Method and system for positioning data stream with null domain name based on task ID

Abstract

The invention relates to the technical field of network security management and flow analysis, and provides a method and a system for positioning a data flow with a null domain name based on a task ID, and the method comprises the steps: monitoring a synchronous message through a process A, and capturing network flow; the abnormal task ID is received through the process B, and a server IP list is determined according to the corresponding domain name of the abnormal task ID; filtering a Client Hello data stream of a target IP (Internet Protocol) from the captured message; judging whether each data stream carries a Server Name field or not; and counting the proportion of the data streams which do not carry the fields and have null domain names, and outputting an evidence message. The problems that traditional manual analysis is low in efficiency, poor in accuracy and high in personnel skill requirement are solved, and the network security management efficiency is remarkably improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security management and traffic analysis, in particular to a domain name empty data flow positioning method and system based on task ID. BACKGROUND

[0002] When a user uses an online service, the user will access corresponding service resources through an HTTPS protocol. In a client hello process message of the HTTPS, a server name field is carried, which is a domain name feature. Fixed network traffic is given to a dedicated processing server through a convergence and shunting device, and a processing software runs on the server. A business system issues a domain name feature through a task WEB interface, and when a user accesses service resources corresponding to the domain name through the HTTPS, if a server name field in a client hello message hits the feature, the business system performs a discarding action on the message, thereby limiting the user from accessing the service resources. However, in a present network, there are cases in which the server name field is not carried in the client hello message, and in this case, the business system cannot effectively hit the feature to limit the user from accessing the corresponding service resources. When this situation occurs, it is necessary to locate and analyze the traffic that does not carry the server name field, to give evidence and to show the proportion of the situation.

[0003] An existing method is that an operation and maintenance personnel values and follows during a task, and when a harmful service resource can be normally accessed, the traffic that is captured is analyzed to give evidence. This method has four shortcomings: 1. The knowledge reserve requirement for the operation and maintenance personnel is high; 2. The manual analysis is slow and cannot quickly give evidence; 3. The manual analysis is easy to miss and the proportion of the situation given is not accurate; 4. When multiple tasks are abnormal, a large amount of manpower needs to be invested for analysis, and the cost of manpower is high. SUMMARY

[0004] In order to help solve the above technical problems, the present application provides a domain name empty data flow positioning method and system based on task ID.

[0005] In a first aspect, the present application provides a domain name empty data flow positioning method based on task ID, which adopts the following technical solution: A domain name empty data flow positioning method based on task ID, comprising the following steps: A process A listens to and parses a synchronization message to obtain a task ID and a target domain name corresponding to the task ID, and based on the task ID, corresponding network traffic messages are captured and stored; The process B receives an abnormal task ID to be analyzed, and acquires a target domain name corresponding to the abnormal task ID according to the abnormal task ID; According to the target domain name, at least one service IP address corresponding to the target domain name is determined. From the network traffic messages captured by the process A, all data streams with the service IP address as the destination address and the Client Hello message type are filtered out. It is judged whether the Client Hello message of each data stream carries a Server Name field, and a judgment result is generated according to the judgment. Based on the judgment result, the proportion information of the domain name empty data stream in the Client Hello message without carrying the Server Name field is counted, and the evidence message of the domain name empty data stream corresponding to the abnormal task ID is output.

[0006] Preferably, the step of determining one or more service IP addresses corresponding to the target domain name comprises: From the network traffic messages captured and stored by the process A, a DNS response message is extracted, and all service IP addresses corresponding to the target domain name are parsed from the DNS response message.

[0007] Preferably, the process A and the process B run in parallel after the system is started, the process A continuously captures messages during task issuing, and the process B triggers the execution of the analysis process after receiving the abnormal task ID.

[0008] Preferably, the step of judging whether the Client Hello message of each data stream carries a Server Name field comprises: If the Client Hello message contains the Server Name extension field and the field is not empty, a first judgment result is marked; if the Server Name extension field is not contained or the field is empty, a second judgment result is marked.

