Network security detection method, device, equipment, medium and program product

Abstract

The invention discloses a network security detection method and device, equipment, a medium and a program product, and relates to the technical field of communication, the method applied to a CATF comprises the steps that data traffic between a client node and a server node is acquired, the client node is in communication connection with the server node, and the server node is in communication connection with the client node; the data flow comprises at least one of the following items: node port information, a node internet protocol IP address and an application protocol; at least one directed graph is determined based on the data traffic, the directed graph comprises node attribute information of the client node, node attribute information of the server node and side information, and the node attribute information comprises at least one of the following items: a protocol type supported by the node, a protocol version and a cryptographic algorithm; the side information is used for indicating a data transmission path between the client node and the server node; and performing network security detection based on the at least one directed graph and the security policy requirement to obtain a network security detection result.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a network security detection method, apparatus, equipment, medium, and program product. Background Technology

[0002] Currently, to achieve secure communication between Network Functions (NFs) in a communication network, secure channels are typically established between NFs using security protocols such as Transport Layer Security (TLS), Secure Sockets Layer (SSL), Internet Protocol Security (IPSec), and Hypertext Transfer Protocol Secure (HTTPS). Alternatively, to achieve secure communication between a terminal and an NF, secure channels are typically established using security protocols such as Secure Shell (SSH).

[0003] However, with the development of cryptographic technology, the number of NFs in communication networks has increased and NF versions have been updated. In order to achieve secure communication between NFs, it is necessary to query and obtain the cryptographic application information of each NF. The workload of obtaining this information is large, and it is difficult to detect security risks in network communication in a timely manner. Summary of the Invention

[0004] This application provides a network security detection method, apparatus, device, medium, and program product, which can reasonably realize the scaling up and down resource scheduling of video services, reduce the occupation of node resources, and improve the overall resource utilization rate.

[0005] In a first aspect, embodiments of this application provide a network security detection method applied to the Network Cryptographic Algorithm Detection Function (CATF), comprising:

[0006] Acquire data traffic between a client node and a server node, wherein the client node and the server node are communicatively connected, and the data traffic includes at least one of the following: node port information, node Internet Protocol (IP) address, and application protocol;

[0007] Based on the data traffic, at least one directed graph is determined, wherein the directed graph includes node attribute information of the client node, node attribute information of the server node, and edge information. The node attribute information includes at least one of the following: the protocol type supported by the node, the protocol version supported, and the cryptographic algorithm supported. The edge information is used to indicate the data transmission path between the client node and the server node.

[0008] Based on the at least one directed graph and security policy requirements, network security detection is performed to obtain network security detection results.

[0009] Optionally, determining at least one directed graph based on the data traffic includes:

[0010] Obtain at least one set of session feature information from the data traffic, the session feature information including at least one of the following: a first IP address, a first port information, a second IP address, a second port information, and a protocol identifier;

[0011] Based on the at least one set of session feature information, construct or update the directed graph corresponding to each of the session feature information;

[0012] Wherein, the client node is any node in the network service system, the first IP address is the IP address of the client node, the first port information is the port information of the client node, the second IP address is the IP address of the server node, the second port information is the port information of the server node, and the protocol identifier is the identifier information of the protocol used when the client node and the server node communicate.

[0013] Optionally, constructing a directed graph corresponding to each of the at least one set of session feature information includes:

[0014] If the first session feature information includes the IP address of the first node, and the first node does not exist in any of the pre-constructed first directed graphs, then the first node is added; wherein the first node is any client node in the network service system, and the first session feature information is any set of session feature information from the at least one set of session feature information.

[0015] If the first session feature information includes the IP address of the second node, and the second node does not exist in any of the first directed graphs, then the second node is added. The second node is any server node in the network service system, and there is a communication connection between the first node and the second node.

[0016] In the first directed graph, a first edge information is set between the first node and the second node. The first edge information is used to indicate the data transmission path between the first node and the second node.

[0017] Optionally, updating the directed graph corresponding to each of the at least one set of session feature information based on the at least one set of session feature information includes:

[0018] If the application protocol corresponding to the protocol identifier in the second session feature information is a preset security protocol, obtain the security protocol information and the supported cryptographic algorithm of each node in the second session feature information; wherein, the second session feature information is any set of session feature information from the at least one set of session feature information;

[0019] Based on the security protocol information and cryptographic algorithms supported by the third node and the fourth node in the second session feature information, the node attribute information of the third node and the node attribute information of the fourth node in the third directed graph are updated; wherein, the third node is any client node in the network service system, the fourth node is any server node in the network service system, and there is a communication connection between the third node and the fourth node.

[0020] Update the second edge information in the third directed graph, which is used to indicate the data transmission path between the third node and the fourth node.

[0021] Optionally, the network security detection result is used to instruct the target node to update the cryptographic module; and / or,

[0022] The network security detection result is used to indicate that a secure connection should be established between the node that has a communication connection with the target node and the target node.

[0023] The target node is either the server node or the client node.

[0024] Optionally, the method further includes:

[0025] Traverse each of the at least one directed graph to obtain at least one fifth node; wherein the fifth node is a server node in the network service system and the fifth node is an NF node;

[0026] Based on the node attribute information of each of the at least one fifth node, obtain the security protocol supported by each of the fifth nodes;

[0027] Based on the security protocols supported by each of the fifth nodes, determine at least one cryptographic algorithm supported by each of the fifth nodes;

[0028] When the communication connection between the fifth node and the sixth node is established through the target cryptographic algorithm, the target cryptographic algorithm is determined to be a cryptographic algorithm supported by the fifth node; wherein, the target cryptographic algorithm is one of at least one cryptographic algorithm supported by the fifth node, and the sixth node is the client node;

[0029] Based on the target cryptographic algorithm, update the supported cryptographic algorithms in the node attribute information of the fifth node.

[0030] Secondly, embodiments of this application also provide a network security detection device applied to CATF, comprising:

[0031] The acquisition module is used to acquire data traffic between client nodes and server nodes; wherein, the client node is any node in the network service system, and the server node is a node in the network service system that has a communication connection with the client node; the data traffic includes node port information, node Internet Protocol IP address, and application protocol.

