For example, many solutions fail to provide a complete process from data capture to security incident detection and alerting, lack the extraction of specific protocol fields, malicious behavior identification and automated response, which limits the application scope of existing technologies to simple monitoring and interception; 3. Insufficient scalability and flexibility: In the existing technology, the traffic capture and decryption process is concentrated locally, which not only increases the pressure on local system resources, but also limits the scalability and adaptability of the solution. In modern complex distributed environments, single-point traffic capture and processing may not meet the needs of high concurrency and large-scale distributed deployment, affecting the elasticity and scalability of the system. Summary of the invention

[0004] The purpose of the present invention is to provide a method, device, equipment and medium for capturing encrypted traffic and analyzing security events to solve the problems raised in the above-mentioned background technology.

[0005] In order to solve the above technical problems, the technical solution adopted by the present invention is: In the first aspect, the encrypted traffic capture and security event analysis method comprises the following steps: S1. Build a data security protection system, deploy a probe service on the server side of the TLS encryption application, and use eBPF technology to capture TLS encrypted traffic in the network stack of the operating system; S2. The probe service obtains the decrypted data from the memory and generates it as a persistent file; S3. Use the probe service as a gRPC client. When the persistent file reaches the preset standard, the reporting mechanism is triggered and the persistent file is transmitted to the remote data liquidity security management system through the gRPC protocol. S4. Use the remote data liquidity security management system as the gRPC server to further extract protocol fields and perform security analysis on the decrypted HTTP data to detect potential security threats in the traffic. S5. After the remote server completes the data analysis, it generates real-time alerts based on the analysis results and responds to potential security incidents.

[0006] A further improvement of the technical solution of the present invention is that: the data security protection system includes a probe device and a remote security analysis device; The probe device is deployed on a server supporting the TLS protocol, and captures TLS decrypted data through eBPF; The remote security analysis device is used to receive the decrypted message file transmitted by the probe device, perform in-depth analysis on the data, and generate a security alarm.

[0007] A further improvement of the technical solution of the present invention is that in S1, the process of capturing TLS encrypted traffic specifically includes: Build a data security protection system, analyze the server operating system environment to support eBPF technology, and evaluate server performance to ensure that there are sufficient resources to support the running of eBPF programs and the capture of TLS traffic, and then install the eBPF tool chain; Deploy a probe service on an application server that supports the TLS protocol and load the eBPF program, wherein the probe service includes the eBPF program, which is designed to hook at a specific location in the network stack to monitor and capture TLS traffic in network communications; When TLS encrypted traffic passes through the server's network stack, the eBPF program hooks into TLS-related function call points in the operating system kernel state through the uprobe mechanism, thereby identifying and capturing data packets of TLS encrypted traffic, extracting metadata of TLS data packets through the eBPF program, and passing it to the probe service through the communication mechanism between user space and kernel space; The encrypted content in the TLS data packet is decoded using the relevant fields in the TLS protocol, including the certificate chain and encryption suite information, to restore the original plaintext data. This process is completed in the kernel state, with high efficiency and low performance overhead, and the decrypted TLS message data is restored to a plaintext message, where the message can contain Web requests, response headers, Cookies, URLs, POST data, etc., providing detailed network communication information.

[0008] A further improvement of the technical solution of the present invention is that in S2, the process of generating a persistent file specifically includes: The probe service is used to obtain the decrypted plaintext data from the memory, and the selection of persistent file generation is performed according to the computing power of the security monitoring node and the function of the data liquidity security management system, and then the persistent file is generated and stored on the disk; The disk message is selected according to the configuration parameters, and the decrypted data is written to the specified persistent file.

