TLS Fingerprint Security Detection Method, Device, Equipment and Medium Based on Merkle Tree

Abstract

The embodiment of the present application provides a TLS fingerprint security detection method, device, equipment and medium based on the Merkle tree, which belongs to the field of network security technology. The method includes: obtaining a target TLS fingerprint under a binary tree structure and selecting any sample TLS fingerprint with the same structure, the target TLS fingerprint includes multiple target nodes located at different levels determined by the target classification chain information, and each target node includes target fingerprint information; based on the target classification chain information and the sample classification chain information, align the hierarchical structure of the target TLS fingerprint and the sample TLS fingerprint, and compare the target node and the sample node layer by layer from top to bottom; if the sample fingerprint information of any sample node matches the target fingerprint information of the target node at the corresponding position, determine the target security detection result of the target TLS fingerprint according to the corresponding sample security label. The present application can improve the granularity of security detection of TLS information, avoid missed detection and false detection, and thus reduce network security risks.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a TLS fingerprint security detection method, apparatus, device, and medium based on a Merkle tree. Background Art

[0002] A Transport Layer Security (TLS) fingerprint is a unique identifier generated by analyzing specific parameters used by a client or server during the TLS handshake. TLS fingerprints can be used to identify different software versions, operating systems, or configurations, enabling a range of network security analysis operations.

[0003] In related technologies, TLS information collected from the client or server (such as the protocol version, cipher suite, and extension type) is combined into a string using predetermined rules. A hash function is then applied to this string, and the resulting fixed-length hash value is used as the TLS fingerprint. This TLS fingerprint is then tested to determine whether the client or server's network behavior is secure by analyzing the TLS information. However, because the TLS fingerprint generated by traditional methods is a single identifier with insufficient feature dimensions and limited expressiveness, this method suffers from low granularity in TLS information security detection, making it prone to missed detections and false detections, thereby creating network security risks. Summary of the Invention

[0004] The main purpose of the embodiments of the present application is to propose a TLS fingerprint security detection method, device, equipment and medium based on the Merkle tree, aiming to improve the granularity of security detection of TLS information, avoid missed detections and false detections, and thus reduce network security risks.

[0005] To achieve the above objectives, a first aspect of an embodiment of the present application proposes a TLS fingerprint security detection method based on a Merkle tree, comprising:

[0006] Obtain a target TLS fingerprint under a binary tree structure generated by the target system, and select any sample TLS fingerprint with the same binary tree structure from a pre-built fingerprint library, wherein the target TLS fingerprint includes multiple target nodes at different levels determined by the target classification chain information, each target node includes target fingerprint information, and the sample TLS fingerprint includes multiple sample nodes at different levels determined by the sample classification chain information, each sample node includes sample fingerprint information and a sample security label;

[0007] Based on the target classification chain information and the sample classification chain information, align the hierarchical structures of the target TLS fingerprint and the sample TLS fingerprint, and compare the target node and the sample node layer by layer from top to bottom;

[0008] If the sample fingerprint information of any sample node matches the target fingerprint information of the target node at the corresponding position, the target security detection result of the target TLS fingerprint is determined according to the corresponding sample security label.

[0009] In some embodiments, the target TLS fingerprint is sequentially a target root node, a target non-leaf node, and a target leaf node from top to bottom toward target nodes of different levels, and the sample TLS fingerprint is sequentially a sample root node, a sample non-leaf node, and a sample leaf node from top to bottom toward sample nodes of different levels;

[0010] If the sample fingerprint information of any sample node matches the target fingerprint information of the target node at the corresponding position, the target security detection result of the target TLS fingerprint is determined according to the corresponding sample security label, including:

[0011] Obtain first matching information between the sample fingerprint information of the sample root node and the target fingerprint information of the target root node. If the first matching information indicates a match, determine a target security detection result of the target TLS fingerprint based on the sample security tag corresponding to the sample root node.

[0012] If the first matching information indicates a mismatch, obtaining second matching information between the sample fingerprint information of any sample non-leaf node and the target fingerprint information of any target non-leaf node; if the second matching information indicates a match, determining a target security detection result of the target TLS fingerprint based on the sample security label of the matched sample non-leaf node;

[0013] If the first matching information and the second matching information are both characterized as mismatches, and the sample fingerprint information of any sample leaf node matches the target fingerprint information of any target leaf node, the target security detection result of the target TLS fingerprint is determined based on the sample security label of the matching sample leaf node.

[0014] In some embodiments, the target TLS fingerprint is generated according to the following steps, comprising:

[0015] Obtain multiple target TLS information of the target system;

[0016] Classify and process the plurality of target TLS information to obtain target category information of each target TLS information, and determine corresponding target classification chain information based on the target category information, wherein the target classification chain information includes target hierarchical categories sequentially associated with the target category information at each level;

[0017] Based on the target classification chain information, a target TLS configuration tree with a binary tree structure is constructed, with the same target category information as the target bottom-level node and the target hierarchical category as the nodes at different levels above the target bottom-level node. The target initial hash value of each target bottom-level node is determined based on at least one target TLS information under the same target classification chain information.

[0018] Select target levels one by one, and select two adjacent target nodes in the target level, where the target nodes have the same target level category in the previous level; calculate the target hash value of the target node corresponding to the target level category in the previous level based on the two target hash values corresponding to the two target nodes, until a unique target root node hash value is generated, and obtain the target TLS fingerprint corresponding to the target system, the initial value of the target level is the level where the target underlying node is located, the initial value of the target node is the target underlying node, and the initial value of the target hash value is the target initial hash value.

[0019] In some embodiments, any sample TLS fingerprint stored in the fingerprint library is generated by the following steps, including:

[0020] Get multiple sample TLS information of the sample system;

[0021] Classify the multiple sample TLS information to obtain sample category information of each sample TLS information, and determine corresponding sample classification chain information based on the sample category information, where the sample classification chain information includes sample level categories sequentially associated with the sample category information at each level;

[0022] Based on the sample classification chain information, a sample TLS configuration tree with a binary tree structure is constructed, with the same sample category information as the sample bottom-level node and the sample level category as the nodes at different levels above the sample bottom-level node. Based on at least one sample TLS information under the same sample classification chain information, the sample initial hash value of each sample bottom-level node is determined;

[0023] Obtain a security policy table and determine the initial security value of each sample TLS information based on the security policy table;

[0024] Determine the initial security label of the corresponding sample node based on the initial security value of at least one sample TLS information under the same sample classification chain information;

[0025] Select sample levels one by one, and select two adjacent sample nodes in the sample level, where the sample nodes have the same sample level category in the previous level; calculate the sample hash value of the sample node corresponding to the sample level category in the previous level based on the two sample hash values corresponding to the two sample nodes, and determine the sample security label corresponding to the sample node in the previous level based on the sample security labels of the two sample nodes;

[0026] Until a unique sample root node hash value is generated, the sample TLS fingerprint corresponding to the sample system is obtained. The initial value of the sample level is the level where the sample underlying node is located, the initial value of the sample node is the sample underlying node, the initial value of the sample hash value is the sample initial hash value, and the initial value of the sample security label is the initial security label.

[0027] In some embodiments, determining an initial security tag of a corresponding sample node according to an initial security value of at least one sample TLS information under the same sample classification chain information includes:

[0028] Obtaining a default label, wherein the default label includes a preset number of label bits arranged in a fixed order;

[0029] Selecting a dynamic label bit from a plurality of label bits according to the sample classification chain information, and updating the dynamic label bit to obtain an updated label bit according to a security state represented by an initial security value of at least one sample TLS information under the same sample classification chain information;

[0030] The default label is updated based on the updated label bit to obtain the initial security label of each sample node.

[0031] In some embodiments, after aligning the hierarchical structures of the target TLS fingerprint and the sample TLS fingerprint, the method further includes:

[0032] Calculate the fingerprint similarity value between the target TLS fingerprint and the sample TLS fingerprint after structural alignment;

[0033] At least one sample TLS fingerprint matching the target TLS fingerprint is determined based on the fingerprint similarity value and a preset similarity threshold, and a target security detection result of the target TLS fingerprint is determined based on the sample security tag of the sample TLS fingerprint.

[0034] In some embodiments, multiple target TLS information is classified to obtain target category information of each target TLS information, including:

[0035] Parse any target TLS information and obtain the function field corresponding to the target TLS information;

[0036] Match the function field with multiple predefined first initial information, and determine that the matched first initial information is the target category information corresponding to the target TLS information, wherein the first initial information at least includes protocol version information, encryption suite information, certificate chain information, and extended sequence information.

[0037] In some embodiments, determining corresponding target classification chain information based on target category information includes:

[0038] Matching the target category information with a plurality of predefined second initial information, and determining that the matched second initial information is a target hierarchy category of an upper level to which the target category information belongs, wherein the second initial information includes at least TLS basic information, TLS extended information, TLS certificate information, and TLS configuration information;

[0039] The target hierarchical category is used as the new target category information and the matching is repeated until the target category information represented as the boundary is matched, and the target classification chain information is obtained.

[0040] In some embodiments, based on the target classification chain information, a target TLS configuration tree with a binary tree structure is constructed with the same target category information as the target bottom node and the target hierarchical category as the nodes at different levels above the target bottom node, including:

[0041] Based on the target classification chain information, a target initial TLS configuration tree in a tree structure is constructed with the same target category information as the target bottom node and the target hierarchical category as the nodes of different levels above the target bottom node, wherein the target initial TLS configuration tree includes multiple target nodes;

[0042] Traverse the target initial TLS configuration tree and determine the number of child nodes of each target node;

[0043] If the number of any child nodes is not equal to the specified number of the level, add a preset null value node for the corresponding target node;

[0044] When the number of child nodes of all target nodes meets the binary tree structure requirements, the target TLS configuration tree is obtained.

[0045] In some embodiments, determining a target initial hash value for each target underlying node based on at least one target TLS information under the same target classification chain information includes:

[0046] Obtain the standardized rule table and hash function;

[0047] According to the standardized rule table, at least one target TLS information under the same target classification chain information is converted into a corresponding feature string, and all feature strings are concatenated to obtain a TLS string;

[0048] The hash value of each TLS string is calculated based on the hash function, and the hash value of the TLS string is used as the target initial hash value of the corresponding target underlying node.