[0032] A determination module is used to determine at least one directed graph based on the data traffic; wherein the directed graph includes node attribute information of the client node, node attribute information of the server node, and edge information, the node attribute information includes the protocol type supported by the node, the protocol version supported, and the cryptographic algorithm supported, and the edge information is used to indicate the data transmission path between the client node and the server node;

[0033] The generation module is used to generate network security detection results based on the at least one directed graph and the security policy requirements of the network service system.

[0034] Thirdly, embodiments of this application provide an electronic device, including: a processor, a memory, and a program stored in the memory and executable on the processor, wherein when the program is executed by the processor, it implements the steps of the network security detection method as described in any one of the first aspects.

[0035] Fourthly, embodiments of this application also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the network security detection method as described in any one of the first aspects.

[0036] Fifthly, embodiments of this application also provide a computer program product, which is stored in a storage medium and executed by at least one processor to implement the steps of the network security detection method as described in any one of the first aspects.

[0037] In this embodiment, by acquiring the data traffic between client nodes and server nodes, key information in network communication, such as ports, IP addresses, and application protocols, can be comprehensively covered, ensuring the thoroughness of the detection. Furthermore, at least one directed graph is constructed based on the data traffic. This directed graph includes node attribute information and edge information for both client and server nodes. The node attribute information includes the protocol types, protocol versions, and cryptographic algorithms supported by the nodes, while the edge information indicates the data transmission path between client and server nodes. This directed graph visualizes complex network communication relationships, facilitating the analysis and understanding of data transmission paths and node attributes between the client and server. Therefore, this application can perform network security detection based on the constructed directed graph and security policy requirements, comprehensively, accurately, and efficiently identifying security vulnerabilities in the network. Attached Figure Description

[0038] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments of this application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0039] Figure 1 This is one of the flowcharts of a network security detection method provided in the embodiments of this application;

[0040] Figure 2 This is a schematic diagram illustrating the deployment of multiple network functions in the core communication network;

[0041] Figure 3 yes Figure 1 A schematic diagram of a core network consisting of at least one directed graph.

[0042] Figure 4 This is the second flowchart of a network security detection method provided in the embodiments of this application;

[0043] Figure 5 This is a schematic diagram of a network security detection device provided in an embodiment of this application;

[0044] Figure 6 This is a schematic diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0045] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0046] To make the embodiments of this application clearer, the relevant technical knowledge involved in the embodiments of this application will be introduced as follows:

[0047] In communication networks (such as in 5G networks), network functions (NFs) typically employ relevant security mechanisms to protect communication security, such as the following security mechanisms:

[0048] (1) To protect the communication security between network functions (NFs), security protocols such as Transport Layer Security (TLS), Secure Socket Layer (SSL), Internet Protocol Security (IPSec), and Hypertext Transfer Protocol Secure (HTTPS) are mainly used to establish secure channels.

[0049] (2) To protect the communication security between the management terminal and the NF, a secure channel is mainly established using security protocols such as Secure Shell and SSH.

[0050] Taking TLS as an example, the TLS protocol is a key exchange mechanism based on cryptographic algorithms that enables the establishment of a secure data transmission channel between two communicating entities. Through the TLS protocol, 5G networks can effectively resist security threats such as data leakage, tampering, and man-in-the-middle attacks, ensuring reliable communication between network functions. At the same time, the TLS protocol also supports authentication and data integrity verification, further improving the security of 5G communication networks. However, with the development of cryptographic technology, especially quantum computing technology, traditional public-key cryptography algorithms face serious security threats, and some cryptographic algorithms or security protocols have security problems:

[0051] 1) Security protocols with security issues in related technologies: SSLv2, TLS1.0, TLS1.1, SSHv1, etc.

[0052] 2) Encryption algorithms with security issues in related technologies: Data Encryption Standard (DES), RC2, RSA1024, etc.

[0053] 3) Hash algorithms with security issues in related technologies: MD5, SHA1, etc.

[0054] 4) Encryption modes with security issues in related technologies: Electronic Codebook (ECB) mode, Cipher Block Chaining (CBC) mode, etc.

[0055] Therefore, to ensure the security of communication networks, it is necessary to understand the cryptographic application status (including the application of cryptographic algorithms and protocols) of each NF in the core network, and to proactively identify any security risks related to cryptographic algorithms and protocols within the NFs. However, communication networks typically have numerous NFs and versions, requiring manual login to each NF to query relevant information or consultation with vendors, which is labor-intensive and may result in incomplete cryptographic application statistics. Furthermore, as the network and services evolve, each NF will be updated according to operational needs. The NF maintenance department and the cryptographic application management department may be different, leading to information asynchrony and untimely updates to cryptographic application status.

[0056] To address the aforementioned technical deficiencies, this application provides a network security detection method, apparatus, device, medium, and program product. The following detailed description, in conjunction with the accompanying drawings, provides specific embodiments and their application scenarios.

[0057] Please see Figure 1 , Figure 1 This is one of the flowcharts of a network security detection method provided in the embodiments of this application. The method is applied to the network cryptographic algorithm detection function CATF and specifically includes the following steps:

[0058] Step 101: Obtain the data traffic between the client node and the server node, wherein the client node and the server node are connected in communication, and the data traffic includes at least one of the following: node port information, node Internet Protocol IP address, and application protocol.

[0059] It should be noted that the embodiments of this application are applied to the Network Cryptographic Algorithm Test function (CATF). CATF can be used to collect and analyze the data traffic between various network functions in the core network, analyze the security protocols and cryptographic algorithms supported by each NF, and form a directed graph (i.e., knowledge graph) of cryptographic algorithms and protocols in the core network and NFs. Figure 2 As shown, CATF, as an NF in a communication network, can be deployed in a cloud-based core network and connected to the core network via an access bus. It can also collect traffic data from various NFs deployed on the core network bus. An NF can be a software and / or hardware entity deployed in a communication network to provide specific network services.

[0060] The aforementioned data traffic can include communication data between various network functions (NFs) and between user equipment and network functions. The client node can be understood as a client of a Transport Layer Security (TLS) connection; it can be either a terminal or a network function connected via TLS. The server node is also a network function connected via TLS.