[0009] A further improvement of the technical solution of the present invention is that in S3, the process of triggering the reporting mechanism specifically includes: When the probe service starts, it loads the gRPC client configuration file, which contains the address, port and other information of the remote server, and initializes the gRPC client to establish a connection with the remote data liquidity security management system, ensuring that the gRPC client is configured correctly and can successfully connect to the remote server; The probe service scans the local persistent file directory and checks whether the persistent file time and size reach the preset standard threshold; When the number of persistent files reaches the preset standard threshold, the probe service triggers the reporting mechanism and prepares to report data, including the list of files to be transferred and file information; The persistent file is transmitted to the remote data liquidity security management system in the form of a stream through the gRPC connection. After receiving the persistent file, the remote data liquidity security management system sends a confirmation message to the probe service. After receiving the confirmation message, the probe service performs file cleanup operations, such as deleting the transferred file, updating the file status, etc.

[0010] A further improvement of the technical solution of the present invention is that in S4, the process of detecting potential security threats in traffic specifically includes: The gRPC server receives encrypted data from the probe service through the established gRPC connection, ensures the stability and reliability of the gRPC connection, avoids data loss or transmission errors, and uses the preset decryption algorithm and key to decrypt the received encrypted data to restore the original data for subsequent protocol field extraction and security analysis; Parse the decrypted data and extract the key information of the request header, request body, response header, and response body. The key information includes URL, request method, request parameters, response status code, and response content, etc., to ensure the accuracy and completeness of the protocol field extraction and avoid missing key information. Perform security analysis on the extracted protocol fields to detect potential security threats in the traffic, including malicious requests, data leakage, DDoS attacks, etc., including detecting malicious request features, analyzing traffic patterns, identifying abnormal or suspicious behaviors, and checking response content to ensure that no sensitive information is leaked.

[0011] A further improvement of the technical solution of the present invention is that in S5, the process of generating the real-time alarm specifically includes: Use predefined security rule sets to analyze extracted protocol fields and detect potential security threats. Security rules include malicious request characteristics, traffic pattern analysis, and response content inspection. Combined with historical data, analyze normal behavior and identify requests that deviate from normal behavior. Take appropriate threat response measures based on the results of security analysis. If malicious attacks or abnormal behaviors are detected, the attack source can be immediately blocked and relevant logs and alarm information can be recorded. If further investigation or processing is required, the relevant information can be sent to the administrator for subsequent processing to ensure the timeliness and effectiveness of threat response, avoid the spread and escalation of security threats, and record detailed logs and alarm information for subsequent analysis and auditing; When the data analysis results meet the set alarm conditions, the system automatically generates alarm information, which includes the alarm type, trigger conditions, occurrence time and recommended response measures, and distributes the alarm information to administrators through multiple channels such as email, SMS and push notifications.

[0012] In a second aspect, a probe device for implementing the encrypted traffic capture and security event analysis method is used to implement the encrypted traffic capture and security event analysis method, including an eBPF program module, a message restoration module, a storage module, and a communication module, wherein the modules are connected by electrical signals; The eBPF program module is used to capture decrypted data of TLS traffic; The message restoration module is used to convert the captured data into the original protocol format; The storage module is used to store the restored message as a persistent file; The communication module is used to send the persistent file to the remote security analysis system through the gRPC protocol.

[0013] In a third aspect, a remote security analysis device is used to implement a probe device for implementing the encrypted traffic capture and security event analysis method, comprising a receiving module, an analysis module and an alarm module, wherein the modules are connected by electrical signals; The receiving module is used to receive a persistent message file transmitted by the probe device; The analysis module is used to extract fields and conduct in-depth analysis on message files to detect potential security threats; The alarm module is used to generate security event alarm information.

[0014] In a fourth aspect, a computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the encrypted traffic capture and security event analysis method is implemented.

[0015] Due to the adoption of the above technical solution, the present invention has the following technical advances compared with the prior art: The present invention provides a method, device, equipment and medium for capturing encrypted traffic and analyzing security events, which solves the TLS decryption problem through non-invasive deployment, utilizes eBPF to operate in kernel state, and does not rely on any changes to a specific protocol stack or application layer when capturing TLS traffic and session data. In particular, it is more flexible to deploy in a dynamically expanding distributed system, does not require modification of application code, and can deploy probe services with no invasive impact at a low cost.

