Multi-protocol rapid identification method and system for VPN burst data

Abstract

This application provides a multi-protocol rapid identification method and system for VPN burst data, relating to the field of network communication technology. The method includes: collecting VPN burst data packets from a target network using multiple collection terminals; extracting combined features, including traffic features and behavioral features; setting a multi-protocol combined identification model, and performing protocol type identification on the combined features; when the first protocol type identification result and the second protocol type identification result are consistent, calling a parsing plug-in according to the protocol type to obtain a decryption key; and decrypting the VPN burst data packet. This application solves the technical problem that the encryption characteristics of VPN data cause data leakage, resulting in the loss of key information, which further affects the speed of protocol identification. By setting combined features (traffic features and behavioral features) for protocol identification, comparing the two identification results to see if they are the same, the protocol type identification result can be quickly determined, thereby improving the overall identification speed and accuracy.

Description

Technical Field

[0001] The present application relates to the field of network communication technology, and in particular to a multi-protocol rapid identification method and system for VPN burst data. Background Art

[0002] With the development of the internet, information exchange is becoming increasingly frequent both domestically and internationally. VPNs offer two key advantages: first, they can transmit encrypted data packets over public networks, ensuring the privacy and integrity of communications; second, they possess excellent camouflage capabilities, simulating common network protocols for transmission, easily bypassing firewalls and allowing for unfettered access. Existing technologies for identifying VPN-surfing data rely primarily on analyzing traffic behavior characteristics, including packet length distribution, connection duration, uplink / downlink traffic ratio, and typical ports and IP addresses. This can lead to the identification of camouflaged protocols, resulting in low accuracy and slow processing speeds.

[0003] In summary, the existing technology has a technical problem in that due to the encryption characteristics of VPN data, data leakage leads to the loss of key information, which further affects the speed of protocol recognition. Summary of the Invention

[0004] The purpose of this application is to provide a multi-protocol rapid identification method and system for VPN burst data, so as to solve the technical problem in the prior art that due to the encryption characteristics of VPN data, data leakage leads to the loss of key information, which further affects the protocol identification speed.

[0005] In view of the above problems, the present application provides a multi-protocol rapid identification method and system for VPN burst data.

[0006] In a first aspect, the present application provides a multi-protocol rapid identification method for VPN sudden network data, which is implemented by a multi-protocol rapid identification system for VPN sudden network data, wherein the multi-protocol rapid identification method for VPN sudden network data includes: collecting VPN sudden network data packets from a target network using multiple collection terminals; extracting combined features of the VPN sudden network data packets, wherein the combined features include traffic features for fingerprint modeling and behavioral features for modeling communication; setting a multi-protocol combination identification model, and performing protocol type identification on the combined features of the VPN sudden network data packets according to the multi-protocol combination identification model to obtain a first protocol type identification result and a second protocol type identification result; when the first protocol type identification result and the second protocol type identification result are consistent, calling a parsing plug-in according to the output protocol type, and parsing a decryption key corresponding to the protocol type based on the parsing plug-in; using the decryption key to decrypt the VPN sudden network data packets, and outputting VPN plaintext data packets from multiple terminals.

[0007] Optionally, by analyzing the five-tuple information of the VPN burst data packet, traffic features for fingerprint modeling are extracted, and the traffic features include packet size, transmission delay, packet interval, data traffic pattern and port number; by analyzing the timing behavior information of the VPN burst data packet, behavioral features of the modeled communication are extracted, and the behavioral features include communication connection characteristics, communication duration, data flow direction, connection retry behavior and upstream and downstream paths.

[0008] Optionally, initialize a combination recognition model, the initialized combination recognition model is a dual-channel protocol recognition architecture; generate protocol training sample data, the protocol training sample data includes known VPN protocol data samples and combination feature samples corresponding to the known VPN protocol data samples, and disguised VPN multi-protocol data samples and combination feature samples corresponding to the disguised VPN multi-protocol data samples; wherein the combination feature samples include traffic feature samples and behavior feature samples; perform dual-channel training on the initialized combination recognition model according to the protocol training sample data, and output a multi-protocol combination recognition model.

[0009] Optionally, the multi-protocol combination identification model includes a protocol classification channel based on lightweight neural network training and a protocol classification channel based on temporal neural network training; wherein, the protocol classification channel based on lightweight neural network training performs protocol type identification on the traffic characteristics of the VPN sudden network data packet and outputs a first protocol type identification result, and the protocol classification channel based on temporal neural network training performs protocol type identification on the behavioral characteristics of the VPN sudden network data packet and outputs a second protocol type identification result.

[0010] Optionally, when the first protocol type identification result and the second protocol type identification result are inconsistent, the VPN sudden network data packet is identified as disguised VPN sudden network data; high-dimensional combined features are extracted from the disguised VPN sudden network data, wherein the high-dimensional combined features include high-dimensional traffic features and high-dimensional behavior features, and the feature convolution scale of the high-dimensional combined features is smaller than the convolution scale of the combined features; feature credibility is evaluated on the high-dimensional traffic features and the high-dimensional behavior features, and traffic feature credibility and behavior feature credibility are output; by comparing the traffic feature credibility and the behavior feature credibility, a parsing plug-in is called to decrypt the disguised VPN sudden network data.

[0011] Optionally, if the traffic feature credibility is greater than or equal to the behavior feature credibility, the parsing plug-in is called according to the first protocol type to decrypt the disguised VPN sudden network data; if the traffic feature credibility is less than the behavior feature credibility, the parsing plug-in is called according to the second protocol type to decrypt the disguised VPN sudden network data.

[0012] Optionally, a parsing plug-in is called according to the output protocol type, and the parsing plug-in is obtained by calling a parsing plug-in management module. The parsing plug-in management module includes multiple parsing plug-ins, and each parsing plug-in corresponds to a protocol type; wherein the parsing plug-in has a built-in protocol feature library and key derivation rules, which are used to derive the corresponding decryption key according to the protocol type.