[0061] In this application embodiment, data traffic can be collected in various ways, including traffic mirroring, optical splitting, and virtualization. Traffic mirroring involves using port mirroring technology to transmit port traffic from network devices to the CATF. Optical splitting involves using a splitter at the physical layer to copy the optical signal to the CATF. Virtualization collection, in a Network Functions Virtualization (NFV) based core network, utilizes virtualization environment mechanisms, such as traffic collection on virtual switches. Alternatively, it can utilize the Management and Orchestration (MANO) system to collect traffic from Network Functions Virtualization (NFV). This application does not limit the specific method of data traffic collection; it can be determined according to actual needs.

[0062] In some embodiments, the acquired data traffic can be obtained by extracting multi-dimensional features using a protocol parsing engine, including network layer features (e.g., source / destination IP addresses, port numbers, etc.), transport layer features (e.g., Transmission Control Protocol (TCP) / Open Systems Interconnection (UDP) session identifiers, etc.), and application layer features (e.g., SSL / TLS protocol versions, cipher suite negotiation information, etc.). In this way, by acquiring the data traffic between client nodes and server nodes, multi-dimensional data collection can be achieved, providing a complete metadata foundation for subsequent topology modeling. Compared to traditional single-dimensional traffic monitoring methods, this effectively improves detection coverage.

[0063] Step 102: Determine at least one directed graph based on the data traffic, wherein the directed graph includes node attribute information of the client node, node attribute information of the server node, and edge information. The node attribute information includes at least one of the following: the protocol type supported by the node, the protocol version supported, and the cryptographic algorithm supported. The edge information is used to indicate the data transmission path between the client node and the server node.

[0064] Specifically, by analyzing session information in data traffic, a directed graph is dynamically constructed and updated to reflect the connection relationships and cryptographic algorithm support status between nodes (client nodes and server nodes) in the network. The session's five-tuple information can be obtained from the data traffic, specifically including: (IP_C, IP_S, Port_C, Port_S, protocol); where IP_C represents the client node's Internet Protocol (IP) address; IP_S represents the server node's IP address; Port_C represents the client node's port number; Port_S represents the server node's port number; and protocol represents the protocol type used (e.g., TCP, UDP, HTTP, TLS, etc.). Therefore, the session relationship between client nodes and server nodes can be displayed by the corresponding five-tuple information.

[0065] For nodes already existing in the network, their corresponding 5-tuple information can be updated based on data traffic, building upon their existing 5-tuple information. For nodes not yet existing in the network, new nodes are created, and their corresponding 5-tuple information is set according to data traffic. Thus, based on the 5-tuple information corresponding to the session relationships between client and server nodes, the session information between nodes with existing session relationships in the communication network can be determined. For example, the connection relationships between nodes can be determined based on edge information, thereby constructing a directed network (such as...). Figure 3 As shown,).

[0066] The edge information between the client node and the server node refers to the directed edge e created or updated between the client node v_i and the server node v_j. Directed edge e can represent a session connection or data transmission path from v_i to v_j. For example... Figure 3 As shown, the attribute information corresponding to a directed edge can be determined based on the node attribute information of the client nodes and the server nodes connected at both ends of the directed edge. The attribute information can include the protocol types (e.g., TLS, HTTP, etc.) commonly supported by the client nodes and the server nodes, the commonly supported protocol versions (e.g., TLS 1.3, TLS 1.2, etc.), and the commonly supported cryptographic algorithms (e.g., AES256-GCM, ECDHE-RSA, etc.). By connecting client nodes, server nodes, and directed edges, a directed graph can be constructed or updated.

[0067] In a specific embodiment of this application, the above steps dynamically construct and update a directed graph through session-level traffic analysis and security protocol feature identification, reflecting the cryptographic algorithm support status of nodes in the network in real time. Combined with an active probing mechanism, the cryptographic algorithm information of NF nodes is further supplemented, providing comprehensive data support for network security detection. Therefore, this embodiment of the application achieves comprehensive monitoring and analysis of network security protocols and cryptographic algorithms, avoiding the problem of incomplete information from manual statistics, reducing manual workload, improving information synchronization, and effectively enhancing network security performance.

[0068] Step 103: Perform network security detection based on the at least one directed graph and security policy requirements to obtain network security detection results.

[0069] The above steps enable compliance checks on the cryptographic algorithms and security protocols supported by each node in the network, identify potential security risks, and propose specific update and remediation suggestions, thus obtaining network security detection results.

[0070] Specifically, by traversing all nodes in the directed graph G and checking whether their supported cryptographic algorithms and protocol versions comply with security policy requirements, nodes that do not meet the security policy can be automatically identified, reducing the workload of manual checks and supporting dynamic updates to the security policy to adapt to constantly changing security needs. Subsequently, if the protocol version or cryptographic algorithm supported by an NF node does not meet the security policy requirements, an update requirement is generated. The update requirement may include upgrading cryptographic modules to support secure protocol versions and cryptographic algorithms, or disabling insecure protocol versions and cryptographic algorithms, etc.

[0071] In some embodiments of this application, the obtained network security detection results may include instructions to enable secure connections. For example, if communication between NF nodes does not use a secure protocol, an instruction to enable a secure connection is generated, instructing the two NF nodes to establish a secure connection. The requirements for enabling a secure connection may include configuring a secure protocol (such as TLS or SSH) for communication and updating the cryptographic modules of both communicating parties to support the secure protocol. Therefore, the generated network security detection results can provide clear guidance on secure connection configuration, facilitating administrators to quickly implement remedial measures. It also supports batch generation of secure connection enabling requirements, making it suitable for large-scale network environments.

[0072] Furthermore, network security testing results can also include security risk recommendations for management departments. The generated security risk analysis results and update requirements can be communicated to relevant departments to facilitate the implementation of remedial measures. Specifically, update requirements for security protocols, cryptographic algorithms, etc., and requirements for enabling secure connections between nodes can be summarized into a report and sent to the node management department. The report content can include a list of NF nodes that need updating and their update requirements, as well as NF node pairs that need to enable secure connections and their configuration requirements. Thus, through this embodiment of the application, the efficiency of security requirement communication is improved, communication costs are reduced, and network security is ensured.