[0016] The present invention provides a method, device, equipment and medium for capturing encrypted traffic and analyzing security events. The capture and analysis functions are decoupled through a distributed design and a distributed architecture design is adopted, which reduces the dependence on local performance while improving scalability and flexibility.

[0017] The present invention provides a method, device, equipment and medium for capturing encrypted traffic and analyzing security events, which transmits data through gRPC, avoids direct exposure of sensitive information, and improves the security and compliance of the system.

[0018] The present invention provides a method, device, equipment and medium for capturing encrypted traffic and analyzing security incidents, supports a distributed architecture, can flexibly adapt to cloud-native environments and large-scale deployments, provides higher scalability than traditional stand-alone or local solutions, performs data transmission through gRPC, avoids direct reliance on a decryption buffer, and supports deployment requirements in multi-tenant and distributed environments.

[0019] The present invention provides encrypted traffic capture and security incident analysis methods, devices, equipment and media, covering the complete process from traffic capture, decryption to field extraction and security incident alarm, and can adapt to multiple scenario requirements such as traffic analysis, threat detection and compliance auditing. Compared with traditional patents limited to traffic capture, it has increased practical value. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0021] Figure 1 It is a schematic diagram of the workflow of the present invention. DETAILED DESCRIPTION

[0022] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0023] Embodiment 1, as Figure 1 As shown, the present invention provides a method for capturing encrypted traffic and analyzing security events, comprising the following steps: Build a data security protection system, deploy a probe service on the server side of the TLS encrypted application, use eBPF technology to capture TLS encrypted traffic in the network stack of the operating system, confirm whether the application server where the probe service is deployed supports eBPF technology, deploy the probe service on the application server that supports the TLS protocol, and load the eBPF program. The probe service includes an eBPF program, which is designed to be hooked at a specific location in the network stack to monitor and capture TLS traffic in network communications. When TLS encrypted traffic passes through the server's network stack, the eBPF program hooks to TLS-related function call points in the kernel state of the operating system through the uprobe mechanism, specifically hooking the two user-state functions SSL_write and SSL_read, thereby identifying and capturing data packets of TLS encrypted traffic, extracting the metadata of the TLS data packet through the eBPF program, and passing it to the probe service through the communication mechanism between the user space and the kernel space, and restoring the original HTTP plaintext data. This process is completed in the kernel state, with high efficiency and low performance overhead, and the decrypted TLS message data is restored to a plaintext HTTP message. , where HTTP messages can contain Web requests, response headers, Cookies, URLs, POST data, etc., providing detailed network communication information; the probe service periodically obtains decrypted data from the memory and generates it as a persistent file; the probe service is used as a gRPC client, and when the persistent file reaches the preset standard, the reporting mechanism is triggered, and the persistent file is transmitted to the remote data liquidity security management system through the gRPC protocol; the remote data liquidity security management system is used as a gRPC server to further extract protocol fields and perform security analysis on the decrypted HTTP data to detect potential security threats in the traffic; after the remote server completes the data analysis, a real-time alarm is generated based on the analysis results, and a response is made to potential security incidents. The encrypted traffic capture and security incident analysis method uses eBPF technology to directly capture the decrypted data of TLS traffic from the server-side kernel state, realizes a transparent decryption process, avoids the high overhead and data loss problems of traditional user-state packet capture, and retains the complete data context by losslessly restoring TLS traffic to the original protocol format (such as HTTP message), providing high-quality input for in-depth security analysis; supports TLS 1.2 and TLS 1.3 protocol decryption, solving the problem of forward secrecy (PFS) in TLS 1.3 protocol causing the failure of traditional decryption solutions, integrating persistent storage and gRPC transmission, optimizing data flow efficiency in distributed environments, adapting to large-scale traffic analysis needs, and combining with remote security analysis systems to identify potential security threats in real time and generate event alerts through field extraction and in-depth analysis; The data security protection system includes probe devices and remote security analysis equipment; The probe device is deployed on the server side that supports the TLS protocol, and captures TLS decrypted data through eBPF; The remote security analysis device is used to receive the decrypted message files transmitted by the probe device, conduct in-depth analysis of the data, and generate security alarms.