[0013] Optionally, the VPN plaintext data packet is multi-portedly output through a plurality of output ports, wherein the plurality of output ports are connected to a configuration switch; and the VPN plaintext data packet is filtered using the configuration switch to obtain a filtered VPN plaintext data packet.

[0014] Optionally, the real-time load status of the multiple output ports is detected to generate multiple real-time load indicators; the multiple real-time load indicators are arranged in descending order according to their indicator sizes to generate an output port queue table, and after obtaining the VPN plaintext data packet; the VPN plaintext data packet is output according to the first-order output port of the output port queue table, and the output port queue table is updated at the same time.

[0015] In a second aspect, the present application also provides a multi-protocol rapid identification system for VPN sudden network data, which is used to execute the multi-protocol rapid identification method for VPN sudden network data as described in the first aspect, wherein the multi-protocol rapid identification system for VPN sudden network data includes: a data packet acquisition module, which is used to collect VPN sudden network data packets from the target network using multiple acquisition terminals; a combined feature extraction module, which is used to extract the combined features of the VPN sudden network data packets, and the combined features include traffic features for fingerprint modeling and behavioral features for modeling communication; a protocol type identification module, which is used to set a multi-protocol combined identification model, and perform protocol type identification on the combined features of the VPN sudden network data packets according to the multi-protocol combined identification model to obtain a first protocol type identification result and a second protocol type identification result; a plug-in parsing module, which is used to call the parsing plug-in according to the output protocol type when the first protocol type identification result and the second protocol type identification result are consistent, and parse the decryption key corresponding to the protocol type based on the parsing plug-in; a data packet decryption module, which is used to decrypt the VPN sudden network data packets using the decryption key, and output VPN plaintext data packets from multiple terminals.

[0016] One or more technical solutions provided in this application have at least the following beneficial effects:

[0017] The method involves collecting VPN burst packets from a target network using multiple collection terminals; extracting combined features of the VPN burst packets, including traffic features for fingerprinting and behavioral features for modeling communication; setting a multi-protocol combined identification model, and performing protocol type identification on the combined features of the VPN burst packets according to the multi-protocol combined identification model, thereby obtaining a first protocol type identification result and a second protocol type identification result; when the first and second protocol type identification results match, invoking a parsing plug-in based on the output protocol type, and using the parsing plug-in to parse a decryption key corresponding to the protocol type; decrypting the VPN burst packets using the decryption key, and outputting VPN plaintext packets from multiple terminals. Specifically, by setting combined features (traffic features and behavioral features), the protocol identification process is performed separately to obtain two candidate identification results. The two identification results are then compared for consistency. If the identification results match, the parsing plug-in is invoked for decryption. The two independent identification channels mutually verify each other to ensure the reliability of the identification results. Only when the two sides agree is the identification considered correct, thereby rapidly determining the protocol of the VPN burst data and accelerating the response speed of protocol identification, thereby improving the accuracy and security of VPN burst data protocol identification.

[0018] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, which can be implemented in accordance with the contents of the description, and to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are specifically listed below. It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present application, nor is it intended to limit the scope of the present application. Other features of the present application will become easy to understand through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in this application or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely exemplary, and a person of ordinary skill in the art can obtain other drawings based on the provided drawings without creative work.

[0020] Figure 1 This is a flowchart of the multi-protocol rapid identification method for VPN burst data in this application;

[0021] Figure 2 This is a schematic diagram of the structure of the multi-protocol rapid identification system for VPN burst data in this application.

[0022] Explanation of the accompanying symbols: data packet collection module 11, combined feature extraction module 12, protocol type identification module 13, plug-in parsing module 14, data packet decryption module 15. DETAILED DESCRIPTION

[0023] This application provides a method and system for rapid multi-protocol identification of VPN burst data, addressing the existing technical issues of data leakage and loss of key information due to the encryption characteristics of VPN data, which further affects the speed of protocol identification. By setting combined features (traffic features and behavioral features), the protocol identification process is executed separately to obtain two candidate identification results. The two identification results are compared for consistency. If the identification results are consistent, a parsing plug-in is invoked for decryption. The two independent identification channels mutually verify each other to ensure the reliability of the identification results. Only when the judgments on both sides are consistent is the identification considered correct. This allows for rapid determination of the protocol of the VPN burst data, accelerating the response speed of protocol identification, and thus improving the accuracy and security of VPN burst data protocol identification.

[0024] Below, the technical solutions in this application will be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of this application, rather than all the embodiments of this application. It should be understood that this application is not limited to the example embodiments described herein. Based on the embodiments of this application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application. It should also be noted that, for the convenience of description, only the parts related to this application, rather than all of them, are shown in the accompanying drawings.

[0025] For example, see the attached Figure 1 The present application provides a multi-protocol rapid identification method for VPN burst data, wherein the multi-protocol rapid identification method for VPN burst data is executed by a multi-protocol rapid identification system for VPN burst data, and the multi-protocol rapid identification method for VPN burst data specifically includes the following steps:

[0026] S100: Collect VPN burst data packets from the target network using multiple collection terminals.

[0027] Specifically, based on the topology of the target network, several key nodes are identified and collection equipment is deployed at these nodes to obtain multiple collection terminals for capturing and collecting data packets. The target network is a network environment that requires monitoring and security control, including a large amount of internal communications and inbound and outbound traffic. It is a key area for security monitoring and data collection. The collection terminal refers to the packet collection device or monitoring node deployed in the target network. It can be a network traffic mirroring device (such as a network card mirror, a mirror port on a network switch), a network security monitoring system (such as an IDS / IPS, a NetFlow collector), or a dedicated hardware device. Multiple collection terminals are usually deployed in different locations on the network to obtain comprehensive and redundant traffic data. VPN burst packets refer to encrypted data packets transmitted from the target network when using VPN technology to penetrate the intranet or when restricted by a firewall.