[0049] To achieve the above objectives, a second aspect of an embodiment of the present application proposes a TLS fingerprint security detection device based on a Merkle tree, comprising:

[0050] an acquisition module, configured to acquire a target TLS fingerprint under a binary tree structure generated by a target system, and select any sample TLS fingerprint having the same binary tree structure from a pre-built fingerprint library, wherein the target TLS fingerprint includes a plurality of target nodes located at different levels determined by the target classification chain information, each target node including target fingerprint information; and the sample TLS fingerprint includes a plurality of sample nodes located at different levels determined by the sample classification chain information, each sample node including sample fingerprint information and a sample security label;

[0051] A matching processing module is used to align the hierarchical structures of the target TLS fingerprint and the sample TLS fingerprint based on the target classification chain information and the sample classification chain information, and compare the target node and the sample node layer by layer from top to bottom;

[0052] The target security detection result module is used to determine the target security detection result of the target TLS fingerprint according to the corresponding sample security label if the sample fingerprint information of any sample node matches the target fingerprint information of the target node at the corresponding position.

[0053] To achieve the above-mentioned purpose, the third aspect of an embodiment of the present application proposes an electronic device, which includes a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements the Merkle tree-based TLS fingerprint security detection method of the above-mentioned first aspect.

[0054] To achieve the above-mentioned objectives, the fourth aspect of an embodiment of the present application proposes a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the Merkle tree-based TLS fingerprint security detection method of the above-mentioned first aspect.

[0055] The present application proposes a TLS fingerprint security detection method, apparatus, device and medium based on Merkle tree, which obtains the target TLS fingerprint under the binary tree structure generated by the target system, and selects any sample TLS fingerprint with the same binary tree structure from a pre-built fingerprint library, wherein the target TLS fingerprint includes a plurality of target nodes at different levels determined by the target classification chain information, each target node includes target fingerprint information, and the sample TLS fingerprint includes a plurality of sample nodes at different levels determined by the sample classification chain information, each sample node includes sample fingerprint information and sample security label, wherein a binary tree structure is used to represent the target TLS fingerprint and the sample TLS fingerprint, which can perform hierarchical and structured management of multiple TLS information, thereby reflecting the different granularities. characteristics of TLS information; then, based on the target classification chain information and the sample classification chain information, the hierarchical structure of the target TLS fingerprint and the sample TLS fingerprint is aligned, and the target node and the sample node are compared hierarchically from top to bottom; if the sample fingerprint information of any sample node matches the target fingerprint information of the target node at the corresponding position, the target security detection result of the target TLS fingerprint is determined according to the corresponding sample security label. In the process of comparing the sample node and the target node at the corresponding position, when the sample fingerprint information matches the target fingerprint information, the target security detection result of the target system can be directly determined according to the corresponding sample security label without the need for complex subsequent analysis and calculation. On the basis of achieving highly granular security detection, the detection time is greatly shortened, which is especially suitable for network security scenarios that require real-time response. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 This is a schematic diagram of an optional implementation environment of a Merkle tree-based TLS fingerprint security detection device provided in an embodiment of the present application;

[0057] Figure 2 This is a schematic diagram of an optional device module of a Merkle tree-based TLS fingerprint security detection device provided in an embodiment of the present application;

[0058] Figure 3 This is an optional flowchart of the TLS fingerprint security detection method based on the Merkle tree provided in an embodiment of the present application;

[0059] Figure 4 yes Figure 3 An optional implementation flowchart of step 101;

[0060] Figure 5 yes Figure 4 An optional implementation flowchart for the steps in (101.1.2);

[0061] Figure 6 yes Figure 4 Another optional implementation flowchart of the steps in (101.1.2);

[0062] Figure 7 This is a schematic diagram of an optional target initial TLS configuration tree for the Merkle tree-based TLS fingerprint security detection method provided in an embodiment of the present application;

[0063] Figure 8 yes Figure 4 An optional implementation flowchart for the steps in (101.1.3);

[0064] Figure 9 This is a schematic diagram of an optional target TLS configuration tree construction for the Merkle tree-based TLS fingerprint security detection method provided in an embodiment of the present application;

[0065] Figure 10 yes Figure 4 Another optional implementation flowchart of the steps in (101.1.3);

[0066] Figure 11 yes Figure 3 Another optional implementation flow chart of step 101;

[0067] Figure 12 This is an optional Merkle tree construction diagram of the Merkle tree-based TLS fingerprint security detection method provided in an embodiment of the present application;

[0068] Figure 13 yes Figure 11 An optional implementation flowchart for the steps in (101.2.5);

[0069] Figure 14 yes Figure 3 An optional implementation flowchart of step 103;

[0070] Figure 15 This is an optional accurate fingerprint comparison flow chart of the TLS fingerprint security detection method based on the Merkle tree provided in the embodiment of the present application;

[0071] Figure 16 yes Figure 3 An optional implementation flowchart after step 102 in FIG.

[0072] Figure 17 This is an optional fuzzy fingerprint comparison flow chart of the Merkle tree-based TLS fingerprint security detection method provided in an embodiment of the present application;

[0073] Figure 18 This is another optional device module diagram of the Merkle tree-based TLS fingerprint security detection device provided in an embodiment of the present application;

[0074] Figure 19 This is a schematic diagram of the hardware structure of the electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0075] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0076] It should be noted that although the device schematics illustrate functional module divisions and the flowcharts illustrate logical sequences, in certain circumstances, the steps shown or described may be performed in a sequence that differs from the module divisions in the device or the sequence in the flowcharts. The terms "first," "second," and so on, in the specification, claims, and drawings, are used to distinguish similar items and are not necessarily used to describe a specific sequence or precedence.

[0077] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this application pertains. The terms used herein are for the purpose of describing the embodiments of this application only and are not intended to limit this application.

[0078] A Transport Layer Security (TLS) fingerprint is a unique identifier generated by analyzing specific parameters used by a client or server during the TLS handshake. TLS fingerprints can be used to identify different software versions, operating systems, or configurations, enabling a range of network security analysis operations.

[0079] In related technologies, TLS information collected from clients or servers (such as protocol version, cipher suite, extension type, etc.) is combined into a string using predetermined rules. A hash function is then applied to this string, and the resulting fixed-length hash value is used as the TLS fingerprint. This TLS fingerprint is then tested to determine whether the client or server's network behavior is secure by analyzing the TLS information. However, because the TLS fingerprint generated by traditional methods is a single, poorly expressive identifier, this method suffers from low granularity in TLS information security testing, making it prone to missed detections and false detections, which can pose network security risks.

[0080] Based on this, the embodiments of the present application provide a TLS fingerprint security detection method, apparatus, device and medium based on the Merkle tree, aiming to improve the granularity of security detection of TLS information, avoid missed detections and false detections, and thus reduce network security risks.

[0081] For example, Figure 1 As shown, Figure 1The figure is a schematic diagram of an optional implementation environment of the Merkle tree-based TLS fingerprint security detection device provided in an embodiment of the present application. The implementation environment includes a client 11 and a server 12, wherein the client 11 and the server 12 are connected via a communication network. When data needs to be transmitted between the client 11 and the server 12, a TLS fingerprint needs to be collected to ensure the security of the data transmission, so that the TLS information represented by the TLS fingerprint can be subsequently security analyzed. To address this situation, the Merkle tree-based TLS fingerprint security detection device proposed in an embodiment of the present application (hereinafter referred to as the "fingerprint security detection device" for ease of description) will perform the following steps: obtain the target TLS fingerprint under the binary tree structure generated by the target system, and select any sample TLS fingerprint with the same binary tree structure from a pre-built fingerprint library, wherein the target TLS fingerprint includes multiple target nodes at different levels determined by the target classification chain information, each target node includes target fingerprint information, and the sample TLS fingerprint includes multiple sample nodes at different levels determined by the sample classification chain information, each sample node includes sample fingerprint information and a sample security label; based on the target classification chain information and the sample classification chain information, align the hierarchical structure of the target TLS fingerprint and the sample TLS fingerprint, and compare the target node and the sample node layer by layer from top to bottom; if the sample fingerprint information of any sample node matches the target fingerprint information of the target node at the corresponding position, determine the target security detection result of the target TLS fingerprint based on the corresponding sample security label. The target system can be either the client 11 or the server 12. It can be understood that the embodiment of the present application obtains the target TLS fingerprint under the binary tree structure generated by the target system, uses the target classification chain information and the sample classification chain information to accurately align the hierarchical structures of the two, and realizes a layer-by-layer comparison based on structured nodes with the sample TLS fingerprint with the same binary tree structure in the pre-built fingerprint library, so as to quickly and accurately determine the security status of the target system according to the sample security label carried by the corresponding sample node.

[0082] The server 12 can be a standalone physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms. Furthermore, the server 12 can be a node server in a blockchain network. The client 11 can be, but is not limited to, a mobile phone, a computer, an intelligent voice interaction device, a smart wearable device, a smart home appliance, an in-vehicle terminal, etc. The client 11 and server 12 can be connected directly or indirectly via wired or wireless communication, which is not limited in this embodiment of the present application.

[0083] It should be noted that in the embodiments of the present application, when it comes to information related to user characteristics such as user basic information or user identity, the user's permission or consent will be obtained first, and the collection, use and processing of such data will comply with relevant laws, regulations and standards. In addition, when the embodiments of the present application need to obtain the user's sensitive personal information, the user's separate permission or consent will be obtained first. After the user's separate permission or consent is clearly obtained, the necessary data for the normal operation of the embodiments of the present application will be obtained. For example, before obtaining the target TLS fingerprint corresponding to the target system, the embodiments of the present application will first obtain the authorization or consent of the relevant personnel of the target system, otherwise the target TLS fingerprint obtained cannot be applied to the embodiments of the present application. In addition, the other relevant data obtained by the fingerprint security detection device of the present application are all authorized data, which will not be repeated here.

[0084] In some embodiments, as Figure 2 As shown, Figure 2 This is a schematic diagram of an optional device module of a Merkle tree-based TLS fingerprint security detection device provided in an embodiment of the present application. The fingerprint security detection device mainly includes three modules:

[0085] (1) TLS information collection module

[0086] First, the client and server establish a TLS handshake connection, perform TLS certificate verification, and finally extract multiple TLS information, such as TLS version, cipher suite, TLS extension, and certificate chain.