[0024] Embodiment 2, as Figure 1 As shown, based on Example 1, the present invention provides a technical solution: Preferably, the process of generating a persistent file specifically includes: The probe service is used to obtain the decrypted HTTP plaintext data from the memory, and the selection of persistent file generation is made according to the computing power of the security monitoring node and the function of the data liquidity security management system, and then the persistent file is generated and stored on the disk. Among them, the selection of persistent file generation is specifically two ways: directly outputting the decrypted HTTP byte stream to the pcapng file; for directly outputting the decrypted HTTP byte stream to the pcapng file, it requires the monitoring node to consume more resources and rewrite the original message sub-throttling to output it to the pcapng file. The requirements for the data liquidity security management system are: low requirements, and it is sufficient to analyze HTTP traffic security events, select the disk-stored messages according to the configuration parameters, and then write the decrypted data to the specified persistent file. Taking HTTPS traffic as an example, the FULL mode processes all qualified messages, including TCP handshake, TLS key negotiation, information interaction, etc. The SIMPLE mode only processes truly valid traffic messages and only stores the decrypted HTTP messages on the disk, which can effectively reduce the file size; The process of triggering the reporting mechanism specifically includes: When the probe service starts, it loads the gRPC client configuration file, which contains the address, port and other information of the remote server, and initializes the gRPC client to establish a connection with the remote data liquidity security management system to ensure that the gRPC client is configured correctly and can successfully connect to the remote server. The probe service scans the local persistent file directory and checks whether the persistent file time and size reach the preset standard threshold. When the persistent file reaches the preset standard threshold, the probe service triggers the reporting mechanism and prepares to report data, including the list of files to be transferred and file information. The persistent file is transmitted to the remote data liquidity security management system in the form of a stream through the gRPC connection. After receiving the persistent file, the remote data liquidity security management system sends a confirmation message to the probe service. After receiving the confirmation message, the probe service performs file cleanup operations, such as deleting the transferred files and updating the file status. The process of detecting potential security threats in traffic includes: The gRPC server receives encrypted HTTP data from the probe service through the established gRPC connection, ensures the stability and reliability of the gRPC connection, avoids data loss or transmission errors, and uses the preset decryption algorithm and key to decrypt the received encrypted data to restore the original HTTP data for subsequent protocol field extraction and security analysis. The decrypted HTTP data is parsed to extract key information of the request header, request body, response header, and response body, including URL, request method, request parameters, response status code, and response content, etc., to ensure the accuracy and completeness of the protocol field extraction, avoid missing key information, perform security analysis on the extracted protocol fields, and detect potential security threats in the traffic, including malicious requests, data leakage, DDoS attacks, etc., including detecting malicious request characteristics, analyzing traffic patterns, identifying abnormal or suspicious behaviors, and checking the response content to ensure that no sensitive information is leaked; The real-time alarm generation process specifically includes: The extracted protocol fields are analyzed using a predefined set of security rules to detect potential security threats. The security rules include malicious request characteristics, traffic pattern analysis, and response content inspection. The normal behavior is analyzed in combination with historical data to identify requests that deviate from normal behavior. According to the results of the security analysis, appropriate threat response measures are taken. If a malicious attack or abnormal behavior is detected, the attack source can be immediately blocked and relevant log and alarm information can be recorded. If further investigation or processing is required, the relevant information can be sent to the administrator for subsequent processing to ensure the timeliness and effectiveness of the threat response and avoid the spread and escalation of security threats. Detailed log and alarm information is recorded for subsequent analysis and auditing. When the data analysis results meet the set alarm conditions, the system automatically generates alarm information, which includes the alarm type, trigger condition, occurrence time, and recommended response measures, and distributes the alarm information to the administrator through multiple channels such as email, SMS, and push notifications.