[0028] Multiple collection terminals collect data packets in different areas of the target network. Based on preset rules (such as specific protocol ports, tunnel encapsulation characteristics, and encrypted traffic ratio), the collected traffic data is filtered and pre-labeled. These filters identify VPN tunnel-specific multi-layer encryption identifiers (such as specific SSL handshakes and TLS SNI field anomalies), distinguishing packets that may belong to VPN burst networks from a large number of packets. This multi-terminal collection achieves comprehensive data coverage, avoids single point omissions, and significantly enhances data integrity and redundancy.

[0029] S200: Extracting combined features of the VPN burst data packets, where the combined features include traffic features for fingerprint modeling and behavior features for modeling communication.

[0030] Furthermore, the present application S200 includes:

[0031] By analyzing the five-tuple information of the VPN burst data packet, traffic features for fingerprint modeling are extracted, and the traffic features include packet size, transmission delay, packet interval, data traffic pattern and port number; by analyzing the timing behavior information of the VPN burst data packet, behavioral features of the modeled communication are extracted, and the behavioral features include communication connection characteristics, communication duration, data flow direction, connection retry behavior and uplink and downlink paths.

[0032] Specifically, the combined signature of VPN burst packets is composed of two types of data features, used to describe and model the overall properties of the packets: traffic signatures for fingerprinting and behavioral signatures for modeling communication. Traffic signatures for fingerprinting analyze static properties of network traffic to create a traffic fingerprint, uniquely identifying a specific protocol or application. Behavioral signatures for modeling communication capture the timing and interaction of packet data to describe the dynamic behavior within a communication session, known as the communication context.

[0033] For each captured VPN burst packet, first use a network packet analysis tool (such as Wireshark or tcpdump) to read its five-tuple information. This five-tuple information, including source IP address, source port number, destination IP address, destination port number, and protocol type, identifies the packet's source and destination, supporting subsequent preliminary classification and packet filtering based on port numbers and protocol types. By analyzing the five-tuple information of VPN burst packets, traffic features used for fingerprinting are extracted, including packet size, transmission delay, packet interval, data flow pattern, and port number. Packet size, representing the number of bytes per packet, is a key static feature for identifying communication patterns. Transmission delay, representing the time between packet transmission and reception, reflects network latency and encryption negotiation. Packet interval, representing the time interval between consecutive packets, reflects burstiness or stability. Data flow pattern describes the uplink and downlink distribution, periodicity, or bursty behavior of packets within a session. Transport layer port numbers are used to distinguish different services or protocols. For example, VPNs often use ports 1194 or 443.

[0034] By analyzing the timing behavior of VPN burst packets—that is, the time-related information about the packets during the capture process, including timestamps, packet sequence, intervals, and the time distribution of each phase of the communication session—we can extract and model the behavioral characteristics of the communication and construct a communication context description, including dynamic features during session establishment, data exchange, disconnection, and reconnection. During the data collection phase, each packet is accurately timestamped. This timestamp information can be used to determine the order and intervals of packet arrival. Timing information is used to identify key stages in the connection establishment process and obtain communication connection characteristics, namely the method and process used to establish the communication connection, focusing on information such as the handshake process, connection initialization, and security negotiation. The communication duration is the duration of a complete communication session from establishment to disconnection, that is, the time difference between the first data packet (usually the start of the handshake) and the last data packet (disconnection or end of the session). The data flow direction is obtained by analyzing the source and destination IP information of the data packet and counting the number and byte count of upstream and downstream data packets. It is the transmission direction of the data packet in the session and the distribution of upstream (from client to server) and downstream (from server to client). Connection retry behavior is the behavior of re-establishing a connection after a disconnection due to network jitter, encryption negotiation failure, or other abnormal factors during the communication process. It is usually obtained by comparing the session interruption time with the start time of the new session and counting the number of retries and time intervals. The uplink and downlink paths are the network paths and number of hops that the data packet travels from the sender to the receiver.

[0035] By extracting the combined features of VPN packets and comprehensively identifying the features of packets, the combination of traffic features and behavioral features can improve the accuracy and reliability of protocol identification.

[0036] S300: Setting a multi-protocol combination identification model, and performing protocol type identification on the combination features of the VPN burst data packet according to the multi-protocol combination identification model to obtain a first protocol type identification result and a second protocol type identification result.

[0037] Furthermore, the present application S300 includes:

[0038] Initialize a combination recognition model, wherein the initialized combination recognition model is a dual-channel protocol recognition architecture; generate protocol training sample data, wherein the protocol training sample data includes known VPN protocol data samples and combination feature samples corresponding to the known VPN protocol data samples, and disguised VPN multi-protocol data samples and combination feature samples corresponding to the disguised VPN multi-protocol data samples; wherein the combination feature samples include traffic feature samples and behavior feature samples; perform dual-channel training on the initialized combination recognition model according to the protocol training sample data, and output a multi-protocol combination recognition model.

[0039] Specifically, the initialization combined recognition model is a holistic model for protocol identification and classification of VPN packets. This model utilizes a dual-channel protocol recognition architecture, enabling recognition of multi-layer encapsulation and mixed protocols. The combined recognition model consists of two parallel recognition channels: one focusing on processing traffic characteristics and the other on timing behavior characteristics.

[0040] Protocol training sample data is constructed, including a combination of characteristic samples of standard VPN traffic data captured from real-world network environments, annotated and preprocessed, and data samples of VPN traffic disguised as other protocols through certain processing or technical means, representing samples with anti-interference and obfuscation properties. Both types of protocol training sample data include traffic characteristic samples and behavioral characteristic samples. In short, raw VPN traffic data is captured on the target network, while disguised traffic data is collected. Preliminary annotation of the captured data is performed using expert experience or automated rules, marking VPN traffic as known VPN protocol samples and disguised traffic as disguised VPN multi-protocol samples.