[0087] Among them, obtaining multiple TLS information of the target system can be achieved in two ways:

[0088] <1> Active scanning and analysis refers to the process of using a scanning tool or program to directly establish a TLS connection with the target system to obtain TLS information of the target system. The scanning tool can be OpenSSL (OpenSSL is an open source software library package) or TestSSL (TestSSL is a command-line tool);

[0089] For example, assuming that you want to evaluate the TLS version and encryption suite supported by a certain website server, you can use a tool such as OpenSSL to try to establish a TLS connection with the website server and collect multiple TLS information of the website server in the process.

[0090] <2> Passive traffic analysis: This method does not require direct interaction with the target system. Instead, it analyzes the TLS information contained in network traffic by monitoring it. This method is applicable to existing communication flows and does not require initiating new connection requests.

[0091] For example, suppose a monitoring tool is deployed on an enterprise network. This tool captures all packets entering and leaving the network. It analyzes these packets, particularly those using the TLS protocol, to obtain relevant TLS information. The monitoring tool might be TCPDUMP (a command-line network packet capture tool) or Wireshark (a graphical network protocol analyzer).

[0092] It should be noted that the specific method of obtaining multiple TLS information of the target system can be set according to actual conditions, and the specific tool for obtaining TLS information can also be selected according to actual conditions. The embodiments of the present application do not limit this.

[0093] (2) Target TLS fingerprint building module

[0094] Then, after completing the collection of TLS information, the multiple TLS information are classified and processed, including classification processing to construct a TLS configuration tree, wherein the TLS configuration tree includes multiple target nodes; then, the hash value corresponding to each target node is determined; then, a Merkle tree is constructed based on the TLS configuration tree, and the Merkle tree is used as the target TLS fingerprint of the target system.

[0095] (3) TLS security detection module

[0096] Next, any sample TLS fingerprint with the same binary tree structure is selected from the pre-built fingerprint library. After aligning the hierarchical structure of the target TLS fingerprint and the sample TLS fingerprint, it is compared with the target TLS fingerprint layer by layer from top to bottom; and based on the sample security label corresponding to at least one matching sample TLS fingerprint, the target security detection result of the target TLS fingerprint is generated.

[0097] After understanding the general working process of the fingerprint security detection device, the embodiment of the present application will continue to provide an in-depth description from the dimension of the fingerprint security detection device, and the beneficial effects of the Merkle tree-based TLS fingerprint security detection method (for the sake of ease of description, it can also be referred to as the "fingerprint security detection method") applied to the fingerprint security detection device will gradually become apparent. Among them, the fingerprint security detection device can be integrated into a computer device, such as a server. Figure 3 As shown, Figure 3 This is an optional flowchart of the TLS fingerprint security detection method based on the Merkle tree provided in the embodiment of the present application. Figure 3 The flowchart shown may include but is not limited to the following steps 101 to 103. The specific process of the fingerprint security detection device when executing the fingerprint security detection method is as follows. It should be noted that this embodiment is Figure 3 The order of step 101 to step 103 is not specifically limited, and the order of steps can be adjusted or some steps can be reduced or added according to actual needs.

[0098] Step 101: obtain the target TLS fingerprint under the binary tree structure generated by the target system, and select any sample TLS fingerprint with the same binary tree structure from a pre-built fingerprint library, wherein the target TLS fingerprint includes multiple target nodes located at different levels respectively determined by the target classification chain information, and each target node includes target fingerprint information; the sample TLS fingerprint includes multiple sample nodes located at different levels respectively determined by the sample classification chain information, and each sample node includes sample fingerprint information and a sample security label.

[0099] Step 101 is described in detail below.

[0100] In some embodiments, a binary tree structure is used to represent the target TLS fingerprint and the sample TLS fingerprint, which can perform hierarchical and structured management of multiple TLS information. Nodes at different levels can reflect the characteristics of TLS information at different granularities, so that in the subsequent security detection process, the fingerprint security detection device can more accurately identify the match between the target TLS fingerprint and the known sample TLS fingerprint. For some malicious activities disguised as normal TLS connections, the embodiments of the present application can discover their subtle abnormal characteristics through nodes at high granularity, avoid missed detections and false detections, and thus improve the accuracy of network security detection.

[0101] In some embodiments, as Figure 4 As shown, Figure 4 yes Figure 3 In step 101 of an optional implementation flowchart, the target TLS fingerprint is generated according to the following steps, including:

[0102] (101.1.1) Obtain multiple target TLS information of the target system;

[0103] (101.1.2) Classify and process multiple target TLS messages to obtain target category information for each target TLS message, and determine corresponding target classification chain information based on the target category information, the target classification chain information including target hierarchical categories sequentially associated with the target category information at each level;

[0104] (101.1.3) Based on the target classification chain information, construct a target TLS configuration tree with a binary tree structure, with the same target category information as the target bottom node and the target level category as the nodes at different levels above the target bottom node. Determine the target initial hash value for each target bottom node based on at least one target TLS information under the same target classification chain information;

[0105] (101.1.4) Select the target hierarchy one by one, and select two adjacent target nodes in the target hierarchy, where the target nodes have the same target hierarchy category in the previous hierarchy; calculate the target hash value of the target node corresponding to the target hierarchy category in the previous hierarchy based on the two target hash values corresponding to the two target nodes, until a unique target root node hash value is generated, and obtain the target TLS fingerprint corresponding to the target system, where the initial value of the target hierarchy is the hierarchy where the target underlying node is located, the initial value of the target node is the target underlying node, and the initial value of the target hash value is the target initial hash value.

[0106] The following describes steps (101.1.1) to (101.1.4) in detail.

[0107] The target TLS information refers to the various parameters and data involved in communicating using the TLS protocol. This includes, but is not limited to, encryption algorithms, certificate information, and protocol versions. The target system refers to the system that generates the target TLS fingerprint. The target system can be a server, network device, or an application.

[0108] Furthermore, embodiments of the present application acquire multiple target TLS information of the target system in as much detail as possible. For example, when the target system establishes a TLS handshake with another system based on an Internet Protocol address (IP address) or domain name, and when verifying the information based on the relevant certificate, the fingerprint generation device collects multiple target TLS information from these two processes as the basis for subsequently constructing a Merkle tree.

[0109] Furthermore, as shown in Tables 1, 2, and 3 below, commonly used target TLS information is listed, wherein Table 1 is an optional target TLS information example table provided in an embodiment of the present application, Table 2 is an optional certificate chain information example table provided in an embodiment of the present application, and Table 3 is an optional extended sequence information example table provided in an embodiment of the present application:

[0110] Table 1

[0111]

[0112] Table 1

[0113]

[0114] Table 2

[0115]

[0116] Table 3

[0117]

[0118] It should be noted that Tables 1, 2, and 3 are only examples, and the specific TLS information obtained by the target system to generate the target TLS information can be set according to actual conditions. It should also be noted that in order to simplify the generation and subsequent processing of TLS fingerprints, the target TLS information obtained by the traditional method does not include certificate configuration information, which results in insufficient feature dimensions and limited expression capabilities of the TLS fingerprints generated by the traditional method. In actual use, it is very easy to be forged and counterfeited by attackers, thereby threatening related network security operations. In comparison, the embodiments of the present application will obtain the target TLS information as comprehensively as possible, especially the certificate configuration information related to the certificate, so that the target TLS fingerprint with strong expression capabilities can be constructed based on multiple target TLS information in multiple aspects and dimensions.

[0119] Among them, target category information refers to the identifier or attribute obtained after classifying the target TLS information, which reflects the characteristics and properties of the target TLS information; the target classification chain information describes the complete path of a target TLS information in the tree classification system, reflecting the logical belonging relationship of each target TLS information from the bottom to the top in the system. The target classification chain information includes target category information and at least one target hierarchical category; the target hierarchical category is used to characterize the classification standards or characteristics of different levels above the target category information.

[0120] Among them, the binary tree structure is a tree data structure. The target TLS configuration tree stipulates that each node has at most two child nodes, and the two child nodes are usually divided into left child nodes and right child nodes. In addition, the target TLS configuration tree has a special node called the root node (without a parent node), and a node without a child node is called a leaf node. Nodes other than the root node and leaf nodes are called non-leaf nodes. Except for the root node, each node has a parent node.

[0121] Furthermore, the target TLS configuration tree with a binary tree structure can cover more target TLS information, thereby enhancing the expression capability of the target TLS fingerprint subsequently determined, so that the target TLS fingerprint obtained based on the Merkle tree can be used for security analysis or data integrity verification; at the same time, the target TLS fingerprint obtained based on the target TLS configuration tree is also a binary tree structure, which enables the relevant system or device to quickly retrieve the information contained in the target TLS fingerprint after obtaining the target TLS fingerprint.

[0122] The target level refers to the level where the hash value is currently being calculated. The initial value of the target level is the level where the target underlying node (leaf node) is located. The initial value of the target node is the target underlying node. The initial value of the target hash value is the target initial hash value. In a tree data structure, the root node refers to a node without a parent node. It is the top node of the entire tree structure, such as Figure 7 As shown, the root node of the target TLS configuration tree is "TLS Configuration".

[0123] Furthermore, the embodiment of the present application constructs a Merkle tree by merging hash values layer by layer, and ultimately uses the multi-level Merkle tree as the target TLS fingerprint corresponding to the target system. Specifically, starting from the bottom layer of the target TLS configuration tree, two adjacent nodes with the same parent node are selected each time, and the calculated hash values are concatenated and hashed again to obtain the hash value of the parent node; this process is repeated until the root node hash value is calculated, forming a complete Merkle tree structure.

[0124] Furthermore, compared with the fingerprint obtained by simple hashing in the traditional method, the target TLS fingerprint under the Merkle tree structure obtained in the embodiment of the present application can express the content of multiple target TLS information more finely, thereby improving the expressive ability of the target TLS fingerprint; at the same time, the characteristics of the Merkle tree make it possible for any modification of the target TLS information to result in a change in the final fingerprint, thereby facilitating the subsequent effective detection of tampering behavior and improving the reliability of related network security operations.