[0025] Embodiment 3, as Figure 1 As shown, on the basis of Embodiment 1-2, the present invention further provides a probe device for implementing the encrypted traffic capture and security event analysis method, which is used to implement the encrypted traffic capture and security event analysis method, including an eBPF program module, a message restoration module, a storage module and a communication module, wherein the modules are connected by electrical signals; eBPF program module to capture decrypted data of TLS traffic; Message restoration module, used to convert captured data into the original protocol format; A storage module, used to store the restored message as a persistent file; The communication module is used to send persistent files to the remote security analysis system through the gRPC protocol; In addition, a remote security analysis device is provided, which is a probe device for implementing a method for capturing encrypted traffic and analyzing security events, comprising a receiving module, an analyzing module, and an alarm module, wherein the modules are electrically connected to each other; A receiving module, used for receiving a persistent message file transmitted by a probe device; The analysis module is used to extract fields and conduct in-depth analysis on message files to detect potential security threats; An alarm module is used to generate security event alarm information; Furthermore, a computer-readable storage medium stores a computer program thereon, which, when executed by a processor, implements a method for capturing encrypted traffic and analyzing security events; Generally speaking, the computer instructions for implementing the method of the present invention can be carried by any combination of one or more computer-readable storage media. The computer-readable storage medium can include any computer-readable medium except the signal itself that is temporarily propagating.

[0026] Computer readable storage media can be, for example, but not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or components, or any combination thereof. More specific examples (non-exhaustive list) of computer readable storage media include: an electrical connection with one or more conductors, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In this document, a computer readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, device, or device.

[0027] Computer program codes for performing the operations of the present invention may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages, in particular, Python suitable for neural network computing and platform frameworks based on TensorFlow, PyTorch, etc. may be used. The program code may be executed entirely on the user's computer, partially on the user's computer, as an independent software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer, or to an external computer (e.g., connected via the Internet using an Internet service provider) through any type of network, including a local area network (LAN) or a wide area network (WAN).

[0028] The above-mentioned computer-readable storage medium can refer to the implementation content and beneficial effects of the method mentioned above, which will not be repeated here.

[0029] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. Encrypted traffic capture and security incident analysis method, characterized in that: The following steps are involved: S1. Build a data security protection system, deploy a probe service on the server side of the TLS encryption application, and use eBPF technology to capture TLS encrypted traffic in the network stack of the operating system; S2. The probe service obtains the decrypted data from the memory and generates it as a persistent file; S3. Use the probe service as a gRPC client. When the persistent file reaches the preset standard, the reporting mechanism is triggered and the persistent file is transmitted to the remote data liquidity security management system through the gRPC protocol. S4. Use the remote data liquidity security management system as the gRPC server to further extract protocol fields and perform security analysis on the decrypted data to detect potential security threats in the traffic. S5. After the remote server completes the data analysis, it generates real-time alerts based on the analysis results and responds to potential security incidents.

2. The method for capturing encrypted traffic and analyzing security events according to claim 1, characterized in that: The data security protection system includes a probe device and a remote security analysis device; The probe device is deployed on a server supporting the TLS protocol, and captures TLS decrypted data through eBPF; The remote security analysis device is used to receive the decrypted message file transmitted by the probe device, perform in-depth analysis on the data, and generate a security alarm.

3. The method for capturing encrypted traffic and analyzing security events according to claim 2, characterized in that: In S1, the process of capturing TLS encrypted traffic specifically includes: Confirm whether the application server where the probe service is deployed supports eBPF technology; Deploy a probe service on an application server that supports the TLS protocol and load the eBPF program, wherein the probe service includes the eBPF program; When TLS encrypted traffic passes through the server's network stack, the eBPF program hooks into TLS-related function call points in the operating system kernel state through the uprobe mechanism, thereby identifying and capturing data packets of TLS encrypted traffic, extracting metadata of TLS data packets through the eBPF program, and passing it to the probe service through the communication mechanism between user space and kernel space; The encrypted content in the TLS data packet is decoded using the relevant fields in the TLS protocol, including the certificate chain and encryption suite information, to restore the original plaintext data, and then the decrypted TLS message data is restored to the plaintext message.