[0009] Preferably, the step of counting the proportion information of the domain name empty data stream comprises: The number of data streams marked as the second judgment result is divided by the total number of all filtered Client Hello data streams to obtain the proportion information.

[0010] Preferably, after the process A parses the synchronization message, the task ID and the target domain name corresponding thereto are stored in a task ID dictionary; the process B queries the task ID dictionary according to the abnormal task ID to acquire the target domain name corresponding thereto.

[0011] In a second aspect, the application provides a task ID-based domain name empty data stream positioning system, which adopts the following technical solution: A task ID-based domain name empty data stream positioning system, wherein the task ID-based domain name empty data stream positioning method in any of the first aspects is adopted, comprising: A message capturing module configured to listen to and parse synchronization messages to obtain task IDs and their corresponding target domain names, and capture and store corresponding network traffic messages based on the task IDs; A task analysis triggering module configured to receive abnormal task IDs to be analyzed, and obtain corresponding target domain names according to the abnormal task IDs; A server IP determining module configured to determine one or more server IP addresses corresponding to the target domain names according to the target domain names; A traffic filtering module configured to filter out all data streams with the server IP addresses as the destination addresses and Client Hello messages as the message types from the network traffic messages captured by the message capturing module; A domain name judging module configured to judge whether the Client Hello messages of each data stream carry a ServerName field, and generate a judgment result accordingly; An evidence output module configured to, based on the judgment result, count the proportion information of the domain name empty data streams in the Client Hello messages that do not carry the ServerName field, and output the evidence messages of the domain name empty data streams corresponding to the abnormal task IDs.

[0012] In summary, compared with the prior art, the method of the application realizes automatic positioning and quantitative analysis of HTTPS data streams without carrying the SNI field by task ID driving and process automatic cooperation, overcomes the defects of low efficiency, easy omission and high skill requirement of the operator of the traditional manual analysis method, and has the following advantages: 1. The operator can obtain the required evidence messages and proportion information by inputting the task ID, reducing the requirement for the operator's standard reserve; 2. The analysis process is fully automated, greatly improving the analysis efficiency and accuracy; 3. When multiple task IDs are abnormal, it can also be responded in time, reducing the risk of insufficient manpower; 4. Compared with manual positioning analysis, tool analysis can bring better trust to customers. BRIEF DESCRIPTION OF DRAWINGS

[0013] Figure 1 A flowchart of an embodiment of a task ID-based domain name empty data stream positioning method of the application. DETAILED DESCRIPTION

[0014] The application will be further described below in conjunction with the drawings, and the structure and principles of the application are very clear to those skilled in the art. It should be understood that the specific embodiments described herein are only used to explain the application and not to limit the application.

[0015] A task ID-based domain name empty data stream positioning method, comprising the following steps: Process A listens to and parses the synchronization message to obtain the task ID and the target domain name corresponding thereto, and captures and stores the corresponding network traffic message based on the task ID; Process B receives an abnormal task ID to be analyzed, and obtains the target domain name corresponding to the abnormal task ID according to the abnormal task ID; According to the target domain name, at least one server IP address corresponding to the target domain name is determined; From the network traffic message captured by process A, all data streams with the server IP address as the destination address and the Client Hello message type are filtered out; Determine whether the Client Hello message of each data stream carries a Server Name field, and generate a judgment result based on the determination; Based on the judgment result, the proportion information of the domain name empty data stream in the Client Hello message without carrying the Server Name field is counted, and the evidence message of the domain name empty data stream corresponding to the abnormal task ID is output.

[0016] The step of determining one or more server IP addresses corresponding to the target domain name according to the target domain name comprises: Extract the DNS response message from the network traffic message captured and stored by process A, and parse all server IP addresses corresponding to the target domain name from the DNS response message.

[0017] The step of determining whether the Client Hello message of each data stream carries a Server Name field comprises: If the Client Hello message contains a Server Name extension field and the field is not empty, mark the first judgment result; if the Client Hello message does not contain a Server Name extension field or the field is empty, mark the second judgment result.

[0018] The step of counting the proportion information of the domain name empty data stream comprises: Divide the number of data streams marked as the second judgment result by the total number of all Client Hello data streams filtered out to obtain the proportion information.