[0125] Furthermore, the embodiment of the present application classifies multiple target TLS information, classifies each target TLS information into a specific category, and constructs target classification chain information based on these target category information, so as to subsequently form a target TLS fingerprint under a binary tree structure based on the target classification chain information and the target category information.

[0126] Furthermore, target fingerprint information refers to the characteristic hash value extracted from each target node within the generated target TLS information. This uniquely identifies the TLS configuration characteristics of the target system at a specific node. Target fingerprint information reflects the processed TLS parameters (such as TLS version, cipher suite, and certificate chain) contained in the target node and is the minimum granularity required to verify the security of the target TLS fingerprint.

[0127] In some embodiments, as Figure 5 As shown, Figure 5 yes Figure 4 An optional implementation flowchart of step (101.1.2) in the embodiment of the present invention classifies multiple target TLS messages to obtain target category information of each target TLS message, including:

[0128] (A.1) Parse any target TLS message and obtain the function field corresponding to the target TLS message;

[0129] (A.2) Match the function field with multiple predefined first initial information, and determine that the matched first initial information is the target category information corresponding to the target TLS information, wherein the first initial information includes at least protocol version information, encryption suite information, certificate chain information, and extended sequence information.

[0130] The following describes steps (A.1) and (A.2) in detail.

[0131] Among them, the function field is a key field extracted from the target TLS information, which can reflect the characteristics and functions of the corresponding target TLS information. Based on the function field, the classification of multiple target TLS information can be realized; the first initial information refers to the pre-defined category to which the target TLS information belongs.

[0132] Exemplarily, a target TLS information is obtained as TLSv1.3; the function field of the target TLS information is parsed to be TLSv; the function field TLSv is matched with a plurality of predefined first initial information, and the target category information to which the target TLS information belongs is determined to be "protocol version information".

[0133] Furthermore, to implement the fingerprint security detection method proposed in the embodiment of the present application, the predefined first initial information includes at least the following:

[0134] (1) Protocol version information (TLS version): Protocol version information refers to the specific version number used in TLS communication. It indicates the adopted protocol standard and its characteristics, affecting the selection and security of the encryption algorithm. Different versions of TLS protocols differ in security and performance. Newer versions usually provide stronger security and higher efficiency.

[0135] (2) Cipher suite information (Cipher suite): Cipher suite information refers to the combination of encryption algorithms negotiated during the TLS handshake process, which determines the security and integrity of data transmission. Specifically, it may include symmetric encryption algorithm (Advanced Encryption Standard, AES), asymmetric encryption (Rivest-Shamir-Adleman Algorithm, RSA) and hash algorithm 256 (Secure Hash Algorithm 256-bit, SHA-256).

[0136] (3) Certificate chain information (certificate chain): Certificate chain information refers to the certificate chain information provided by the target system to other systems or other devices in a communication connection. Certificate chain information usually includes a server certificate, one or more intermediate certificates, and a root certificate. Certificate chain information is used to verify the identity of the target system, ensure the legitimacy of the connection, and prevent man-in-the-middle attacks.

[0137] (4) Extended Sequence Information (Extended Sequence): Extended sequence information is an optional extension field used in the TLS handshake process. It represents the additional functions or parameters that the target system is allowed to use, such as supported compression algorithms, Server Name Indication (SNI) and Application-Layer Protocol Negotiation (ALPN). Extended sequence information makes the TLS protocol more flexible and can support a variety of application scenarios and requirements, thereby improving the adaptability and functionality of the protocol.

[0138] It should be noted that the pre-defined first initial information may also include supporting signature information, shared key information, certificate validity information, certificate revocation status, certificate public key information, certificate issuance information, etc. The specific content represented by the first initial information can be set according to actual conditions. The embodiment of the present application does not impose any restrictions on this, so that the fingerprint generation device can match the function field obtained by parsing to the corresponding first initial information during actual use.

[0139] In some embodiments, as Figure 6 As shown, Figure 6 yes Figure 4 Another optional implementation flowchart of step (101.1.2) in the embodiment of the present invention, determining corresponding target classification chain information based on target category information, includes:

[0140] (B.1) matching the target category information with a plurality of predefined second initial information, and determining that the matched second initial information is a target hierarchical category of a level above that to which the target category information belongs, wherein the second initial information includes at least TLS basic information, TLS extended information, TLS certificate information, and TLS configuration information;

[0141] (B.2) The target hierarchical category is used as the new target category information and the matching is repeated until the target category information represented as the boundary is matched, thereby obtaining the target classification chain information.

[0142] Steps (B.1) and (B.2) are described in detail below.

[0143] Among them, the second initial information refers to another set of predefined higher-level classification labels that are different from the first initial information, which reflects the information characterization result obtained by logical aggregation of the first initial information; the second initial information that matches the target category information is determined to be the target hierarchical category, and the target hierarchical category is used to describe the higher-level characteristics of the target TLS information above the target category information.

[0144] Furthermore, to implement the fingerprint security detection method proposed in the embodiment of the present application, the predefined second initial information includes at least the following content: extended sequence information.

[0145] (1) TLS basic information (corresponding to Figure 7 Basic configuration in): TLS basic information refers to the most basic protocol parameters and features in a TLS connection, and the protocol version information and encryption suite information in the target category information of the embodiment of the present application all belong to TLS basic information.

[0146] (2) TLS extended information (corresponding to Figure 7Extended configuration in): TLS extended information refers to the optional extension field negotiated during the TLS handshake process, which allows the client and server to support additional functions or parameters, and the extended sequence information in the target category information of the embodiment of the present application belongs to TLS extended information.

[0147] (3) TLS certificate information (corresponding to Figure 7 Certificate configuration in): TLS certificate information refers to the digital certificate and its related attributes related to the TLS connection, and the certificate chain information in the target category information of the embodiment of the present application belongs to TLS certificate information.

[0148] (4) TLS configuration information (corresponding to Figure 7 TLS configuration in): TLS configuration information refers to all parameters related to the TLS connection process, and the TLS basic information, TLS extension information, and TLS certificate information in the embodiments of the present application all belong to TLS configuration information; TLS configuration information is represented as the end boundary of all target classification chain information.

[0149] It should be noted that the pre-defined second initial information may also include key information, session recovery information, application layer protocol information, etc. The specific content represented by the second initial information can be set according to actual conditions. The embodiment of the present application does not limit this, so that in actual use, the fingerprint generation device can match the corresponding second initial information according to the target category information to which the target TLS information belongs.

[0150] For example, Figure 7 As shown, Figure 7 This is a schematic diagram of an optional target initial TLS configuration tree for the Merkle tree-based TLS fingerprint security detection method provided in an embodiment of the present application. Figure 7 It is indicated that the target TLS information a is obtained as "version 1" and the target TLS information b is obtained as "suite 1"; based on steps (A.1) to (A.2), the target category information of the target TLS information a is determined to be "TLS version", and the target category information of the target TLS information b is determined to be "encryption suite"; then, the target category information is matched with a plurality of predefined second initial information to determine that the target hierarchy category of the upper level of "TLS version" and "encryption suite" is both "basic configuration"; then, the target hierarchy category is used as new target category information and continues to be matched with a plurality of second initial information to determine that the target hierarchy category of the upper level of "basic configuration" is "TLS configuration" characterized as a boundary, thereby obtaining the target classification chain information of the target TLS information a as "TLS version-basic configuration-TLS configuration" and the target classification chain information of the target TLS information b as "encryption suite-basic configuration-TLS configuration".

[0151] Furthermore, multiple second initial information can be hierarchically processed in advance so that steps (B.1) to (B.2) can match the second initial information of the corresponding level. Figure 7 In the example, "TLS version" belongs to both "basic configuration" and "TSL configuration", but the pre-classification processing results limit the second initial information that can match "TLS version" to only basic information, certificate configuration and extended configuration. Therefore, in this match, the target hierarchy category of the upper level to which the target category information belongs will not be mistakenly determined to be "TLS configuration".

[0152] In some embodiments, as Figure 8 As shown, Figure 8 yes Figure 4 An optional implementation flowchart for steps (101.1.3) in the target classification chain is used to construct a target TLS configuration tree with a binary tree structure, using the same target category information as the target bottom node and the target hierarchical category as the nodes at different levels above the target bottom node, including:

[0153] (C.1) Based on the target classification chain information, a target initial TLS configuration tree is constructed in a tree structure with the same target category information as the target bottom node and the target hierarchical category as the nodes at different levels above the target bottom node, wherein the target initial TLS configuration tree includes multiple target nodes;

[0154] (C.2) Traverse the target initial TLS configuration tree and determine the number of child nodes of each target node;

[0155] (C.3) If the number of any child nodes is not equal to the specified number of the level, add a preset null value node to the corresponding target node;

[0156] (C.4) When the number of child nodes of all target nodes meets the binary tree structure requirements, the target TLS configuration tree is obtained.

[0157] Steps (C.1) to (C.4) are described in detail below.

[0158] In some embodiments, as Figure 7 As shown, Figure 7A target initial TLS configuration tree with a depth of 4 is constructed based on the obtained multiple target TLS information. The multiple target TLS information includes n versions, m suites, j certificates, and k extensions. The specific values represented by n, m, j, and k can be set according to actual circumstances. Specifically, the target category information for "version 1" is "TLS version," the target classification chain information for "version 1" is "TLS version-basic configuration-TLS configuration," the target category information for "version n" is "TLS version," and the target classification chain information for "version n" is also "TLS version-basic configuration-TLS configuration." That is, "TLS version" is the same target category information corresponding to multiple target TLS information. Therefore, "TLS version" is used as the target bottom node, and the nodes at different levels above the target category information are determined based on the target classification chain information corresponding to "TLS version." In this example, the node one level above "TLS version" is "basic configuration," and the node one level above "basic configuration" is "TLS configuration." Similar operations are performed based on the target category information and target classification chain information corresponding to other target TLS information to obtain the target initial TLS configuration tree. Each node in the target initial TLS configuration tree is called a target node. For example, Figure 7 "TLS Configuration", "Basic Configuration" and "Certificate Chain" are all target nodes.

