HTTPS network attack detection method and device based on flow behavior detection
By detecting abnormal behavior and comparing fingerprints with HTTPS traffic, the problem of detecting HTTPS attack traffic has been solved, enabling effective monitoring of encrypted HTTPS traffic and identification of attack tools.
Patent Information
- Application Number
- CN202511457574.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-10-13
- Publication Date
- 2026-01-13
AI Technical Summary
Existing technologies are insufficient to effectively detect encrypted HTTPS attack traffic. Traditional methods cannot monitor HTTPS attack traffic, and JA3 fingerprint collisions are frequent under high traffic conditions. Decryption solutions are either immature or do not allow decryption. Business requests and attack tool traffic behaviors are similar and difficult to distinguish.
By acquiring target HTTPS traffic, a pre-set abnormal traffic behavior detection mechanism is used for initial identification, detecting abnormal behavior points, comparing attack tool fingerprints, detecting slow attacks, and detecting successful scans. Combined with the summary results of abnormal behavior, the attack tools and abnormal behavior points are confirmed.
It achieves effective detection of encrypted HTTPS traffic, solves fingerprint collision and behavioral interpretability issues, and accurately identifies attack tools and attack behaviors.
Smart Images
Figure CN121333675A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network information security technology, and in particular to a method and apparatus for detecting HTTPS network attacks based on traffic behavior detection. Background Technology
[0002] In network information security technology, the detection of encrypted data attacks is a crucial component, and the detection of HTTPS attack traffic has always been a challenge. Traditional HTTP attack traffic detection can generate alerts by matching plaintext keywords such as malicious commands and SQL injection statements. However, HTTPS attack traffic encrypts all plaintext content, making traditional methods ineffective for monitoring.
[0003] Current solutions mainly include decrypting HTTPS attack traffic to detect threats, or comparing pre-extracted JA3 fingerprints of attack tools with HTTPS traffic to detect threats. However, under high traffic conditions, collisions can occur between normal application JA3 fingerprints and attack tool JA3 fingerprints; in practice, decryption solutions for detecting threats after decrypting HTTPS attack traffic are not mature enough, and there are situations where decryption is impossible or the business does not allow the implementation of decryption solutions; in fixed scenarios, business requests and attack tools have similarities in traffic behavior, so detection cannot be solely based on traffic behavior. Summary of the Invention
[0004] This invention provides a method and apparatus for detecting HTTPS network attacks based on traffic behavior detection, in order to solve at least one of the above-mentioned technical problems.
[0005] This invention provides a method for detecting HTTPS network attacks based on traffic behavior detection, the method comprising:
[0006] Obtain the target HTTPS traffic to be identified;
[0007] Using a pre-defined abnormal traffic behavior detection mechanism, the target HTTPS traffic is initially identified as abnormal to obtain behavioral anomalies.
[0008] The abnormal behavior points are compared with the attack tool fingerprint database, slow attack detection is performed, and successful scan detection is performed to obtain a summary result of the abnormal behavior.
[0009] In some embodiments, the preset abnormal traffic behavior detection mechanism includes:
[0010] Within a preset time frame, there must be at least a preset number of single streams for each IP address pair, and the number of single streams for each IP address pair must be less than the preset number.
[0011] The duration of each stream is recorded, and the duration is within a preset range;
[0012] The client port numbers of multi-stream applications exhibit a continuous distribution.
[0013] Count the number of uplink packets for each stream; if the number of uplink packets exceeds a preset percentage.
[0014] Count the maximum number of uplink packets for each stream; if the maximum number of uplink packets exceeds a preset percentage.
[0015] The number of Application Data in each stream is counted, and the number of Application Data exceeds a preset proportion;
[0016] Detection points that meet all of the above conditions are considered abnormal traffic behavior points.
[0017] In some embodiments, the abnormal behavior points are compared with an attack tool fingerprint database, slow attack detection is performed, and scan success detection is performed, specifically including:
[0018] The abnormal behavior points are further identified and matched against the attack tool's limited domain fingerprint database. If a successful match is found, the attack tool name and attack platform type information are output.
[0019] The abnormal behavior points are then re-evaluated to determine whether they constitute a slow attack.
[0020] The abnormal behavior points are then re-evaluated to determine whether any abnormal behavior indicates a successful scan.
[0021] In some embodiments, the summary results of the abnormal behavior include at least the corresponding attack tool name, attack tool version, attack tool operating platform information, traffic behavior anomaly points, attack frequency, whether it is a slow attack, and whether the attack was successful.
[0022] In some embodiments, the abnormal behavior points are further identified to determine whether they constitute a slow attack, specifically including:
[0023] Within 1 minute, there must be at least 10 flows between the same IP address and at least 20 flows between the same IP address, and the number of flows between the same IP address must be less than 5000.
[0024] The duration of each stream after initial screening is recorded, rounded up to the nearest minute. Streams less than one minute are set to zero, and the most frequent duration is less than 5 minutes.
[0025] In some embodiments, the abnormal behavior points are further identified to determine whether there are any abnormal behaviors that resulted in successful scanning, specifically including:
[0026] Let the number of downlink packets in the multi-stream be x1, x2, x3...x. n ;
[0027] Take the average number M and the standard deviation S of these downlink packets. If there is a downlink packet count greater than the average number plus the standard deviation multiplied by 3, the scan is considered successful.
[0028] The present invention also provides an HTTPS network attack detection device based on traffic behavior detection, the device comprising:
[0029] The traffic acquisition unit is used to acquire the target HTTPS traffic to be identified.