[0073] Optionally, determining at least one directed graph based on the data traffic includes:

[0074] Obtain at least one set of session feature information from the data traffic, the session feature information including at least one of the following: a first IP address, a first port information, a second IP address, a second port information, and a protocol identifier;

[0075] Based on the at least one set of session feature information, construct or update the directed graph corresponding to each of the session feature information;

[0076] Wherein, the client node is any node in the network service system, the first IP address is the IP address of the client node, the first port information is the port information of the client node, the second IP address is the IP address of the server node, the second port information is the port information of the server node, and the protocol identifier is the identifier information of the protocol used when the client node and the server node communicate.

[0077] It's worth noting that the data traffic is processed at the session level. For client and server nodes with session relationships, a set of session characteristic information is obtained. This session characteristic information is a five-tuple, specifically including (IP_C, IP_S, Port_C, Port_S, protocol). IP_C is the first IP address (the client node's IP address), IP_S is the second IP address (the server node's IP address), Port_C is the first port information (the client node's port information), Port_S is the second port information (the node's port information), and protocol is the identifier of the protocol used when the client node and the server node communicate, indicating the protocol type used for communication between them (such as TCP, UDP, HTTP, TLS, etc.).

[0078] In some embodiments, a set of session feature information can represent a client node and a server node, as well as the session connection relationship between the client node and the server node. A directed edge e is created between the client node v_i and the server node v_j, representing the session connection from v_i to v_j. The attributes of the directed edge include the protocol type (e.g., TLS, HTTP, etc.), the protocol version (e.g., TLS 1.3, TLS 1.2, etc.), and the algorithm used (e.g., AES256-GCM, ECDHE-RSA, etc.). Each session feature information corresponds to a directed edge in the directed graph, and the client node and the server node correspond to two nodes in the directed graph, respectively. Thus, the embodiments of this application realize the automatic mapping of session feature information to the directed graph, reducing manual intervention.

[0079] Optionally, constructing a directed graph corresponding to each of the at least one set of session feature information includes:

[0080] If the first session feature information includes the IP address of the first node, and the first node does not exist in any of the pre-constructed first directed graphs, then the first node is added; wherein the first node is any client node in the network service system, and the first session feature information is any set of session feature information from the at least one set of session feature information.

[0081] If the first session feature information includes the IP address of the second node, and the second node does not exist in any of the first directed graphs, then the second node is added. The second node is any server node in the network service system, and there is a communication connection between the first node and the second node.

[0082] In the first directed graph, a first edge information is set between the first node and the second node. The first edge information is used to indicate the data transmission path between the first node and the second node.

[0083] In some embodiments, if the IP address of the first node does not exist in any pre-constructed first directed graph, it indicates that the first node does not exist in that first directed graph, meaning that the client node does not exist in any directed graph in the network service system. In this case, a first node v_i can be added to the first directed graph. Furthermore, it can be determined whether the IP address of the first node is in the NF list of the core network. If the IP address of the first node is in the NF list, it indicates that the first node is an NF, and the node type attribute of the first node can be set to NF. Otherwise, the node type attribute of the first node can be set to empty (i.e., indicating that the first node is a non-NF type node).

[0084] In some embodiments, if there is an IP address in the pre-constructed first directed graph that does not contain the IP address of the second node, it indicates that the second node does not exist in the first directed graph, meaning that the server node does not exist in any of the directed graphs in the network service system. In this case, a second node v_j can be added to the first directed graph. Furthermore, if the IP address of the second node indicates that the second node is NF (meaning it is in the NF list), then the node type attribute of the second node can be set to NF. Otherwise, the node type attribute of the second node can be set to empty (meaning the second node is a non-NF type node).

[0085] The first node and the second node mentioned above are the client node and the server node, respectively. Since the first node and the second node have a session connection, a directed edge can be constructed between them: a directed edge e = [e^(v_i)] connects node v_i and node v_j.<v_i,v_j> This indicates that there is a session connection between node v_i and node v_j.

[0086] Thus, based on the first session feature information, a first node, a second node, and directed edges are added to the first directed graph. Therefore, based on multiple sets of session feature information, such as... Figure 3 As shown, the first directed graph can include multiple server nodes, multiple client nodes, node attribute information of each node, and information on directed edges between nodes, thereby representing the protocols, cryptographic algorithms, etc., supported by the nodes. It is evident that the embodiments of this application can visualize complex network communication relationships using the constructed directed graph, facilitating accurate identification of security vulnerabilities in the network, such as unsupported protocol versions and insecure cryptographic algorithms, reducing manual intervention and improving detection efficiency.

[0087] In this first directed graph, the server node in one session connection can overlap with either the client node or the server node in another session connection. For example, one session connection may contain client node A and server node B, while another session connection may contain client node C and server node D. Client node A can be the same node as client node C, and client node A can also be the same node as server node D; this application does not impose specific limitations. As can be seen, the nodes can be interconnected, jointly constructing a directed graph that represents the connection status and attributes of multiple nodes. This directed graph facilitates the analysis of the security protocols and cryptographic algorithms supported and used by each node and each NF, making the node information more comprehensive.

[0088] In another embodiment, when a new set of session feature information is detected, the nodes and edges in the directed graph can be dynamically updated. If a node or edge already exists, its attribute information is updated. Specifically, the attributes of nodes and edges can be dynamically modified using the update interface of the graph database. This reflects changes in the network topology in real time, ensuring the accuracy of the directed graph. Real-time security detection based on dynamically updated directed graphs is achieved.

[0089] Optionally, updating the directed graph corresponding to each of the at least one set of session feature information based on the at least one set of session feature information includes:

[0090] If the application protocol corresponding to the protocol identifier in the second session feature information is a preset security protocol, obtain the security protocol information and the supported cryptographic algorithm of each node in the second session feature information; wherein, the second session feature information is any set of session feature information from the at least one set of session feature information;

[0091] Based on the security protocol information and cryptographic algorithms supported by the third node and the fourth node in the second session feature information, the node attribute information of the third node and the node attribute information of the fourth node in the third directed graph are updated; wherein, the third node is any client node in the network service system, the fourth node is any server node in the network service system, and there is a communication connection between the third node and the fourth node.