[0159] Furthermore, to ensure the balance of the resulting target TLS configuration tree, "null nodes" ("NULL") may be introduced. Null nodes do not actually contain valid data, but are used to fill tree positions that are not assigned actual data due to insufficient data. This maintains the integrity and symmetry of the tree structure, ensuring that the height, hierarchical relationships, and other properties of the resulting target TLS configuration tree meet design requirements.

[0160] Specifically, check whether the target initial TLS configuration tree meets the structural requirements of the binary tree, that is, each target node except the target bottom node has only two child nodes. If the number of child nodes does not meet the requirements, add a preset null value node to the corresponding target node until the target TLS configuration tree that meets the binary tree structure requirements is obtained.

[0161] Or, as Figure 9 As shown, Figure 9 This is a schematic diagram of an optional target TLS configuration tree construction method based on the Merkle tree provided by the embodiment of the present application. It first determines the height of the target TLS configuration tree finally generated based on the data block characterized as "target category information". For example, if the number of data blocks N is equal to 2 n(N≥2, n≥1, N=2n), then a target TLS configuration tree with a height of n+1 can be constructed; if the number of target category information is not equal to 2 n , assuming N is less than 2 a and greater than or equal to 2 b (N ≥ 1, a > b ≥ 1, 2a > N ≥ 2b), then (2a - N) null value nodes ("NULL" data blocks) need to be added to calculate the hash values of each data block and construct a TLS configuration tree of height (a + 1). Furthermore, to improve data management efficiency, each data block can be assigned a corresponding security label.

[0162] In some embodiments, as Figure 10 As shown, Figure 10 yes Figure 4 Another optional implementation flowchart of step (101.1.3) in the embodiment of the present invention, determining the target initial hash value of each target underlying node based on at least one target TLS information under the same target classification chain information, includes:

[0163] (D.1) Obtaining a standardized rule table and hash function;

[0164] (D.2) According to the standardized rule table, convert at least one target TLS information under the same target classification chain information into a corresponding feature string, and concatenate all feature strings to obtain the TLS string;

[0165] (D.3) Calculate the hash value of each TLS string based on the hash function, and use the hash value of the TLS string as the target initial hash value of the corresponding target underlying node.

[0166] Steps (D.1) to (D.3) are described in detail below.

[0167] The standardized rule table is a set of predefined rules used to convert target TLS information in different formats into a simplified, unified signature string. A hash function is a special function that maps data of arbitrary length to an output value of fixed length, commonly referred to as a hash value. Hash functions can include Message Digest Algorithm 5 (MD5) and Secure Hash Algorithm 256 (SHA-256). The embodiments of this application do not limit the hash function used in actual applications.

[0168] Furthermore, as shown in Table 4, Table 4 is an optional standardized conversion example table provided in an embodiment of the present application, which illustrates an optional standardization rule for target TLS information. In actual application, the mapping rule of target TLS information to feature string can be adaptively set according to actual conditions, and the embodiment of the present application does not impose any restrictions on this.

[0169] Table 4

[0170]

[0171] Exemplarily, the target classification chain information of "version 1" to "version n" is the same. Therefore, after converting "version 1" to "version n" into corresponding feature strings, all feature strings of "version 1" to "version n" are concatenated to obtain the TLS string corresponding to the "TLS version"; then, a hash function is used to determine the hash value corresponding to the TLS string, and the hash value is used as the target initial hash value of the target classification chain information represented as the "TLS version".

[0172] In some embodiments, as Figure 11 As shown, Figure 11 yes Figure 3 In another optional implementation flowchart of step 101, any sample TLS fingerprint stored in the fingerprint library is generated by the following steps, including:

[0173] (101.2.1) Obtain TLS information for multiple samples of the sample system;

[0174] (101.2.2) Classify multiple sample TLS information to obtain sample category information for each sample TLS information, and determine corresponding sample classification chain information based on the sample category information, where the sample classification chain information includes the sample level categories associated with the sample category information at each level;

[0175] (101.2.3) Based on the sample classification chain information, construct a sample TLS configuration tree with a binary tree structure, with the same sample category information as the sample bottom-level node and the sample level category as the nodes at different levels above the sample bottom-level node. Determine the sample initial hash value of each sample bottom-level node based on at least one sample TLS information under the same sample classification chain information;

[0176] (101.2.4) Obtain the security policy table and determine the initial security value of each sample TLS information based on the security policy table;

[0177] (101.2.5) Determine the initial security label of the corresponding sample node based on the initial security value of at least one sample TLS information under the same sample classification chain information;

[0178] (101.2.6) Select sample levels one by one, and select two adjacent sample nodes in the sample level, where the sample nodes have the same sample level category in the previous level; calculate the sample hash value of the sample node corresponding to the sample level category in the previous level based on the two sample hash values corresponding to the two sample nodes, and determine the sample security label corresponding to the sample node in the previous level based on the sample security labels of the two sample nodes;

[0179] (101.2.7) Until a unique sample root node hash value is generated, the sample TLS fingerprint corresponding to the sample system is obtained, the initial value of the sample level is the level where the sample bottom node is located, the initial value of the sample node is the sample bottom node, the initial value of the sample hash value is the sample initial hash value, and the initial value of the sample security label is the initial security label.

[0180] Steps (101.2.1) to (101.2.7) are described in detail below.

[0181] The sample system refers to the system that generates the sample TLS fingerprint. The sample system can be a server, network device, or an application. The sample system and the target system can be the same or different. The generation method of the sample TLS information is similar to that of the target TLS information. For the sake of distinction, "sample" is used instead of "target." Therefore, the similarities are not repeated here.

[0182] Furthermore, unlike the target TLS fingerprint, the sample node includes not only the sample fingerprint information but also a sample security tag. The sample security tag is used to identify the security status of the sample TLS information represented by each sample node in the sample TLS fingerprint, indicating whether the sample TLS information contained in the corresponding sample node has security risks or vulnerabilities. This provides a basis for security testing of the target TLS fingerprint and helps determine whether the target TLS information configuration of the target system is secure or contains potential threats.

[0183] The security policy table is a set of predefined rules and standards used to evaluate the security of each sample TLS message and help identify potential security risks. As shown in Table 5, Table 5 is an optional security policy example table provided in the embodiment of this application:

[0184] Table 5

[0185]

[0186] It should be noted that Table 5 only shows some security identification rules. The security identification rules contained in the actual security policy table are more detailed and complex. This is only an example for ease of understanding and does not mean that the security identification rules actually used are limited to Table 5.

[0187] Furthermore, after determining the initial security value corresponding to each sample TLS message based on the security policy table, the initial security label for the corresponding sample node is determined based on the initial security value of at least one sample TLS message under the same classification chain information. Assuming that the multiple sample TLS messages obtained all belong to a sample node characterized as "TLS version," the initial security label corresponding to the "TLS version" sample node can be set to "secure" if the initial security values of all sample TLS messages under the "TLS version" sample node are characterized as "secure." Otherwise, if at least one initial security value is characterized as "unsecure," the initial security label for the "TLS version" sample node is also characterized as "unsecure." Of course, this is only an example of a feasible initial security label setting rule, and specific adjustments can be made based on actual circumstances. For example, the initial security label for the "TLS version" sample node can be set to "unsecure" only when the number of initial security values characterized as "unsecure" under the same category reaches a certain number (greater than 1).

[0188] In some embodiments, in addition to determining the sample TLS fingerprint based solely on the hash value corresponding to each sample TLS information, the sample TLS fingerprint may also be determined in combination with the security tag. Figure 12 As shown, Figure 12 This is an optional Merkle tree construction diagram of the TLS fingerprint security detection method based on the Merkle tree provided in the embodiment of the present application. Figure 12 This article briefly demonstrates the construction process of a Merkle tree of height 4. For any sample node, it includes a hash value (Hash / H) and a security label (Label / L). Specifically, for the hash value portion: a hash is calculated for the "TLS string" or "NULL." If Hash(x) represents the hash value of sample node x, then for any pair of adjacent sample nodes A and B, the hash value of their parent (upper-level) node P can be expressed as Hash(Hash(A)+Hash(B)), where "+" represents a string concatenation operation. For example, Hash(1-2) = (Hash1+Hash2). In addition, the sample node can also be extended to include security label attributes: first determine the initial security label corresponding to the bottom sample node, then the security label of each non-leaf sample node in the Merkle tree is obtained by the logical operation "AND operation" based on the security labels of its two child nodes; for the security label part: if Label (x) represents the security label of the sample node x, then for any pair of adjacent sample nodes A and B, the security label corresponding to their father (upper layer) node P can be expressed as Label (A) & Label (B), where "&" represents the AND operation. Until a unique root node hash value is generated, the constructed Merkle tree is obtained, and the Merkle tree is used as the sample TLS fingerprint corresponding to the sample system. Figure 12 The root node hash value in is "Hash(1-8)".

[0189] Furthermore, the fingerprint library that was finally built contains fingerprint data records of three types of sample TLS fingerprints (root fingerprint, leaf fingerprint, and non-leaf fingerprint). The root fingerprint is used to record the root hash value and child node information of the sample TLS fingerprint, the leaf fingerprint is used to record the leaf node hash value of the sample TLS fingerprint, and the non-leaf fingerprint is used to record the hash values and child node information of other nodes.

[0190] Furthermore, the table structure of the fingerprint library can be as shown in Table 6, which specifically includes: ID, TYPE (node type), hash value, left child node ID, right child node ID, corresponding TLS information feature description (such as WEB client name, malware family, WEB server name, etc.), security label (such as secure configuration / insecure configuration, valid certificate / invalid certificate, secure extension / insecure extension, normal software / malware, etc.).

[0191] Table 6

[0192]

[0193] Furthermore, once the Merkle tree is constructed, a hash tree is generated, which serves as the fingerprint of the sample system. It uniquely identifies all key security parameters in a client or server session connection. This can then be compared with fingerprints in a known TLS security configuration database. If a certain level of fingerprint is not found in the security configuration list or matches a known insecure configuration, the TLS connection can be considered to have a security risk. Furthermore, given that TLS protocols, encryption technologies, and best practices change over time, it is necessary to regularly update the security configuration database and re-evaluate existing TLS fingerprints to ensure continued security.

[0194] It is understood that while determining the hash value corresponding to each sample node layer by layer, the embodiments of this application also aggregate security labels layer by layer upward to obtain security labels that reflect the security status of each sample node. In this way, the sample TLS fingerprint not only uniquely identifies each sample TLS information but also reflects its security, facilitating subsequent security assessments and risk management, thereby more effectively identifying and responding to potential security threats.