[0019] In the embodiment of the present application, after process A parses the synchronization message, the task ID and its corresponding target domain name are also stored in a task ID dictionary; process B queries the task ID dictionary according to the abnormal task ID to obtain the corresponding target domain name.

[0020] In the present application, the system runs on a server, parses a configuration file to obtain configuration information. Process A accesses the online traffic of a dial test user, listens to a task ID synchronization message (task ID and task content) and stores it, when a task ID is issued, the message is captured according to the task ID and stored in a specified path, and the overall log is recorded. Process B is responsible for listening to the input of an abnormal task ID, when a task ID to be analyzed is received, the message under the corresponding path is extracted according to the task ID, subsequent analysis is performed according to the task content, and the empty domain name data flow evidence message and the proportion information are obtained.

[0021] When the program stops, the final output content is: The stored message corresponding to each task ID and the overall log record; The empty domain name data flow evidence message and the proportion information of the task ID to be analyzed.

[0022] Specifically, the method of the present application comprises the following steps: Step S101: read the configuration file or configuration information. The configuration information includes the following contents: Network interface name: the network interface name of traffic access, which can be configured and defaults to eth0; Project storage directory: the path for storing log files and packet capture files, which can be configured and defaults to / appfs / current; Message storage directory: the directory for storing messages of each task ID, which can be configured and defaults to / appfs / current / task ID; Message name: the file name for storing messages, which can be configured and defaults to task ID_timestamp.pcap; Overall log name: the file name of the overall log, which can be configured and defaults to gwtask_timestamp.log; Analysis storage directory: the path for storing analysis-related contents, which can be configured and defaults to / appfs / analysis / ; Evidence message storage directory: / appfs / analysis / task ID; Evidence message name: the file name of the evidence message, which can be configured and defaults to / appfs / analysis / task ID / serial number.pcap; Analysis log name: the file name of the analysis log, which can be configured and defaults to all_timestamp.csv.

[0023] Step S102: Create file storage directory, initialization is completed Create the corresponding directory according to the storage information in the configuration. If the directory already exists, it is not created.

[0024] Step S201: Start process A, start synchronous message listening and packet capture function Step S202: Parse the synchronization message, get the task ID and task content, generate a task ID dictionary, for example: { "3000289130131": "ystqf.cn", "3000289130132": "41cze.top" } As the example describes, the dictionary stores the following information: Task ID, task content (domain name) Step S203: Start packet capture, when a new task ID arrives, stop the current packet capture, store the message and record the overall log Message storage example: 3000289130131_202509301515.pcap Log example: gwtask_202509301515.log Log content example: 202509301515,3000289130131,ystqf.cn Step S204: Determine whether the current test task is complete. If it is complete, stop process A; if it is not complete, continue with step S203 Step S301: Start process B, start the abnormal task ID listening function, get the domain name information from the task ID field through the task ID Step S302: Get the message and parse the extracted domain name server IP. Here, the client hello message is filtered, and the corresponding message destination IP is extracted. The client hello message filtering condition is: tls.handshake.type == 1 Step S303: Through the server IP, reverse lookup the DNS response message to get the server IP list of the domain name Step S304: Through the traffic filtering module, extract the client hello traffic corresponding to all server IPs Filtering rule: client hello message characteristics and server IP, such as: tls.handshake.type ==1&&(ip.dst == 220.181.43.51) Step S305: traverse the extracted client hello traffic to the domain name judgment module, and record it to the evidence dictionary, for example: { "str_00001": "OK", "str_00002": "NONE" } Step S306: After the traversal is completed, the evidence dictionary is processed, the evidence message is stored, and the proportion information is output, for example: Evidence message example: / appfs / analysis / 3000289130131 / 00001.pcap Analysis log example: all_202509301525.csv Analysis log content example: 3000289130131, ystqf.cn, 10% In the embodiments of the present application, process A and process B run in parallel after the system starts, process A continuously performs packet capture during task issuance, and process B triggers the execution of the analysis process after receiving the abnormal task ID, therefore the step numbers (such as S201) above are only illustrative and should not be interpreted as a limitation on the technical solutions.