[0092] Update the second edge information in the third directed graph, which is used to indicate the data transmission path between the third node and the fourth node.

[0093] In specific embodiments of this application, node attributes can be referenced in Table 1 below. The IP address of node v_i is xxxx, the node type attribute is NF, the network element name is AMF, the security protocols supported are TLS1.3, TLS1.2, and SSHv2, and the non-security protocols are not supported. When NF acts as a client node, it can support Algorithm 1, Algorithm 2, and Algorithm 3; when NF acts as a server node, it can support Algorithm 1 and Algorithm 2.

[0094] Table 1

[0095]

[0096] The attributes of directed edges can be found in Table 2 below. Among them, the security protocols supported by directed edge e are TLS 1.3 using Algorithm 1, SSHv2 using Algorithm 2, and insecure protocols.

[0097] Table 2

[0098] Security Protocol algorithm ... TLS 1.3 Algorithm 1 ... SSHv2 Algorithm 2 ...

[0099] In some embodiments, the protocol used in the current client node and server node session can be identified as a secure protocol, such as SSL / TLS / HTTPS / IPSec / SSH, by security protocol characteristics (e.g., the protocol identifier mentioned above). If the client node and server node session does not use a secure protocol, no further processing is performed. If the protocol identifier indicates a secure protocol, the following processing can be performed:

[0100] like Figure 4 As shown, firstly, the encrypted communication portion of the security protocol can be ignored. The handshake process of the security protocol is analyzed, and the handshake information is parsed to extract the following: protocol type (e.g., TLS, SSH), protocol version (e.g., TLS 1.3, SSHv2), list of algorithms supported by the client (Cipher Suites in ClientHello), algorithm selected by the server (Cipher Suite in ServerHello), and digital certificate information (optional). This allows for the accurate acquisition of the cryptographic algorithms and protocol versions supported by the node, providing data support for subsequent cryptographic algorithm compliance checks.

[0101] Subsequently, based on the extracted security protocol information, the attribute information of nodes v_i and v_j in the directed graph is dynamically updated to reflect the security protocols and cryptographic algorithms supported by the nodes. For example, updating the attributes of the client node (third node v_i) can add or update protocol type, version, client algorithm support list, etc. For the server node (fourth node v_j), protocol type, version, algorithm selected by the server, etc., can also be added or updated.

[0102] Finally, based on the extracted security protocol information, the edge information in the directed graph is dynamically updated to reflect the secure communication paths between nodes. For directed edge e =<v_i,v_j> Add or update the following attributes: [Protocol (TLS), Version (1.3), Algorithm used (Algorithm 1)]. This allows for a clear representation of the secure communication path between nodes, supporting security policy verification and anomaly detection based on edge attributes.

[0103] In this embodiment, session quintuple extraction provides basic data for traffic analysis. Dynamic updates of nodes and edges maintain network topology and attribute information in real time. Cryptographic algorithms and protocol versions are accurately obtained through security protocol feature identification. Finally, an active probing mechanism supplements the cryptographic algorithm support status of NF nodes. Thus, accurate identification of secure protocol traffic, extraction of protocol version and cryptographic algorithm information, real-time updates of the cryptographic algorithm support status of client and server nodes, and real-time updates of secure communication paths between nodes are achieved.

[0104] Optionally, the network security detection result is used to instruct the target node to update the cryptographic module; and / or,

[0105] The network security detection result is used to indicate that a secure connection should be established between the node that has a communication connection with the target node and the target node.

[0106] The target node is either the server node or the client node.

[0107] In some specific embodiments, network security detection results are used to generate cryptographic module update instructions and secure connection activation instructions for specific nodes (target nodes). The specific steps are as follows: Target Node Identification: First, during the construction of the directed graph, target nodes are identified by analyzing network traffic and protocol support. These target nodes can be server-side or client-side nodes, judged based on the compliance of their supported protocols and cryptographic algorithms. Subsequently, the compliance of each target node is audited using the dynamically constructed directed graph. If the cryptographic algorithm or protocol version supported by the target node is found to be inconsistent with the enterprise or industry security policy, a corresponding security detection result is generated. Next, if the detection result of the target node shows that its cryptographic module is outdated or has known vulnerabilities, the system automatically generates an instruction to update the cryptographic module. This instruction will include a recommendation to upgrade to an implementation that supports the latest and most secure protocols and algorithms to enhance the target node's security protection capabilities. Finally, a secure connection activation instruction is generated if the detection results indicate that there is a communication connection between the target node and other nodes, but this communication does not use a secure protocol.

[0108] Among them, network security detection results can explicitly require all relevant nodes (i.e., the target node and its communication connection nodes) to configure and enable secure transmission protocols (such as TLS, SSH) to ensure the confidentiality and integrity of data transmission.

[0109] Furthermore, after the entire monitoring and response cycle is completed, all update instructions can be summarized to generate a detailed report for the network management department, including a list of target nodes that need to be updated, specific requirements for enabling secure connections, and the priority and implementation guidelines for each update.

[0110] Thus, this embodiment of the application can promptly update the cryptographic modules of target nodes and establish secure connections, significantly enhancing the overall security of the network and reducing the potential attack surface. Furthermore, by automating the generation of update and configuration instructions, it reduces the need for manual review and processing, improving efficiency and minimizing errors caused by human factors. Simultaneously, this embodiment of the application can flexibly adjust security strategies and implementation directions based on the real-time status changes of different nodes, effectively responding to rapidly changing network threat environments.

[0111] Optionally, the method further includes:

[0112] Traverse each of the at least one directed graph to obtain at least one fifth node; wherein the fifth node is a server node in the network service system and the fifth node is an NF node;

[0113] Based on the node attribute information of each of the at least one fifth node, obtain the security protocol supported by each of the fifth nodes;

[0114] Based on the security protocols supported by each of the fifth nodes, determine at least one cryptographic algorithm supported by each of the fifth nodes;

[0115] When the communication connection between the fifth node and the sixth node is established through the target cryptographic algorithm, the target cryptographic algorithm is determined to be a cryptographic algorithm supported by the fifth node; wherein, the target cryptographic algorithm is one of at least one cryptographic algorithm supported by the fifth node, and the sixth node is the client node;

[0116] Based on the target cryptographic algorithm, update the supported cryptographic algorithms in the node attribute information of the fifth node.