[0195] In some embodiments, as Figure 13 As shown, Figure 13 yes Figure 11 An optional implementation flowchart of step (101.2.5) in the example, determining the initial security label of the corresponding sample node based on the initial security value of at least one sample TLS information under the same sample classification chain information, including:

[0196] (E.1) Obtaining a default tag, wherein the default tag includes a preset number of tag bits arranged in a fixed order;

[0197] (E.2) selecting a dynamic label bit from the plurality of label bits according to the sample classification chain information, and updating the dynamic label bit to obtain an updated label bit according to a security state represented by an initial security value of at least one sample TLS information under the same sample classification chain information;

[0198] (E.3) Update the default label based on the updated label bit to obtain the initial security label of each sample node.

[0199] Steps (E.1) to (E.3) are described in detail below.

[0200] The default tag is a predefined fixed-length binary tag, such as "00000000", which contains 8 tag bits. The tag bits are arranged in a fixed order, and each tag bit corresponds to a type of security attribute. The corresponding value of each tag bit is used to identify the security status of the corresponding sample TLS information. The dynamic tag bit is a tag bit selected from the default tag. Different classification chain information corresponds to different dynamic tag bits, so as to identify the security status of multiple sample TLS information under the same category information. For example, the last tag bit is used to identify the security status of the sample node characterized as "TLS version".

[0201] In some embodiments, the security label design scheme is shown in Table 7, which is an optional security label design example table provided in an embodiment of the present application. In order to efficiently disseminate security labels, a binary identification method can be used. Each bit (label bit) starting from the end identifies the TLS version security, encryption suite security, extended sequence security, certificate signature algorithm security, certificate status security, and software security in sequence (this is only an example and does not represent a limitation of the embodiment of the present application). For example, if the corresponding bit is 0, it means security and if it is 1, it means insecurity. The security label design scheme can be expanded according to different security requirements.

[0202] Table 7

[0203]

[0204] Table 7

[0205]

[0206] Step 102: Based on the target classification chain information and the sample classification chain information, align the hierarchical structures of the target TLS fingerprint and the sample TLS fingerprint, and compare the target node and the sample node layer by layer from top to bottom.

[0207] Step 102 is described in detail below.

[0208] In some embodiments, the target classification chain information and the sample classification chain information are first used to accurately align the hierarchical structures of the target TLS fingerprint and the sample TLS fingerprint, thereby ensuring that the nodes of the two at the same level and position can correspond one to one. For example, the target classification chain information and the sample classification chain information, which are also characterized as "TLS version-basic configuration-TLS configuration", are aligned so that the target nodes and sample nodes at the same position have comparative significance; then, the corresponding target nodes and sample nodes are compared layer by layer in a top-down order to determine the security status of the target TLS fingerprint. Step 102 not only ensures the structural consistency and accuracy of the fingerprint comparison, but also can identify subtle differences at different levels, enhance the accuracy and robustness of the match, and improve the granularity of security detection of TLS information through hierarchical alignment and layer-by-layer comparison, avoid missed detections and false detections, and thus reduce network security risks.

[0209] Step 103: If the sample fingerprint information of any sample node matches the target fingerprint information of the target node at the corresponding position, the target security detection result of the target TLS fingerprint is determined according to the corresponding sample security tag.

[0210] Step 103 is described in detail below.

[0211] In some embodiments, when comparing sample nodes and target nodes at corresponding locations, if the sample fingerprint matches the target fingerprint, the target security detection result for the target system can be directly determined based on the corresponding sample security tag, eliminating the need for complex subsequent analysis and calculations. This significantly reduces detection time while achieving highly granular security detection, making it particularly suitable for network security scenarios requiring real-time response.

[0212] Among them, the target security detection result refers to the assessment result of the security status of the target system obtained based on the sample security label corresponding to the sample TLS fingerprint that matches the target TLS fingerprint. The target security detection result can be used to guide subsequent security protection measures and decisions.

[0213] Furthermore, the target security detection result can be a security detection report generated based on the corresponding sample security label. Specifically, the security detection results corresponding to each target node are first summarized, including the matching of unsafe target fingerprint information (such as weak encryption suites, outdated protocol versions), malware fingerprint matching, application identification and classification, botnet fingerprint matching, man-in-the-middle attack fingerprint matching, client device fingerprint matching, zero-day attack fingerprint matching, threat intelligence fingerprint matching, and certificate security fingerprint matching (such as self-signed, expired certificates); then, through classification and priority sorting, high-risk issues (such as known malware, serious configuration vulnerabilities) are placed at the forefront of the report, and detailed repair suggestions are provided (such as updating protocol versions, disabling weak encryption suites); finally, the security detection report can be displayed through visual charts (such as risk distribution maps, fingerprint matching statistics) to help the security team quickly understand the current security status of the target system and take subsequent actions.

[0214] In addition, the fingerprint security detection method proposed in the embodiment of the present application can be used in the following security detection scenarios. Of course, this is only an example and does not mean that the embodiment of the present application limits the actual security detection scenarios:

[0215] (1) TLS configuration security detection: Identify and detect the security of TLS configuration by analyzing the characteristics of the TLS handshake process (such as supported encryption suites, extensions, protocol versions, etc.) to identify potential security risks.

[0216] (2) Malware Detection: Malware often uses specific TLS libraries or configurations, and its TLS fingerprint may be different from normal traffic. By identifying the TLS fingerprint of malware, its communication can be quickly detected and blocked.

[0217] (3) Botnet Detection: Botnet C2 servers often use specific TLS configurations, and their TLS fingerprints may be different from those of legitimate servers. By identifying the TLS fingerprint of the C2 server, botnet communications can be detected and blocked.

[0218] (4) Application identification and classification: Different applications (such as browsers, mobile applications, and IoT devices) use different TLS libraries and configurations and have unique TLS fingerprints. By identifying these fingerprints, network traffic can be classified and monitored.

[0219] (5) Man-in-the-middle attack detection: Man-in-the-middle attack tools (such as SSLStrip and mitmproxy) usually use specific TLS configurations, and their TLS fingerprints may be different from legitimate traffic. By identifying the TLS fingerprints of these tools, man-in-the-middle attacks can be detected and blocked.

[0220] (6) Client device identification: Different client devices (such as Windows, macOS, Android, and iOS) use different TLS libraries and configurations and have unique TLS fingerprints. By identifying these fingerprints, client devices can be classified and monitored.

[0221] (7) Zero-day attack detection: Zero-day attacks may use new TLS configurations or libraries, and their TLS fingerprints may be different from known traffic. By analyzing the abnormal behavior of TLS fingerprints, potential zero-day attacks can be detected.

[0222] (8) Threat intelligence sharing: Combining TLS fingerprints with threat intelligence databases can quickly identify known threats.

[0223] Furthermore, traditional security detection methods may only rely on a few macro features, which can easily lead to misjudgments. However, the embodiments of the present application use detailed fingerprint information for comparison, which can more comprehensively and accurately identify the true security status of the target system. For some seemingly abnormal situations that are actually normal business changes, accurate fingerprint matching can avoid missing security threats, thereby improving the accuracy of security detection.

[0224] In some embodiments, as Figure 14 As shown, Figure 14 yes Figure 3 Step 103 in the flowchart is an optional implementation. If the sample fingerprint information of any sample node matches the target fingerprint information of the target node at the corresponding position, the target security detection result of the target TLS fingerprint is determined according to the corresponding sample security tag, including:

[0225] (103.1.1) Obtain first matching information between the sample fingerprint information of the sample root node and the target fingerprint information of the target root node. If the first matching information indicates a match, determine the target security detection result of the target TLS fingerprint based on the sample security tag corresponding to the sample root node;

[0226] (103.1.2) If the first matching information indicates a mismatch, obtain second matching information between the sample fingerprint information of any sample non-leaf node and the target fingerprint information of any target non-leaf node. If the second matching information indicates a match, determine the target security detection result of the target TLS fingerprint based on the sample security tag of the matched sample non-leaf node.

[0227] (103.1.3) If both the first matching information and the second matching information are characterized as mismatches, and the sample fingerprint information of any sample leaf node matches the target fingerprint information of any target leaf node, determine the target security detection result of the target TLS fingerprint based on the sample security label of the matched sample leaf node.

[0228] The following describes steps (103.1.1) to (103.1.3) in detail.

[0229] In some embodiments, the target TLS fingerprint is sequentially a target root node, a target non-leaf node, and a target leaf node from top to bottom to target nodes of different levels, and the sample TLS fingerprint is sequentially a sample root node, a sample non-leaf node, and a sample leaf node from top to bottom to sample nodes of different levels. Figure 12 As shown, Hash(1-8) is the sample root node, Hash(1-2), Hash(3-4), Hash(1-4), Hash(5-6), Hash(7-8), and Hash(5-8) are all sample non-leaf nodes, and Hash1, Hash2, Hash3, Hash4, Hash5, Hash6, Hash7, and Hash8 are all sample non-leaf nodes.

[0230] Furthermore, the fingerprint security detection methods proposed in the embodiments of the present application include two methods: <1> Accurate fingerprint matching; <2> Fuzzy fingerprint matching. Specifically, you can choose to perform precise fingerprint matching or fuzzy fingerprint matching according to different security detection scenarios. Among them, precise fingerprint matching only needs to accurately match a hash value in the fingerprint library to determine the security status of the corresponding target system. It is suitable for security detection scenarios such as TLS configuration security detection and man-in-the-middle attack detection with simple security judgment rules and high certainty; while fuzzy fingerprint matching needs to calculate the similarity between it and a Merkle hash tree in the fingerprint library to determine the degree of similarity with a certain system. It is suitable for security detection scenarios such as malware detection, client device identification, zero-day attack detection, etc. with complex security judgment rules and family classification.