[0041] By introducing multi-protocol samples of disguised VPNs, the model learns how to distinguish real VPN traffic from disguised traffic under interference, enhancing its robustness. Using protocol training sample data, the initial combination recognition model undergoes dual-channel training. During training, the lightweight neural network channel focuses on learning traffic characteristics, while the time series neural network channel focuses on learning behavioral characteristics. The protocol training sample data undergoes normalization and data augmentation, such as logarithmic transformation and mean normalization, to ensure that each feature is within a reasonable range. A lightweight neural network training channel is constructed to learn traffic characteristics. The model can be designed as an input layer, three fully connected layers, and an output layer. Reluctant Unit (ReLU) activation functions are used, and finally, Softmax is used to output classification probabilities. A time series neural network training channel is constructed to capture behavioral characteristics. A two-layer LSTM network is designed, with several hidden units in each layer. The final state is fed into a fully connected layer to obtain the classification output.

[0042] Each training sample is distributed simultaneously to two channels: traffic features are fed into the lightweight network, and behavioral features are fed into the time series network. Standard supervised training methods are used to update the parameters of both models, monitoring the loss function and accuracy during training. Supervised learning is performed on both the lightweight channel and the time series channel, adjusting parameters until the classification accuracy converges. A joint loss function is used to guide the optimization of both channels, ensuring that the output performs well in both static and dynamic feature dimensions. Hyperparameters such as batch size, learning rate, and training epochs are set, and cross-validation is performed on a validation set to ensure convergence. After training, the dual-channel model is saved as a multi-protocol combination recognition model.

[0043] Through a dual-channel architecture, traffic and behavioral features are used to improve recognition accuracy respectively, and combined features (including traffic and behavioral features) are constructed using known VPN samples and disguised VPN samples. The model is jointly trained to achieve high-precision and high-robust multi-protocol combination recognition. The overall model has a low misjudgment rate and excellent anti-interference ability in complex and changing network environments.

[0044] Furthermore, the present application further comprises the following steps:

[0045] The multi-protocol combination identification model includes a protocol classification channel based on lightweight neural network training and a protocol classification channel based on temporal neural network training; wherein, the protocol classification channel based on lightweight neural network training performs protocol type identification on the traffic characteristics of the VPN sudden network data packet and outputs a first protocol type identification result, and the protocol classification channel based on temporal neural network training performs protocol type identification on the behavioral characteristics of the VPN sudden network data packet and outputs a second protocol type identification result.

[0046] Specifically, the multi-protocol combination identification model includes a protocol classification channel based on lightweight neural network training and a protocol classification channel based on time series neural network training. Among them, the protocol classification channel based on lightweight neural network training is a neural network channel that specifically models and classifies static traffic characteristics in VPN data packets (such as packet size, transmission delay, packet interval, traffic pattern, port number, etc.); the protocol classification channel based on time series neural network training is a neural network channel that focuses on capturing the dynamic behavior characteristics of VPN data packets in timing (such as handshake delay, communication duration, data flow direction, connection retry status, and upstream and downstream paths, etc.).

[0047] The combined features of the extracted VPN burst data packets are input into the multi-protocol combination recognition model. The protocol classification channel based on lightweight neural network training performs protocol type recognition on the traffic features and outputs the first protocol type recognition result; the protocol classification channel based on temporal neural network training performs protocol type recognition on the behavioral features and outputs the second protocol type recognition result.

[0048] The first protocol type identification result is output by the protocol classification channel trained by the lightweight neural network, which mainly reflects the contribution of traffic characteristics to the protocol type determination, indicating that the data packet is determined to be a specific protocol type under the traffic characteristic dimension; the second protocol type identification result is output by the protocol classification channel based on the temporal neural network training, which mainly identifies the protocol type based on dynamic communication behavior, indicating that the data packet is determined to be a specific protocol type under the behavioral characteristic dimension, which is used for comparison and verification with the first result (traffic characteristic identification).

[0049] By setting up a dual-channel multi-protocol combination recognition model, the protocol identification of VPN sudden network data packets is carried out, which has strong anti-obfuscation, anti-encryption, and anti-port masquerading capabilities. The dual-channel consistency judgment reduces false positives and missed judgments, and accurately identifies the protocol type of VPN sudden network data packets, thereby improving the accuracy and reliability of protocol identification.

[0050] Furthermore, the present application further comprises the following steps:

[0051] When the first protocol type identification result and the second protocol type identification result are inconsistent, the VPN burst data packet is identified as disguised VPN burst data; high-dimensional combined features are extracted from the disguised VPN burst data, wherein the high-dimensional combined features include high-dimensional flow features and high-dimensional behavior features, and the feature convolution scale of the high-dimensional combined features is smaller than the convolution scale of the combined features; feature credibility is evaluated on the high-dimensional flow features and the high-dimensional behavior features, and flow feature credibility and behavior feature credibility are output; and by comparing the flow feature credibility with the behavior feature credibility, a parsing plug-in is called to decrypt the disguised VPN burst data.

[0052] If the credibility of the traffic feature is greater than or equal to the credibility of the behavior feature, the parsing plug-in is called according to the first protocol type to decrypt the disguised VPN sudden network data; if the credibility of the traffic feature is less than the credibility of the behavior feature, the parsing plug-in is called according to the second protocol type to decrypt the disguised VPN sudden network data.