4. The method for capturing encrypted traffic and analyzing security events according to claim 3, characterized in that: In S2, the process of generating a persistent file specifically includes: The probe service is used to obtain the decrypted plaintext data from the memory, and the selection of persistent file generation is performed according to the computing power of the security monitoring node and the function of the data liquidity security management system, and then the persistent file is generated and stored on the disk; The disk message is selected according to the configuration parameters, and the decrypted data is written to the specified persistent file.

5. The method for capturing encrypted traffic and analyzing security events according to claim 4, characterized in that: In S3, the process of triggering the reporting mechanism specifically includes: When the probe service starts, it loads the gRPC client configuration file, initializes the gRPC client, and establishes a connection with the remote data liquidity security management system; The probe service scans the local persistent file directory and checks whether the persistent file time and size reach the preset standard threshold; When the number of persistent files reaches the preset standard threshold, the probe service triggers the reporting mechanism and prepares to report data, including the list of files to be transferred and file information; The persistent file is transmitted to the remote data liquidity security management system in the form of a stream through the gRPC connection. After receiving the persistent file, the remote data liquidity security management system sends a confirmation message to the probe service. After receiving the confirmation message, the probe service performs the file cleanup operation.

6. The method for capturing encrypted traffic and analyzing security events according to claim 5, characterized in that: In S4, the process of detecting potential security threats in traffic specifically includes: The gRPC server receives the encrypted data from the probe service through the established gRPC connection, and decrypts the received encrypted data using the preset decryption algorithm and key to restore the original data; Parse the decrypted data and extract the key information of the request header, request body, response header and response body, where the key information includes URL, request method, request parameters, response status code and response content; Perform security analysis on the extracted protocol fields to detect potential security threats in the traffic, including malicious requests, data leakage, and DDoS attacks. Among them, detect malicious request characteristics, analyze traffic patterns, identify abnormal or suspicious behaviors, and check the response content to ensure that no sensitive information is leaked.

7. The method for capturing encrypted traffic and analyzing security events according to claim 6, characterized in that: In S5, the real-time alarm generation process specifically includes: Use predefined security rule sets to analyze extracted protocol fields and detect potential security threats. Security rules include malicious request characteristics, traffic pattern analysis, and response content inspection. Combined with historical data, analyze normal behavior and identify requests that deviate from normal behavior. Take appropriate threat response measures based on the results of security analysis. If malicious attacks or abnormal behaviors are detected, the attack source can be immediately blocked and relevant logs and alarm information can be recorded. If further investigation or processing is required, the relevant information can be sent to the administrator for follow-up processing, and detailed logs and alarm information can be recorded; When the data analysis results meet the set alarm conditions, the system automatically generates alarm information, which includes the alarm type, trigger conditions, occurrence time and recommended response measures, and distributes the alarm information to administrators through multiple channels such as email, SMS and push notifications.

8. A probe device for implementing the encrypted traffic capture and security event analysis method, used to implement the encrypted traffic capture and security event analysis method as described in any one of claims 1 to 7, characterized in that: It includes an eBPF program module, a message restoration module, a storage module, and a communication module, wherein the modules are connected by electrical signals; The eBPF program module is used to capture decrypted data of TLS traffic; The message restoration module is used to convert the captured data into the original protocol format; The storage module is used to store the restored message as a persistent file; The communication module is used to send the persistent file to the remote security analysis system through the gRPC protocol.

9. A remote security analysis device, used to implement the probe device for implementing the encrypted traffic capture and security event analysis method of claim 8, characterized in that: It includes a receiving module, an analyzing module and an alarm module, wherein the modules are connected by electrical signals; The receiving module is used to receive a persistent message file transmitted by the probe device; The analysis module is used to extract fields and conduct in-depth analysis on message files to detect potential security threats; The alarm module is used to generate security event alarm information.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the encrypted traffic capture and security event analysis method as described in any one of claims 1 to 7 is implemented.

Images