[0231] First, let’s introduce <1> Accurate fingerprint comparison: traverse the target TLS fingerprint through the Breadth-First Search (BFS) algorithm and compare it with the sample TLS fingerprints in the known fingerprint library one by one:

[0232] In some embodiments, as Figure 15 As shown, Figure 15This is an optional precise fingerprint comparison flow chart of the Merkle tree-based TLS fingerprint security detection method provided in an embodiment of the present application. When the target TLS fingerprint and any sample TLS fingerprint are aligned, the root node fingerprint information is first matched, and the target fingerprint information corresponding to the target root node of the target TLS fingerprint is compared with the sample fingerprint information corresponding to the sample root node of the sample TLS fingerprint, and first matching information representing the matching result is obtained; if the first matching information is characterized as a match, the target security detection result is obtained directly based on the sample security label corresponding to the sample root node. Specifically, the sample security label of the sample root node is obtained by performing an "AND operation" based on the sample security label corresponding to the lower-level child node. Therefore, the security status of the target TLS information under each category of the target system can be judged according to the specific value of each label bit;

[0233] If the first matching information is characterized as a mismatch, the matching of the fingerprint information of the non-leaf nodes will be performed. It should be noted that in actual application, more than one layer of non-leaf nodes may be included, so the matching of the fingerprint information of the non-leaf nodes will be performed layer by layer from top to bottom. Specifically, the target fingerprint information corresponding to the target non-leaf node of the target TLS fingerprint is compared with the sample fingerprint information corresponding to the sample non-leaf node of the sample TLS fingerprint, and the second matching information representing the result of this matching is obtained; if the second matching information is characterized as a match, the target security detection result is obtained directly based on the sample security label corresponding to the matched sample non-leaf node.

[0234] If both the first matching information and the second matching information are characterized as mismatches, the process enters the matching of leaf node fingerprint information, and compares the target fingerprint information corresponding to the target leaf node of the target TLS fingerprint with the sample fingerprint information corresponding to the sample leaf node of the sample TLS fingerprint; if they match, the target security detection result is obtained directly based on the sample security label corresponding to the matched sample leaf node; if they do not match, the target security detection result is obtained, indicating that the default target system has a TLS security risk.

[0235] It is understandable that the embodiment of the present application adopts a hierarchical matching strategy to perform security detection on the target TLS fingerprint in a progressive layer-by-layer manner: first, a macro match is performed through the overall fingerprint of the root node to quickly capture the overall security status; when the root node match fails, the intermediate level of non-leaf nodes is matched instead, and the matching is refined to the key classification and attributes of TLS information to further explore potential risks; if there is still no match for the non-leaf node, the specific TLS information is compared one by one at the leaf node level to achieve accurate identification of the most subtle features of the TLS information. When the generated TLS fingerprint is a binary tree structure, such fine-grained progressive matching improves the accuracy and sensitivity of the detection, and effectively reduces missed detections and false alarms, significantly improving the credibility and practical value of the security detection results in actual applications.

[0236] In some embodiments, as Figure 16 As shown, Figure 16 yes Figure 3 An optional implementation flowchart after step 102 in the embodiment further includes, after aligning the hierarchical structures of the target TLS fingerprint and the sample TLS fingerprint:

[0237] (102.1.1) Calculate the fingerprint similarity value between the target TLS fingerprint and the sample TLS fingerprint after structural alignment;

[0238] (102.1.2) Determine at least one sample TLS fingerprint that matches the target TLS fingerprint based on the fingerprint similarity value and a preset similarity threshold, and determine a target security detection result for the target TLS fingerprint based on the sample security label of the sample TLS fingerprint.

[0239] The following describes steps (102.1.1) to (102.1.2) in detail.

[0240] Among them, the fingerprint similarity value is a quantitative indicator used to indicate the degree of similarity between the target TLS fingerprint and the sample TLS fingerprint. This value is obtained by comparing the hash values of the nodes at each level of the fingerprint. The higher the value, the higher the similarity between the target TLS fingerprint and the sample TLS fingerprint being compared.

[0241] The similarity threshold is a predefined standard value used to determine whether the fingerprint similarity value is high enough to determine whether there is a match between the target TLS fingerprint and the sample TLS fingerprint. If the similarity value exceeds the threshold, the match is considered successful.

[0242] Next, <2> Fuzzy fingerprint comparison, comparing the target TLS fingerprint with all sample TLS fingerprints in the fingerprint library:

[0243] In some embodiments, as Figure 17 As shown, Figure 17 This is an optional fuzzy fingerprint comparison flowchart of the Merkle tree-based TLS fingerprint security detection method provided in an embodiment of the present application. When the target TLS fingerprint and any sample TLS fingerprint are aligned, the hash value set of all target nodes is extracted from the target TLS fingerprint to obtain S1, and the hash value set of all sample nodes is extracted from the sample TLS fingerprint to obtain S2; then, the intersection (|S1∩S2|) and union (|S1∪S2|) of S1 and S2 are calculated; finally, the fingerprint similarity is calculated. For example, the fingerprint similarity Similarity=|S1∩S2| / |S1∪S2| can be calculated by the Jaccard similarity coefficient formula, where the closer the Similarity is, the more similar the target TLS fingerprint is to the corresponding sample TLS fingerprint. Furthermore, the target security detection result is determined based on the sample security labels corresponding to k (k≥1) sample TLS fingerprints whose fingerprint similarity values exceed the similarity threshold.

[0244] like Figure 18 As shown, Figure 18 This is another optional device module diagram of the Merkle tree-based TLS fingerprint security detection device provided in an embodiment of the present application. The fingerprint security detection device may include the following modules 201 to 203:

[0245] An acquisition module 201 is configured to acquire a target TLS fingerprint under a binary tree structure generated by a target system, and select any sample TLS fingerprint having the same binary tree structure from a pre-built fingerprint library, wherein the target TLS fingerprint includes a plurality of target nodes located at different levels determined by the target classification chain information, each target node including target fingerprint information, and the sample TLS fingerprint includes a plurality of sample nodes located at different levels determined by the sample classification chain information, each sample node including sample fingerprint information and a sample security label;

[0246] A matching processing module 202 is configured to align the hierarchical structures of the target TLS fingerprint and the sample TLS fingerprint based on the target classification chain information and the sample classification chain information, and compare the target node and the sample node layer by layer from top to bottom;

[0247] The target security detection result module 203 is used to determine the target security detection result of the target TLS fingerprint according to the corresponding sample security tag if the sample fingerprint information of any sample node matches the target fingerprint information of the target node at the corresponding position.

[0248] The present application proposes a TLS fingerprint security detection method, apparatus, device and medium based on Merkle tree, which obtains the target TLS fingerprint under the binary tree structure generated by the target system, and selects any sample TLS fingerprint with the same binary tree structure from a pre-built fingerprint library, wherein the target TLS fingerprint includes a plurality of target nodes at different levels determined by the target classification chain information, each target node includes target fingerprint information, and the sample TLS fingerprint includes a plurality of sample nodes at different levels determined by the sample classification chain information, each sample node includes sample fingerprint information and sample security label, wherein a binary tree structure is used to represent the target TLS fingerprint and the sample TLS fingerprint, which can perform hierarchical and structured management of multiple TLS information, thereby reflecting the different granularities. characteristics of TLS information; then, based on the target classification chain information and the sample classification chain information, the hierarchical structure of the target TLS fingerprint and the sample TLS fingerprint is aligned, and the target node and the sample node are compared hierarchically from top to bottom; if the sample fingerprint information of any sample node matches the target fingerprint information of the target node at the corresponding position, the target security detection result of the target TLS fingerprint is determined according to the corresponding sample security label. In the process of comparing the sample node and the target node at the corresponding position, when the sample fingerprint information matches the target fingerprint information, the target security detection result of the target system can be directly determined according to the corresponding sample security label without the need for complex subsequent analysis and calculation. On the basis of achieving highly granular security detection, the detection time is greatly shortened, which is especially suitable for network security scenarios that require real-time response.

[0249] The specific implementation of the fingerprint security detection device is basically the same as the specific embodiment of the fingerprint security detection method described above, and will not be repeated here.

[0250] In addition, embodiments of the present application can acquire and process relevant TLS information based on artificial intelligence technology. Artificial Intelligence (AI) refers to the theories, methods, techniques, and application systems that use digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to achieve optimal results.

[0251] Furthermore, foundational AI technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interaction systems, and mechatronics. AI software technologies primarily encompass computer vision, robotics, biometrics, speech processing, natural language processing, and machine learning / deep learning.

[0252] The fingerprint security detection method provided in the embodiment of the present application also relates to the field of artificial intelligence technology. The fingerprint security detection method provided in the embodiment of the present application can be applied to a terminal, can be applied to a server side, or can be software running in a terminal or a server side. In some embodiments, the terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, etc.; the server side can be configured as an independent physical server, or as a server cluster or distributed system composed of multiple physical servers, or as a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms; the software can be an application that implements the fingerprint security detection method, etc., but is not limited to the above forms.

[0253] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, and the like. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, and the like that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments in which tasks are performed by remote processing devices connected via a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media, including storage devices.

[0254] The present application also provides an electronic device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the fingerprint security detection method when executing the computer program. The electronic device can be any smart terminal including a tablet computer, an in-vehicle computer, or the like.

[0255] like Figure 19 As shown, Figure 19 : is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application, the electronic device includes:

[0256] The processor 301 may be implemented as a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is configured to execute relevant programs to implement the technical solutions provided in the embodiments of the present application.

[0257] The memory 302 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 302 can store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 302 and is called by the processor 301 to execute the fingerprint security detection method of the embodiments of this application.

[0258] Input / output interface 303, used to implement information input and output;

[0259] Communication interface 304, used to implement communication interaction between this device and other devices, which can be achieved through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WiFi, Bluetooth, etc.);

[0260] bus 305 , which transmits information between the various components of the device (e.g., processor 301 , memory 302 , input / output interface 303 , and communication interface 304 );

[0261] The processor 301 , the memory 302 , the input / output interface 303 and the communication interface 304 are connected to each other in communication within the device via the bus 305 .

[0262] An embodiment of the present application further provides a computer-readable storage medium storing a computer program, which implements the above-mentioned fingerprint security detection method when executed by a processor.

[0263] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely arranged relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0264] The embodiments described in the embodiments of this application are intended to more clearly illustrate the technical solutions of the embodiments of this application and do not constitute a limitation on the technical solutions provided by the embodiments of this application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0265] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0266] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, i.e., they may be located in one place or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of this embodiment.