[0053] Specifically, when the protocol identification results of the traffic features by the protocol classification channel trained with a lightweight neural network are inconsistent with the protocol identification results of the behavior features by the protocol classification channel trained with a time-series neural network, the packet is judged to be at risk of protocol spoofing and is identified as spoofed VPN burst data. A more in-depth feature extraction is performed on the spoofed VPN burst data packets, including high-dimensional traffic features and high-dimensional behavior features. That is, based on the original combined features, the data structure is modeled at a finer granularity by using feature convolutions at a smaller scale than the original combined features. For example, for traffic features, certain port mutations, rate fluctuations, and atypical flow directions are extracted; for behavior features, anomalies in connection behavior are analyzed, such as frequent connection retries in a short period of time or unusually stable connection patterns.

[0054] The extracted high-dimensional traffic features and high-dimensional behavioral features are evaluated for credibility to determine which type of features best represents the true protocol type. The credibility of each feature is analyzed, specifically the degree to which it accurately reflects the characteristics of the packet. The credibility is typically a score between 0 and 1, with higher scores indicating more credibility and greater suitability for subsequent analysis or classification.

[0055] The extracted high-dimensional traffic features and high-dimensional behavioral features are input into the credibility assessment network. Two credibility values are calculated using a multi-layer perceptron (MLP) coupled with an attention weighting mechanism. For each input feature, feature mapping is performed through the MLP to generate a hidden layer feature representation. The MLP network consists of multiple hidden layers and activation functions, enabling it to learn the deep relationships between input features. The attention weighting mechanism dynamically assigns feature importance weights. Based on the contextual relationships of the features, each feature is assigned a weight indicating its relative importance in calculating credibility. For example, for traffic features, the attention mechanism will focus on features such as packet size and transmission latency that have a decisive impact on protocol identification. For behavioral features, the attention mechanism may increase attention to connection retry frequency and session persistence.

[0056] The weighted feature representation is mapped using a Sigmoid activation function to obtain a feature confidence value, which ranges from 0 to 1 and indicates the reliability of the feature in protocol type identification. If the traffic feature confidence is greater than or equal to the behavior feature confidence, the traffic feature contributes more to protocol identification. Therefore, the traffic feature is favored for decryption. The first protocol type is selected, and the parsing plug-in associated with that protocol type is invoked for decryption. The parsing plug-in decrypts the packet based on the protocol type determined by the traffic feature, recovering the VPN plaintext packet.

[0057] If the traffic feature is less reliable than the behavior feature, the second protocol type is selected and the corresponding parsing plug-in is called for decryption. In this case, the behavior feature is considered more reliable, so the protocol type based on the behavior feature is selected for decryption.

[0058] For example, high-dimensional features are extracted from disguised VPN packets, and the high-dimensional traffic features obtained are: packet size 1400 bytes, transmission delay 15ms, port number 443; high-dimensional behavior features: connection duration 250s, number of retries 2 times, data flow direction is uplink; multi-layer perceptron (MLP) and attention mechanism are used to evaluate the high-dimensional traffic features and high-dimensional behavior features, and the traffic feature credibility is 0.88 and the behavior feature credibility is 0.75. Each feature is input separately, so the traffic feature has 3 inputs (such as packet size, transmission delay, port number), and the behavior feature has 3 inputs (such as connection duration, number of retries, data flow direction). For the traffic feature, after standardization, the packet size is 0.85, the transmission delay is 0.75, and the port number is 0.8; for the behavior feature, after standardization, the connection duration is 0.9, the number of retries is 0.8, and the data flow direction is 1. The MLP calculates the weighted sum of the hidden layer, and then processes it through the activation function ReLU. The final output credibility value is MLP. 流量 (0.85, 0.75, 0.80) = 0.88, MLP 行为 (0.90, 0.80, 1.0) = 0.75. Therefore, the first protocol type corresponding to the traffic feature is selected for decryption, and the parsing plug-in matching the protocol type is called to obtain the decryption key through the built-in protocol feature library and key derivation rules.

[0059] By extracting and evaluating features in high-dimensional space, the disguised VPN data can be accurately identified and parsed, which improves the ability to identify tampered or disguised protocol types, selects the most likely protocol type for decryption, and improves the decryption success rate.

[0060] S400: When the first protocol type identification result and the second protocol type identification result are consistent, calling a parsing plug-in according to the output protocol type, and parsing a decryption key corresponding to the protocol type based on the parsing plug-in.

[0061] Furthermore, the present application S400 includes:

[0062] The parsing plug-in is called according to the output protocol type. The parsing plug-in is obtained by calling the parsing plug-in management module. The parsing plug-in management module includes multiple parsing plug-ins, each parsing plug-in corresponds to a protocol type; wherein the parsing plug-in has a built-in protocol feature library and key derivation rules, which are used to derive the corresponding decryption key according to the protocol type.

[0063] Specifically, when the protocol type identification results output by the lightweight neural network channel and the sequential neural network channel in the multi-protocol combination recognition model are consistent, it indicates that the current VPN packet type judgment is highly reliable, and the identification result is directly output. Based on the output protocol type, the corresponding parsing plug-in is called through the parsing plug-in management module. The parsing plug-in management module includes multiple parsing plug-ins, each corresponding to a protocol type, such as the OpenVPN protocol corresponding to the OpenVPN_Parser.dll parsing plug-in; the WireGuard protocol corresponding to the WireGuard_KeyExtractor.py parsing plug-in; the L2TP / IPSec protocol corresponding to the IPSecHandler.so parsing plug-in, etc.

[0064] The parsing plug-in includes a built-in protocol signature library and key derivation rules. The protocol signature library contains information related to specific protocol types, allowing it to identify and parse packets of that protocol type. The key derivation rules are used to derive the corresponding decryption key based on the protocol type. Specifically, the parsing plug-in accesses its built-in protocol signature library to verify that the captured packet fully conforms to the structural characteristics of the protocol. For example, it verifies whether the packet header contains 0x38 0x13, whether the HMAC verification field is present during the handshake phase, and whether the encrypted handshake is based on TLS 1.2. Once verified, the plug-in extracts the key from the specified data field according to the key derivation rules. The extracted key is validated using the plug-in's internal algorithm verification mechanisms (such as HMAC checks and symmetric decryption attempts). If verification succeeds, the key is returned to the upper-layer module as the decryption key for the current session, allowing it to be used for plaintext decryption.