[0025] The present application also proposes a task ID-based domain name empty data stream positioning system, characterized in that the above-mentioned task ID-based domain name empty data stream positioning method is used, comprising: A packet capture module configured to listen to and parse synchronization messages to obtain task IDs and their corresponding target domain names, and capture and store corresponding network traffic messages based on task IDs; A task analysis trigger module for receiving abnormal task IDs to be analyzed, and obtaining corresponding target domain names according to the abnormal task IDs; A server IP determination module for determining one or more server IP addresses corresponding to the target domain name according to the target domain name; A traffic filtering module for filtering all data streams with the server IP address as the destination address and the Client Hello message type from the network traffic messages captured by the packet capture module; A domain name judgment module for judging whether the Client Hello message of each data stream carries the ServerName field, and generating a judgment result accordingly; An evidence output module for calculating the proportion of domain name empty data streams in the Client Hello message based on the judgment result, and outputting the evidence message of the domain name empty data stream corresponding to the abnormal task ID.

Claims

1. A method for locating data streams with empty domain names based on task IDs, characterized in that, Includes the following steps: Process A listens to and parses synchronization messages to obtain the task ID and its corresponding target domain name, and captures and stores the corresponding network traffic messages based on the task ID; Process B receives the ID of the abnormal task to be analyzed and obtains the corresponding target domain name based on the abnormal task ID; Based on the target domain name, determine at least one corresponding server IP address; Filter out all data streams whose destination address is the server IP address and whose message type is Client Hello from the network traffic packets captured by process A; Determine whether the Client Hello message of each data stream carries the Server Name field, and generate a determination result accordingly; Based on the judgment result, the percentage of empty domain name data streams in the Client Hello message that do not carry the Server Name field is calculated, and an evidence message for the empty domain name data stream corresponding to the abnormal task ID is output.

2. The method according to claim 1, characterized in that, The step of determining one or more server IP addresses corresponding to the target domain name includes: Extract DNS response messages from the network traffic packets captured and stored by process A, and parse all server IP addresses corresponding to the target domain name from the DNS response messages.

3. The method according to claim 1, characterized in that, Process A and process B run in parallel after the system starts. Process A continuously captures messages during task distribution, and process B triggers the execution analysis process after receiving the abnormal task ID.

4. The method according to claim 1, characterized in that, The step of determining whether the Client Hello message of each data stream carries a Server Name field includes: If the Client Hello message contains the Server Name extended field and the field is not empty, then the first judgment result is marked; if the Server Name extended field is not contained or the field is empty, then the second judgment result is marked.

5. The method according to claim 4, characterized in that, The steps for calculating the percentage of data streams with empty domain names include: The percentage information is obtained by dividing the number of data streams marked as the second judgment result by the total number of all filtered Client Hello data streams.

6. The method according to claim 1, characterized in that, After process A parses the synchronization message, it stores the task ID and its corresponding target domain name in a task ID dictionary; process B queries the task ID dictionary based on the abnormal task ID to obtain the corresponding target domain name.

7. A data stream location system based on an empty domain name using a task ID, characterized in that, The method for locating empty domain names based on task IDs, as described in any one of claims 1 to 6, includes: The message capture module is configured to listen for and parse synchronization messages to obtain the task ID and its corresponding target domain name, and capture and store the corresponding network traffic messages based on the task ID; The task analysis triggering module is used to receive the abnormal task ID to be analyzed and obtain the corresponding target domain name based on the abnormal task ID; The server IP determination module is used to determine one or more server IP addresses corresponding to the target domain name. The traffic filtering module is used to filter out all data streams whose destination address is the server IP address and whose message type is Client Hello from the network traffic packets captured by the packet capture module. The domain name determination module is used to determine whether the Client Hello message of each data stream carries the ServerName field, and generate a determination result accordingly; The evidence output module is used to, based on the judgment result, count the proportion of empty domain data streams in the Client Hello message that do not carry the ServerName field, and output an evidence message for an empty domain data stream corresponding to the abnormal task ID.

Images