[0267] Those skilled in the art will appreciate that all or some of the steps in the methods, systems, and functional modules / units in the devices disclosed above may be implemented as software, firmware, hardware, or appropriate combinations thereof.

[0268] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0269] It should be understood that in this application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0270] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the above-mentioned units is only a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0271] The units described above as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0272] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0273] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes multiple instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: various media that can store programs, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0274] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but are not intended to limit the scope of the present invention. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and essence of the present invention should be within the scope of the present invention.

Claims

1. A TLS fingerprint security detection method based on Merkle tree, characterized in that: include: Obtain a target TLS fingerprint under a binary tree structure generated by the target system, and select any sample TLS fingerprint with the same binary tree structure from a pre-built fingerprint library, wherein the target TLS fingerprint includes a plurality of target nodes located at different levels determined by the target classification chain information, each of which includes target fingerprint information; and the sample TLS fingerprint includes a plurality of sample nodes located at different levels determined by the sample classification chain information, each of which includes sample fingerprint information and a sample security label; Based on the target classification chain information and the sample classification chain information, align the hierarchical structures of the target TLS fingerprint and the sample TLS fingerprint, and compare the target node and the sample node layer by layer from top to bottom; If the sample fingerprint information of any of the sample nodes matches the target fingerprint information of the target node at the corresponding position, the target security detection result of the target TLS fingerprint is determined according to the corresponding sample security tag.

2. The TLS fingerprint security detection method based on the Merkle tree according to claim 1 is characterized in that: The target TLS fingerprint is a target root node, a target non-leaf node, and a target leaf node in order from top to bottom toward the target nodes of different levels; the sample TLS fingerprint is a sample root node, a sample non-leaf node, and a sample leaf node in order from top to bottom toward the sample nodes of different levels; If the sample fingerprint information of any of the sample nodes matches the target fingerprint information of the target node at the corresponding position, determining the target security detection result of the target TLS fingerprint according to the corresponding sample security tag includes: Obtaining first matching information between the sample fingerprint information of the sample root node and the target fingerprint information of the target root node, and if the first matching information indicates a match, determining the target security detection result of the target TLS fingerprint according to the sample security tag corresponding to the sample root node; If the first matching information indicates a mismatch, obtaining second matching information between the sample fingerprint information of any of the sample non-leaf nodes and the target fingerprint information of any of the target non-leaf nodes; if the second matching information indicates a match, determining the target security detection result of the target TLS fingerprint based on the sample security tag of the matched sample non-leaf node; If the first matching information and the second matching information are both characterized as mismatches, and the sample fingerprint information of any of the sample leaf nodes matches the target fingerprint information of any of the target leaf nodes, the target security detection result of the target TLS fingerprint is determined based on the sample security label of the matched sample leaf node.

3. The TLS fingerprint security detection method based on Merkle tree according to claim 1 is characterized in that The target TLS fingerprint is generated according to the following steps, comprising: Obtaining multiple target TLS information of the target system; Classify the plurality of target TLS information to obtain target category information of each target TLS information, and determine the corresponding target classification chain information based on the target category information, wherein the target classification chain information includes target level categories sequentially associated with the target category information at each level; Based on the target classification chain information, construct a target TLS configuration tree with a binary tree structure, with the same target category information as the target bottom-level node and the target hierarchical category as the nodes at different levels above the target bottom-level node; and determine a target initial hash value for each target bottom-level node based on at least one target TLS information under the same target classification chain information; Select target levels one by one, and select two adjacent target nodes in the target level, wherein the target nodes have the same target level category as the target nodes in the previous level; calculate the target hash value of the target node corresponding to the target level category in the previous level based on the two target hash values corresponding to the two target nodes, until a unique target root node hash value is generated, and obtain the target TLS fingerprint corresponding to the target system, the initial value of the target level is the level where the target underlying node is located, the initial value of the target node is the target underlying node, and the initial value of the target hash value is the target initial hash value.

4. The TLS fingerprint security detection method based on Merkle tree according to claim 3 is characterized in that Any of the sample TLS fingerprints stored in the fingerprint library is generated by the following steps, which include: Get multiple sample TLS information of the sample system; Classify the plurality of sample TLS information to obtain sample category information of each sample TLS information, and determine the corresponding sample classification chain information based on the sample category information, wherein the sample classification chain information includes sample level categories sequentially associated with the sample category information at each level; Based on the sample classification chain information, construct a sample TLS configuration tree with a binary tree structure, using the same sample category information as the sample bottom-level node and the sample level category as the nodes at different levels above the sample bottom-level node; and determine the sample initial hash value of each sample bottom-level node based on at least one sample TLS information under the same sample classification chain information; Obtaining a security policy table, and determining an initial security value for each of the sample TLS information based on the security policy table; Determining an initial security label corresponding to the sample node according to the initial security value of at least one of the sample TLS information under the same sample classification chain information; Selecting sample levels one by one, selecting two adjacent sample nodes in the sample level, wherein the sample nodes correspond to the same sample level category in the previous level; calculating the sample hash value of the sample node corresponding to the sample level category in the previous level based on the two sample hash values corresponding to the two sample nodes, and determining the sample security label corresponding to the sample node in the previous level based on the sample security labels of the two sample nodes; Until a unique sample root node hash value is generated, the sample TLS fingerprint corresponding to the sample system is obtained, the initial value of the sample level is the level where the sample bottom node is located, the initial value of the sample node is the sample bottom node, the initial value of the sample hash value is the sample initial hash value, and the initial value of the sample security label is the initial security label.

5. The TLS fingerprint security detection method based on Merkle tree according to claim 4 is characterized in that, The determining, according to the initial security value of at least one of the sample TLS information under the same sample classification chain information, the initial security label corresponding to the sample node includes: Obtaining a default label, wherein the default label includes a preset number of label bits arranged in a fixed order; Selecting a dynamic tag bit from the plurality of tag bits according to the sample classification chain information, and updating the dynamic tag bit to obtain an updated tag bit according to a security state represented by the initial security value of at least one sample TLS information under the same sample classification chain information; The default label is updated based on the updated label bit to obtain the initial security label of each of the sample nodes.

6. The TLS fingerprint security detection method based on Merkle tree according to claim 4 is characterized in that, After aligning the hierarchical structures of the target TLS fingerprint and the sample TLS fingerprint, the method further includes: Calculating a fingerprint similarity value between the target TLS fingerprint and the sample TLS fingerprint after structural alignment; At least one of the sample TLS fingerprints matching the target TLS fingerprint is determined based on the fingerprint similarity value and a preset similarity threshold, and the target security detection result of the target TLS fingerprint is determined based on the sample security tag of the sample TLS fingerprint.

7. The TLS fingerprint security detection method based on Merkle tree according to claim 3 is characterized in that: The classifying and processing the plurality of target TLS information to obtain target category information of each target TLS information includes: Parsing any of the target TLS information to obtain a function field corresponding to the target TLS information; Match the function field with multiple predefined first initial information, and determine that the matched first initial information is the target category information corresponding to the target TLS information, wherein the first initial information includes at least protocol version information, encryption suite information, certificate chain information, and extended sequence information.

8. The TLS fingerprint security detection method based on Merkle tree according to claim 3 is characterized in that: The determining the corresponding target classification chain information based on the target category information includes: Matching the target category information with a plurality of predefined second initial information, and determining that the matched second initial information is the target hierarchical category of an upper level to which the target category information belongs, wherein the second initial information includes at least TLS basic information, TLS extended information, TLS certificate information, and TLS configuration information; The target hierarchical category is used as the new target category information and the matching is repeated until the target category information characterized as a boundary is matched, thereby obtaining the target classification chain information.

9. The TLS fingerprint security detection method based on Merkle tree according to claim 3, characterized in that: The target TLS configuration tree having a binary tree structure is constructed based on the target classification chain information, with the same target category information as the target bottom node and the target hierarchical category as the nodes of different levels above the target bottom node, including: Based on the target classification chain information, a target initial TLS configuration tree in a tree structure is constructed with the same target category information as the target bottom node and the target hierarchical category as the nodes of different hierarchies above the target bottom node, wherein the target initial TLS configuration tree includes multiple target nodes; Traversing the target initial TLS configuration tree to determine the number of child nodes of each target node; If the number of any of the child nodes is not equal to the specified number of the level, add a preset null value node to the corresponding target node; When the number of child nodes of all target nodes meets the binary tree structure requirement, the target TLS configuration tree is obtained.

10. The TLS fingerprint security detection method based on Merkle tree according to claim 3 is characterized in that: The determining, based on at least one target TLS information under the same target classification chain information, a target initial hash value of each target underlying node includes: Obtain the standardized rule table and hash function; According to the standardization rule table, convert at least one target TLS information under the same target classification chain information into a corresponding feature string, and concatenate all the feature strings to obtain a TLS string; A hash value of each TLS string is calculated based on the hash function, and the hash value of the TLS string is used as the target initial hash value corresponding to the target underlying node.

11. A TLS fingerprint security detection device based on Merkle tree, characterized in that: include: an acquisition module, configured to acquire a target TLS fingerprint under a binary tree structure generated by a target system, and select any sample TLS fingerprint having the same binary tree structure from a pre-built fingerprint library, wherein the target TLS fingerprint includes a plurality of target nodes located at different levels determined by the target classification chain information, each of the target nodes including target fingerprint information; and the sample TLS fingerprint includes a plurality of sample nodes located at different levels determined by the sample classification chain information, each of the sample nodes including sample fingerprint information and a sample security label; a matching processing module, configured to align the hierarchical structures of the target TLS fingerprint and the sample TLS fingerprint based on the target classification chain information and the sample classification chain information, and compare the target node and the sample node layer by layer from top to bottom; A target security detection result module is used to determine the target security detection result of the target TLS fingerprint according to the corresponding sample security tag if the sample fingerprint information of any of the sample nodes matches the target fingerprint information of the target node at the corresponding position.

12. An electronic device, characterized in that: The electronic device includes a memory and a processor, the memory stores a computer program, and when the processor executes the computer program, it implements the TLS fingerprint security detection method based on the Merkle tree according to any one of claims 1 to 9.

13. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the Merkle tree-based TLS fingerprint security detection method according to any one of claims 1 to 9 is implemented.

Images