[0065] By calling the parsing plug-in, VPN packets are accurately parsed according to the identified protocol type and the corresponding decryption key is derived, thus improving the accuracy and efficiency of protocol parsing.

[0066] S500: Decrypt the VPN data packet using the decryption key, and output the VPN plaintext data packet at multiple terminals.

[0067] Furthermore, the present application S500 includes:

[0068] The VPN plaintext data packet is output through multiple output ports, wherein the multiple output ports are connected to a configuration switch; the VPN plaintext data packet is filtered using the configuration switch to obtain the filtered VPN plaintext data packet.

[0069] Specifically, it uses the decryption key obtained by parsing the plug-in to decrypt VPN packets and restore VPN plaintext packets, including original plaintext data such as HTTP requests, DNS queries, FTP commands, and remote desktop transmissions, clearly identifying communication content, URLs, and user behavior. It can decrypt and decompress all PPTP data and output plaintext packets; it can decrypt and decompress L2TP data encrypted with the DES algorithm and output plaintext packets; and it can decrypt SS tunnel data such as wumaVPN, AtomVPN, and OfficeVPN in real time and output plaintext packets.

[0070] After successful decryption, the VPN plaintext data packets are pushed to multiple output ports for multi-port output. These output ports are connected to the configuration switch. The configuration switch is a configurable logic module that defines which plaintext data should be output and which should be filtered out. This includes filtering by protocol type, port, and content keyword.

[0071] The switch obtains pre-set filtering rules from the client, such as outputting only HTTP plaintext data, excluding DNS packets, filtering out plaintext content without the keywords "login" and "token," and retaining port commands in FTP protocol plaintext. VPN plaintext packets are then filtered according to the pre-set filtering rules, allowing only packets that meet the filtering rules to pass through. The filtered VPN plaintext packets are then retained and output to all ports. For example, if only HTTP packets need to be transmitted to port A, the switch can be configured to allow only HTTP packets and block all other types of packets.

[0072] Through multi-port output and configuration switches, VPN packets are decrypted and filtered, effectively screening out packets that meet specific criteria and enhancing data security and compliance. The use of configuration switches further enhances data transmission control, ensuring that only packets that meet specific criteria are transmitted to subsequent ports, thereby improving data processing accuracy and efficiency.

[0073] Furthermore, the present application further comprises the following steps:

[0074] Detect the real-time load status of the multiple output ports and generate multiple real-time load indicators; arrange the multiple real-time load indicators in descending order according to their indicator size to generate an output port queue table, and after obtaining the VPN plaintext data packet; output the VPN plaintext data packet according to the first-order output port of the output port queue table, and update the output port queue table at the same time.

[0075] Specifically, after decrypting the plaintext packets from VPN traffic, the system monitors the real-time load status of all output ports (such as the volume and speed of traffic currently being processed) to prevent overload on the output ports. This system then generates multiple real-time load indicators. The real-time load status represents the current data transmission volume and workload on the output port. Real-time load indicators quantify the load status of the output port and can include data transmission rate, queue length, and other indicators.

[0076] An output port queue is constructed by sorting multiple real-time load indicators in descending order, placing the lightest-loaded port at the head of the queue. When a new plaintext packet arrives, it is output from the first output port in the queue, selecting the first, lightest-loaded port in the queue. After the output is complete, the real-time load status changes, so the load information for that output port is updated and the queue is reordered to ensure that the next packet is appropriately distributed to the lightest-loaded port, achieving dynamic load balancing.

[0077] By real-time detection and adjustment of the use of output ports, load balancing of multi-port outputs is achieved, overloading of a single port is avoided, and VPN plaintext data packets are always transmitted to the port with the lowest current load and the strongest transmission capacity, thereby improving data processing efficiency and overall performance.

[0078] In summary, the multi-protocol rapid identification method for VPN burst data provided by this application has the following beneficial effects:

[0079] The method involves collecting VPN burst packets from a target network using multiple collection terminals; extracting combined features of the VPN burst packets, including traffic features for fingerprinting and behavioral features for modeling communication; setting a multi-protocol combined identification model, and performing protocol type identification on the combined features of the VPN burst packets according to the multi-protocol combined identification model, thereby obtaining a first protocol type identification result and a second protocol type identification result; when the first and second protocol type identification results match, invoking a parsing plug-in based on the output protocol type, and using the parsing plug-in to parse a decryption key corresponding to the protocol type; decrypting the VPN burst packets using the decryption key, and outputting VPN plaintext packets from multiple terminals. Specifically, by setting combined features (traffic features and behavioral features), the protocol identification process is performed separately to obtain two candidate identification results. The two identification results are then compared for consistency. If the identification results match, the parsing plug-in is invoked for decryption. The two independent identification channels mutually verify each other to ensure the reliability of the identification results. Only when the two sides agree is the identification considered correct, thereby rapidly determining the protocol of the VPN burst data and accelerating the response speed of protocol identification, thereby improving the accuracy and security of VPN burst data protocol identification.