[0117] In this embodiment, network security can be enhanced by traversing a directed graph and obtaining information about the server nodes. Specifically, at least one previously constructed directed graph can be traversed to identify each server node (the fifth node). It is ensured that each selected server node is an NF (Network Function) node in the network service system for subsequent checks and updates. Then, by accessing the attribute information of the fifth node, the system obtains the security protocols supported by each server node. These security protocols may include, but are not limited to, TLS and SSH, which form the basis of the entire network security communication. Based on the supported security protocols, the corresponding cryptographic algorithms are further parsed. For example, for nodes supporting TLS, multiple cryptographic algorithms such as AES, RSA, and ECDHE can be obtained. The collected cryptographic algorithms will become the basis for establishing subsequent connections.

[0118] Based on the above, assuming that a communication connection has been established between the target client node (sixth node) and the fifth node, the target cryptographic algorithm to be used is confirmed. This target cryptographic algorithm should be one of the cryptographic algorithms supported by the fifth node to ensure compatibility. If the target cryptographic algorithm is confirmed to meet audit standards, the node attribute information of the fifth node needs to be updated to indicate that it has successfully supported these cryptographic algorithms. This not only optimizes the node's status data but also facilitates future compliance checks and risk assessments.

[0119] Therefore, this application embodiment can effectively improve the security of communication in the network by verifying and recording the security protocols and cryptographic algorithms supported by each server node, ensuring that all nodes comply with the latest security standards. It can also flexibly adapt to network changes by updating device attribute information in real time, and comprehensively manage nodes and their supported security protocols and cryptographic algorithms using a directed graph, improving network traffic transparency and facilitating the formulation and execution of security policies. Simultaneously, through automation, it significantly reduces the time and effort required by maintenance personnel to verify and update network functional nodes, thereby improving overall efficiency and reducing human error.

[0120] In another specific embodiment, such as Figure 4 As shown, a network security detection method is provided, which specifically includes the following steps:

[0121] Step 201: The client node sends a secure connection request to the server using the cryptographic algorithms it supports;

[0122] Step 202: The server node selects the cryptographic algorithms it supports;

[0123] Step 203: The server node sends a secure connection response to the client node;

[0124] Step 204: The server node and the client node communicate based on a secure channel;

[0125] Step 205: CATF obtains the data traffic between the client node and the server node; the data traffic includes at least one of the following: node port information, node Internet Protocol IP address, and application protocol;

[0126] Step 206: CATF determines at least one directed graph based on the data traffic, wherein the directed graph includes node attribute information of the client node, node attribute information of the server node, and edge information. The node attribute information includes at least one of the following: the protocol type supported by the node, the protocol version supported, and the cryptographic algorithm supported. The edge information is used to indicate the data transmission path between the client node and the server node.

[0127] Step 207: CATF performs network security testing based on at least one directed graph and security policy requirements to obtain network security testing results; the network security testing results are used to instruct the target node to update the password module; and / or, the network security testing results are used to instruct a node with a communication connection to the target node to open a secure connection with the target node; the target node is the server node or the client node;

[0128] Step 208: CATF sends the network security detection results to the server node;

[0129] Step 209: CATF sends the network security detection results to the client node.

[0130] It should be noted that the above embodiments are able to achieve the above... Figure 2 All method steps implemented in the method embodiment shown are capable of achieving the same technical effect. Therefore, the parts that are the same as those in the method embodiment and their beneficial effects will not be described in detail here.

[0131] Please see Figure 5 This application also provides a network security detection device 300 for CATF, which includes:

[0132] The acquisition module 301 is used to acquire the data traffic between the client node and the server node; wherein, the client node is any node in the network service system, the server node is a node in the network service system that has a communication connection with the client node, and the data traffic includes node port information, node Internet Protocol IP address, and application protocol;

[0133] The determining module 302 is used to determine at least one directed graph based on the data traffic; wherein the directed graph includes node attribute information of the client node, node attribute information of the server node, and edge information, the node attribute information includes the protocol type supported by the node, the supported protocol version, and the supported cryptographic algorithm, and the edge information is used to indicate the data transmission path between the client node and the server node;

[0134] The generation module 303 is used to generate network security detection results based on the at least one directed graph and the security policy requirements of the network service system.

[0135] Optionally, the determining module 302 includes:

[0136] The first acquisition unit is configured to acquire at least one set of session feature information from the data traffic, wherein the session feature information includes at least one of the following: a first IP address, a first port information, a second IP address, a second port information, and a protocol identifier;

[0137] The first processing unit is configured to construct or update a directed graph corresponding to each of the at least one set of session feature information based on the at least one set of session feature information.

[0138] Wherein, the client node is any node in the network service system, the first IP address is the IP address of the client node, the first port information is the port information of the client node, the second IP address is the IP address of the server node, the second port information is the port information of the server node, and the protocol identifier is the identifier information of the protocol used when the client node and the server node communicate.

[0139] Optionally, the first processing unit is specifically used for:

[0140] If the first session feature information includes the IP address of the first node, and the first node does not exist in any of the pre-constructed first directed graphs, then the first node is added; wherein the first node is any client node in the network service system, and the first session feature information is any set of session feature information from the at least one set of session feature information.

[0141] If the first session feature information includes the IP address of the second node, and the second node does not exist in any of the first directed graphs, then the second node is added. The second node is any server node in the network service system, and there is a communication connection between the first node and the second node.

[0142] In the first directed graph, a first edge information is set between the first node and the second node. The first edge information is used to indicate the data transmission path between the first node and the second node.