[0080] Example 2: Based on the same inventive concept as the multi-protocol rapid identification method for VPN burst data in the aforementioned Example 1, this application also provides a multi-protocol rapid identification system for VPN burst data, see the attached Figure 2 The multi-protocol rapid identification system for VPN burst data includes:

[0081] The data packet collection module 11 is used to collect VPN sudden network data packets from the target network using multiple collection terminals; the combined feature extraction module 12 is used to extract the combined features of the VPN sudden network data packets, and the combined features include traffic features for fingerprint modeling and behavioral features for modeling communication; the protocol type identification module 13 is used to set a multi-protocol combined identification model, and perform protocol type identification on the combined features of the VPN sudden network data packets according to the multi-protocol combined identification model to obtain a first protocol type identification result and a second protocol type identification result; the plug-in parsing module 14 is used to call the parsing plug-in according to the output protocol type when the first protocol type identification result and the second protocol type identification result are consistent, and parse the decryption key corresponding to the protocol type based on the parsing plug-in; the data packet decryption module 15 is used to use the decryption key to decrypt the VPN sudden network data packet, and output the VPN plaintext data packet at multiple terminals.

[0082] Furthermore, the combined feature extraction module 12 in the multi-protocol rapid identification system for VPN burst data is further configured to:

[0083] By analyzing the five-tuple information of the VPN burst data packet, traffic features for fingerprint modeling are extracted, and the traffic features include packet size, transmission delay, packet interval, data traffic pattern and port number; by analyzing the timing behavior information of the VPN burst data packet, behavioral features of the modeled communication are extracted, and the behavioral features include communication connection characteristics, communication duration, data flow direction, connection retry behavior and uplink and downlink paths.

[0084] Furthermore, the protocol type identification module 13 in the multi-protocol rapid identification system for VPN burst data is further configured to:

[0085] Initialize a combination recognition model, wherein the initialized combination recognition model is a dual-channel protocol recognition architecture; generate protocol training sample data, wherein the protocol training sample data includes known VPN protocol data samples and combination feature samples corresponding to the known VPN protocol data samples, and disguised VPN multi-protocol data samples and combination feature samples corresponding to the disguised VPN multi-protocol data samples; wherein the combination feature samples include traffic feature samples and behavior feature samples; perform dual-channel training on the initialized combination recognition model according to the protocol training sample data, and output a multi-protocol combination recognition model.

[0086] Furthermore, the protocol type identification module 13 in the multi-protocol rapid identification system for VPN burst data is further used to:

[0087] The multi-protocol combination identification model includes a protocol classification channel based on lightweight neural network training and a protocol classification channel based on temporal neural network training; wherein, the protocol classification channel based on lightweight neural network training performs protocol type identification on the traffic characteristics of the VPN sudden network data packet and outputs a first protocol type identification result, and the protocol classification channel based on temporal neural network training performs protocol type identification on the behavioral characteristics of the VPN sudden network data packet and outputs a second protocol type identification result.

[0088] Furthermore, the protocol type identification module 13 in the multi-protocol rapid identification system for VPN burst data is further used to:

[0089] When the first protocol type identification result and the second protocol type identification result are inconsistent, the VPN burst data packet is identified as disguised VPN burst data; high-dimensional combined features are extracted from the disguised VPN burst data, wherein the high-dimensional combined features include high-dimensional flow features and high-dimensional behavior features, and the feature convolution scale of the high-dimensional combined features is smaller than the convolution scale of the combined features; feature credibility is evaluated on the high-dimensional flow features and the high-dimensional behavior features, and flow feature credibility and behavior feature credibility are output; and by comparing the flow feature credibility with the behavior feature credibility, a parsing plug-in is called to decrypt the disguised VPN burst data.

[0090] Furthermore, the protocol type identification module 13 in the multi-protocol rapid identification system for VPN burst data is further used to:

[0091] If the credibility of the traffic feature is greater than or equal to the credibility of the behavior feature, the parsing plug-in is called according to the first protocol type to decrypt the disguised VPN sudden network data; if the credibility of the traffic feature is less than the credibility of the behavior feature, the parsing plug-in is called according to the second protocol type to decrypt the disguised VPN sudden network data.

[0092] Furthermore, the plug-in parsing module 14 in the multi-protocol rapid identification system for VPN burst data is further used to:

[0093] The parsing plug-in is called according to the output protocol type. The parsing plug-in is obtained by calling the parsing plug-in management module. The parsing plug-in management module includes multiple parsing plug-ins, each parsing plug-in corresponds to a protocol type; wherein the parsing plug-in has a built-in protocol feature library and key derivation rules, which are used to derive the corresponding decryption key according to the protocol type.

[0094] Furthermore, the data packet decryption module 15 in the multi-protocol rapid identification system for VPN burst data is further used to:

[0095] The VPN plaintext data packet is output through multiple output ports, wherein the multiple output ports are connected to a configuration switch; the VPN plaintext data packet is filtered using the configuration switch to obtain the filtered VPN plaintext data packet.

[0096] Furthermore, the data packet decryption module 15 in the multi-protocol rapid identification system for VPN burst data is further used to:

[0097] Detect the real-time load status of the multiple output ports and generate multiple real-time load indicators; arrange the multiple real-time load indicators in descending order according to their indicator size to generate an output port queue table, and after obtaining the VPN plaintext data packet; output the VPN plaintext data packet according to the first-order output port of the output port queue table, and update the output port queue table at the same time.

[0098] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. Figure 1 The multi-protocol rapid identification method for VPN sudden network data and the specific examples in Example 1 are also applicable to the multi-protocol rapid identification system for VPN sudden network data in this embodiment. Through the above detailed description of the multi-protocol rapid identification method for VPN sudden network data, those skilled in the art can clearly understand the multi-protocol rapid identification system for VPN sudden network data in this embodiment. Therefore, for the sake of brevity of the specification, it will not be described in detail here.

[0099] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present application. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application is not limited to the embodiments shown herein, but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

[0100] Obviously, for those skilled in the art, several improvements and modifications can be made to the present application without departing from the principles of the present application, and these improvements and modifications also fall within the scope of protection of the present application.