[0143] Optionally, the first processing unit is specifically used for:

[0144] If the application protocol corresponding to the protocol identifier in the second session feature information is a preset security protocol, obtain the security protocol information and the supported cryptographic algorithm of each node in the second session feature information; wherein, the second session feature information is any set of session feature information from the at least one set of session feature information;

[0145] Based on the security protocol information and cryptographic algorithms supported by the third node and the fourth node in the second session feature information, the node attribute information of the third node and the node attribute information of the fourth node in the third directed graph are updated; wherein, the third node is any client node in the network service system, the fourth node is any server node in the network service system, and there is a communication connection between the third node and the fourth node.

[0146] Update the second edge information in the third directed graph, which is used to indicate the data transmission path between the third node and the fourth node.

[0147] Optionally, the network security detection result is used to instruct the target node to update the cryptographic module; and / or,

[0148] The network security detection result is used to indicate that a secure connection should be established between the node that has a communication connection with the target node and the target node.

[0149] The target node is either the server node or the client node.

[0150] Optionally, the network security detection device 300 is further configured to:

[0151] Traverse each of the at least one directed graph to obtain at least one fifth node; wherein the fifth node is a server node in the network service system and the fifth node is an NF node;

[0152] Based on the node attribute information of each of the at least one fifth node, obtain the security protocol supported by each of the fifth nodes;

[0153] Based on the security protocols supported by each of the fifth nodes, determine at least one cryptographic algorithm supported by each of the fifth nodes;

[0154] When the communication connection between the fifth node and the sixth node is established through the target cryptographic algorithm, the target cryptographic algorithm is determined to be a cryptographic algorithm supported by the fifth node; wherein, the target cryptographic algorithm is one of at least one cryptographic algorithm supported by the fifth node, and the sixth node is the client node;

[0155] Based on the target cryptographic algorithm, update the supported cryptographic algorithms in the node attribute information of the fifth node.

[0156] It should be noted that the network security detection device 300 provided in this application embodiment is capable of achieving the above-mentioned... Figure 2 All method steps implemented in the method embodiment shown are capable of achieving the same technical effect. Therefore, the parts that are the same as those in the method embodiment and their beneficial effects will not be described in detail here.

[0157] This application also provides an electronic device. See also... Figure 6 , Figure 6 This is a structural diagram of the electronic device provided in the embodiments of this application. Since the principle by which the electronic device 400 solves the problem is similar to the network security detection method in the embodiments of this application, the implementation of the electronic device 400 can be referred to as follows: Figure 2 The implementation of the method shown will not be repeated here.

[0158] like Figure 6 As shown, the electronic device 400 includes: a processor 410, configured to read a program from the memory 420 and execute the following processes:

[0159] Acquire data traffic between a client node and a server node, wherein the client node and the server node are communicatively connected, and the data traffic includes at least one of the following: node port information, node Internet Protocol (IP) address, and application protocol;

[0160] Based on the data traffic, at least one directed graph is determined, wherein the directed graph includes node attribute information of the client node, node attribute information of the server node, and edge information. The node attribute information includes at least one of the following: the protocol type supported by the node, the protocol version supported, and the cryptographic algorithm supported. The edge information is used to indicate the data transmission path between the client node and the server node.

[0161] Based on the at least one directed graph and security policy requirements, network security detection is performed to obtain network security detection results.

[0162] Optionally, the processor 410 is also used to read the program from the memory 420 and perform the following steps:

[0163] Obtain at least one set of session feature information from the data traffic, the session feature information including at least one of the following: a first IP address, a first port information, a second IP address, a second port information, and a protocol identifier;

[0164] Based on the at least one set of session feature information, construct or update the directed graph corresponding to each of the session feature information;

[0165] Wherein, the client node is any node in the network service system, the first IP address is the IP address of the client node, the first port information is the port information of the client node, the second IP address is the IP address of the server node, the second port information is the port information of the server node, and the protocol identifier is the identifier information of the protocol used when the client node and the server node communicate.

[0166] Optionally, the processor 410 is also used to read the program from the memory 420 and perform the following steps:

[0167] If the first session feature information includes the IP address of the first node, and the first node does not exist in any of the pre-constructed first directed graphs, then the first node is added; wherein the first node is any client node in the network service system, and the first session feature information is any set of session feature information from the at least one set of session feature information.

[0168] If the first session feature information includes the IP address of the second node, and the second node does not exist in any of the first directed graphs, then the second node is added. The second node is any server node in the network service system, and there is a communication connection between the first node and the second node.

[0169] In the first directed graph, a first edge information is set between the first node and the second node. The first edge information is used to indicate the data transmission path between the first node and the second node.

[0170] Optionally, the processor 410 is also used to read the program from the memory 420 and perform the following steps:

[0171] If the application protocol corresponding to the protocol identifier in the second session feature information is a preset security protocol, obtain the security protocol information and the supported cryptographic algorithm of each node in the second session feature information; wherein, the second session feature information is any set of session feature information from the at least one set of session feature information;

[0172] Based on the security protocol information and cryptographic algorithms supported by the third node and the fourth node in the second session feature information, the node attribute information of the third node and the node attribute information of the fourth node in the third directed graph are updated; wherein, the third node is any client node in the network service system, the fourth node is any server node in the network service system, and there is a communication connection between the third node and the fourth node.

[0173] Update the second edge information in the third directed graph, which is used to indicate the data transmission path between the third node and the fourth node.

[0174] Optionally, the network security detection result is used to instruct the target node to update the cryptographic module; and / or,

[0175] The network security detection result is used to indicate that a secure connection should be established between the node that has a communication connection with the target node and the target node.

[0176] The target node is either the server node or the client node.

[0177] Optionally, the processor 410 is also used to read the program from the memory 420 and perform the following steps:

[0178] Traverse each of the at least one directed graph to obtain at least one fifth node; wherein the fifth node is a server node in the network service system and the fifth node is an NF node;

[0179] Based on the node attribute information of each of the at least one fifth node, obtain the security protocol supported by each of the fifth nodes;

[0180] Based on the security protocols supported by each of the fifth nodes, determine at least one cryptographic algorithm supported by each of the fifth nodes;

[0181] When the communication connection between the fifth node and the sixth node is established through the target cryptographic algorithm, the target cryptographic algorithm is determined to be a cryptographic algorithm supported by the fifth node; wherein, the target cryptographic algorithm is one of at least one cryptographic algorithm supported by the fifth node, and the sixth node is the client node;

[0182] Based on the target cryptographic algorithm, update the supported cryptographic algorithms in the node attribute information of the fifth node.