Claims

1. A multi-protocol rapid identification method for VPN burst data, characterized in that: include: Collect VPN packets from the target network using multiple collection terminals; Extracting combined features of the VPN burst data packets, the combined features including traffic features for fingerprint modeling and behavioral features for modeling communication; Setting a multi-protocol combination identification model, performing protocol type identification on the combination features of the VPN burst data packet according to the multi-protocol combination identification model, and obtaining a first protocol type identification result and a second protocol type identification result, including: The multi-protocol combination recognition model includes a protocol classification channel based on lightweight neural network training and a protocol classification channel based on temporal neural network training; Among them, the protocol classification channel based on lightweight neural network training performs protocol type identification on the traffic characteristics of the VPN sudden network data packet and outputs a first protocol type identification result; the protocol classification channel based on temporal neural network training performs protocol type identification on the behavioral characteristics of the VPN sudden network data packet and outputs a second protocol type identification result; When the first protocol type identification result and the second protocol type identification result are consistent, calling the parsing plug-in according to the output protocol type, parsing the decryption key corresponding to the protocol type based on the parsing plug-in; using the decryption key to decrypt the VPN burst data packet, and outputting the VPN plaintext data packet on multiple terminals; When the first protocol type identification result and the second protocol type identification result are inconsistent, identifying the VPN burst data packet as camouflaged VPN burst data; Extracting high-dimensional combined features from the disguised VPN burst data, wherein the high-dimensional combined features include high-dimensional traffic features and high-dimensional behavior features, and a feature convolution scale of the high-dimensional combined features is smaller than a convolution scale of the combined features; Performing feature credibility evaluation on the high-dimensional traffic feature and the high-dimensional behavior feature, and outputting traffic feature credibility and behavior feature credibility; By comparing the credibility of the traffic feature and the credibility of the behavior feature, the parsing plug-in is called to decrypt the disguised VPN network data.

2. The multi-protocol rapid identification method for VPN burst data according to claim 1, wherein: Extracting the combined features of the VPN burst data packet includes: Extracting traffic features for fingerprint modeling by analyzing the five-tuple information of the VPN burst data packet, wherein the traffic features include packet size, transmission delay, packet interval, data traffic pattern and port number; By analyzing the timing behavior information of the VPN burst data packets, behavioral features of the modeled communication are extracted, wherein the behavioral features include communication connection features, communication duration, data flow direction, connection retry behavior and uplink and downlink paths.

3. The multi-protocol rapid identification method for VPN burst data according to claim 1, wherein: The VPN plaintext data packet is output through multiple output ports, wherein the multiple output ports are connected to a configuration switch; The VPN plaintext data packet is filtered using the configuration switch to obtain the filtered VPN plaintext data packet.

4. The multi-protocol rapid identification method for VPN burst data according to claim 3, wherein: The VPN plaintext data packet is output through multiple output ports, further comprising: detecting real-time load states of the plurality of output ports and generating a plurality of real-time load indicators; Arrange the multiple real-time load indicators in descending order to generate an output port queue table. After obtaining the VPN plaintext data packet, The VPN plaintext data packet is output according to the first-order output port in the output port queue table, and the output port queue table is updated at the same time.

5. The multi-protocol rapid identification method for VPN burst data according to claim 1, wherein: Set up a multi-protocol combination recognition model, including: Initializing a combined recognition model, wherein the initialized combined recognition model is a dual-channel protocol recognition architecture; Generate protocol training sample data, the protocol training sample data including known VPN protocol data samples and combined feature samples corresponding to the known VPN protocol data samples, and disguised VPN multi-protocol data samples and combined feature samples corresponding to the disguised VPN multi-protocol data samples; Wherein, the combined feature sample includes a flow feature sample and a behavior feature sample; The initialized combination recognition model is dual-channel trained according to the protocol training sample data to output a multi-protocol combination recognition model.

6. The multi-protocol rapid identification method for VPN burst data according to claim 1, wherein: By comparing the credibility of the traffic feature and the credibility of the behavior feature, calling the parsing plug-in to decrypt the disguised VPN network data, including: If the credibility of the traffic feature is greater than or equal to the credibility of the behavior feature, calling the parsing plug-in according to the first protocol type to decrypt the disguised VPN network data; If the credibility of the traffic feature is less than the credibility of the behavior feature, the parsing plug-in is called according to the second protocol type to decrypt the disguised VPN network data.

7. The multi-protocol rapid identification method for VPN burst data according to claim 1, wherein: Calling a parsing plug-in according to the output protocol type, the parsing plug-in is acquired by calling a parsing plug-in management module, the parsing plug-in management module includes multiple parsing plug-ins, each parsing plug-in corresponds to a protocol type; The parsing plug-in has a built-in protocol feature library and key derivation rules, which are used to derive the corresponding decryption key according to the protocol type.

8. A multi-protocol rapid identification system for VPN burst data, characterized in that: The method for implementing the multi-protocol rapid identification method for VPN burst data according to any one of claims 1 to 7, wherein the multi-protocol rapid identification system for VPN burst data comprises: The data packet collection module is used to collect VPN burst data packets from the target network using multiple collection terminals; A combined feature extraction module, configured to extract combined features of the VPN burst data packets, wherein the combined features include traffic features for fingerprint modeling and behavioral features for modeling communication; A protocol type identification module is used to set a multi-protocol combination identification model, and perform protocol type identification on the combination characteristics of the VPN burst network data packet according to the multi-protocol combination identification model to obtain a first protocol type identification result and a second protocol type identification result; a plug-in parsing module, configured to, when the first protocol type identification result and the second protocol type identification result are consistent, call the parsing plug-in according to the output protocol type, and parse the decryption key corresponding to the protocol type based on the parsing plug-in; The data packet decryption module is used to decrypt the VPN burst data packet using the decryption key and output the VPN plaintext data packet through multiple terminals.

Images