[0183] The electronic device 400 provided in this application embodiment can perform the above-described... Figure 2 The method embodiments shown are similar in principle and technical effect, and will not be described again here.

[0184] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the above-described... Figure 2 The various processes in the embodiments of the network security detection method described herein achieve the same technical effect, and therefore will not be repeated here to avoid repetition. The computer-readable storage medium mentioned herein includes, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0185] This application embodiment also provides a computer program / program product, which is stored in a storage medium and executed by at least one processor to implement the above. Figure 2 The various processes of the network security detection method embodiments described herein can achieve the same technical effect, and will not be repeated here to avoid duplication.

[0186] In the several embodiments provided in this application, it should be understood that the disclosed methods and apparatus can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0187] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can be physically included separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or in the form of hardware plus software functional units.

[0188] The integrated units implemented as software functional units described above can be stored in a computer-readable storage medium. These software functional units, stored in a storage medium, include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute some steps of the transmission and reception methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0189] The above description is the preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principles described in this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A network security detection method, characterized in that, CATF, used for network cryptographic algorithm detection, includes: Acquire data traffic between a client node and a server node, wherein the client node and the server node are communicatively connected, and the data traffic includes at least one of the following: node port information, node Internet Protocol (IP) address, and application protocol; Based on the data traffic, at least one directed graph is determined, wherein the directed graph includes node attribute information of the client node, node attribute information of the server node, and edge information. The node attribute information includes at least one of the following: the protocol type supported by the node, the protocol version supported, and the cryptographic algorithm supported. The edge information is used to indicate the data transmission path between the client node and the server node. Based on the at least one directed graph and security policy requirements, network security detection is performed to obtain network security detection results.

2. The method according to claim 1, characterized in that, The step of determining at least one directed graph based on the data traffic includes: Obtain at least one set of session feature information from the data traffic, the session feature information including at least one of the following: a first IP address, a first port information, a second IP address, a second port information, and a protocol identifier; Based on the at least one set of session feature information, construct or update the directed graph corresponding to each of the session feature information; Wherein, the client node is any node in the network service system, the first IP address is the IP address of the client node, the first port information is the port information of the client node, the second IP address is the IP address of the server node, the second port information is the port information of the server node, and the protocol identifier is the identifier information of the protocol used when the client node and the server node communicate.

3. The method according to claim 2, characterized in that, The step of constructing a directed graph corresponding to each of the at least one set of session feature information includes: If the first session feature information includes the IP address of the first node, and the first node does not exist in any of the pre-constructed first directed graphs, then the first node is added; wherein the first node is any client node in the network service system, and the first session feature information is any set of session feature information from the at least one set of session feature information. If the first session feature information includes the IP address of the second node, and the second node does not exist in any of the first directed graphs, then the second node is added. The second node is any server node in the network service system, and there is a communication connection between the first node and the second node. In the first directed graph, a first edge information is set between the first node and the second node. The first edge information is used to indicate the data transmission path between the first node and the second node.

4. The method according to claim 2 or 3, characterized in that, The step of updating the directed graph corresponding to each of the at least one set of session feature information includes: If the application protocol corresponding to the protocol identifier in the second session feature information is a preset security protocol, obtain the security protocol information and the supported cryptographic algorithm of each node in the second session feature information; wherein, the second session feature information is any set of session feature information from the at least one set of session feature information; Based on the security protocol information and cryptographic algorithms supported by the third node and the fourth node in the second session feature information, the node attribute information of the third node and the node attribute information of the fourth node in the third directed graph are updated; wherein, the third node is any client node in the network service system, the fourth node is any server node in the network service system, and there is a communication connection between the third node and the fourth node. Update the second edge information in the third directed graph, which is used to indicate the data transmission path between the third node and the fourth node.

5. The method according to claim 1, characterized in that, The network security detection results are used to instruct the target node to update the password module; and / or, The network security detection result is used to indicate that a secure connection should be established between the node that has a communication connection with the target node and the target node. The target node is either the server node or the client node.

6. The method according to any one of claims 1 to 3, characterized in that, The method further includes: Traverse each of the at least one directed graph to obtain at least one fifth node; wherein the fifth node is a server node in the network service system and the fifth node is an NF node; Based on the node attribute information of each of the at least one fifth node, obtain the security protocol supported by each of the fifth nodes; Based on the security protocols supported by each of the fifth nodes, determine at least one cryptographic algorithm supported by each of the fifth nodes; When the communication connection between the fifth node and the sixth node is established through the target cryptographic algorithm, the target cryptographic algorithm is determined to be a cryptographic algorithm supported by the fifth node; wherein, the target cryptographic algorithm is one of at least one cryptographic algorithm supported by the fifth node, and the sixth node is the client node; Based on the target cryptographic algorithm, update the supported cryptographic algorithms in the node attribute information of the fifth node.

7. A network security detection device, characterized in that, Applied to CATF, including: The acquisition module is used to acquire data traffic between client nodes and server nodes; wherein, the client node is any node in the network service system, and the server node is a node in the network service system that has a communication connection with the client node; the data traffic includes node port information, node Internet Protocol IP address, and application protocol. A determination module is used to determine at least one directed graph based on the data traffic; wherein the directed graph includes node attribute information of the client node, node attribute information of the server node, and edge information, the node attribute information includes the protocol type supported by the node, the protocol version supported, and the cryptographic algorithm supported, and the edge information is used to indicate the data transmission path between the client node and the server node; The generation module is used to generate network security detection results based on the at least one directed graph and the security policy requirements of the network service system.

8. An electronic device, characterized in that, include: A processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the steps of the network security detection method as described in any one of claims 1 to 6.

9. A computer-readable storage medium for storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps in the network security detection method as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, It includes computer instructions that, when executed by a processor, implement the steps in the network security detection method as described in any one of claims 1 to 6.

Images