[0030] Anomaly detection unit is used to perform preliminary anomaly identification on the target HTTPS traffic using a preset abnormal traffic behavior detection mechanism to obtain behavioral anomalies;
[0031] The secondary detection unit is used to compare the abnormal behavior points with the attack tool fingerprint database, detect slow attacks, and detect successful scans to obtain a summary result of abnormal behavior.
[0032] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described above.
[0033] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described above.
[0034] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the method described above.
[0035] The HTTPS network attack detection method and apparatus based on traffic behavior detection provided by this invention acquires the target HTTPS traffic to be identified, and uses a preset abnormal traffic behavior detection mechanism to perform preliminary anomaly identification on the target HTTPS traffic to obtain behavioral anomalies. These behavioral anomalies are then compared with an attack tool fingerprint database, slow attack detection is performed, and successful scan detection is conducted to obtain a summary result of behavioral anomalies. In this way, for HTTPS attack traffic, fingerprinting is used to identify attack tools, and a behavioral mechanism is added to solve the problems of fingerprint collision and the interpretability of attack tool behavior, ultimately confirming the attack tools and abnormal attack behaviors, thereby achieving encrypted HTTPS traffic detection. Attached Figure Description
[0036] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.
[0037] Figure 1 This is one of the flowcharts of the HTTPS network attack detection method based on traffic behavior detection provided by the present invention;
[0038] Figure 2 This is the second flowchart of the HTTPS network attack detection method based on traffic behavior detection provided by the present invention. Detailed Implementation
[0039] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.
[0040] In general, the method provided by this invention uses web attack network traffic that communicates using the HTTPS protocol. Its input is network traffic that communicates using the HTTPS protocol, and its output is the name and version of the attack tool, the name and version of the system on which the attack tool runs, the attack frequency, and traffic anomalies.
[0041] In one specific implementation, such as Figure 1 As shown, the HTTPS network attack detection method based on traffic behavior detection provided by this invention includes the following steps:
[0042] Obtain the target HTTPS traffic to be identified;
[0043] Using a pre-defined abnormal traffic behavior detection mechanism, the target HTTPS traffic is initially identified as abnormal to obtain behavioral anomalies.
[0044] The abnormal behavior points are compared with the attack tool fingerprint database, slow attack detection is performed, and successful scan detection is performed to obtain a summary result of the abnormal behavior.
[0045] During the TLS handshake, multiple values from the ClientHello phase are extracted, including but not limited to the TLS version, client cipher suite list, server cipher suite type, certificate version, certificate signing algorithm, certificate signing algorithm length, certificate issuer field, certificate user field, certificate public key algorithm, certificate public key algorithm length, and certificate extensions. This set of features is concatenated into a long string, and the resulting hash value is used as the fingerprint.
[0046] In some embodiments, the preset abnormal traffic behavior detection mechanism includes:
[0047] Within a preset time frame, there must be at least a preset number of single streams for each IP address pair, and the number of single streams for each IP address pair must be less than the preset number.
[0048] The duration of each stream is recorded, and the duration is within a preset range;
[0049] The client port numbers of multi-stream applications exhibit a continuous distribution.
[0050] Count the number of uplink packets for each stream; if the number of uplink packets exceeds a preset percentage.
[0051] Count the maximum number of uplink packets for each stream; if the maximum number of uplink packets exceeds a preset percentage.
[0052] The number of Application Data in each stream is counted, and the number of Application Data exceeds a preset proportion;
[0053] Detection points that meet all of the above conditions are considered abnormal traffic behavior points.
[0054] Specifically, abnormal traffic behavior detection mechanisms, such as Figure 2 As shown, the abnormal traffic behavior detection mechanism is divided into general detection items and TLS communication data statistics detection items. If all of the following 6 detection points are met, the traffic behavior can be identified as abnormal.
[0055] The general testing items include:
[0056] 1) Within a certain time range, there must be at least a certain number of single streams for the same IP pair, and the number of single streams for the same IP pair must be less than a certain number. The specific algorithm is that within 1 minute, there must be at least 20 streams for the same IP pair, at least 30 streams for the same IP pair, and less than 5000 streams for the same IP pair (generally used for initial screening of HTTPS scanning behavior; see the section on "Slow Attack Detection" for slow scanning).
[0057] 2) Count the duration of each flow. The most common duration is within a certain range. The specific algorithm is to count the duration of each flow after the initial screening, round up to the minute, and return less than 1 minute to 0. The most frequent duration is less than 2 minutes (single flow duration is less than 2 seconds) (generally HTTPS scanning behavior is screened first, slow scanning is seen in the section on slow attack detection).
[0058] 3) The client port numbers of multi-stream traffic exhibit a continuous distribution. The specific algorithm involves statistically analyzing the distribution of client port numbers for each stream after initial screening to determine whether the client port numbers of abnormal traffic exhibit continuity. Let the port values be x1, x2, x3...x n Then take the median M of these port values, and obtain the y-th median; if there are arithmetic progressions for the (y-3), (y-2), (y-1), (y), (y+1), and (y+2)-th values, then the port distribution has continuity:
[0059] x (y-2) -x (y-3) =x (y-1) -x (y-2) =x (y) -x (y-1) =x (y-1) -x (y) =x (y+2) -x (y+1)
[0060] TLS communication data statistics and detection items include:
[0061] 1) Count the number of uplink packets for each flow. The most prevalent number of uplink packets should exceed a certain proportion. The specific algorithm is as follows: count the number of uplink packets for each flow after initial screening, and sum the numbers of single flows with the same number of uplink packets (8 or more times). The proportion of these single flows should exceed 40% of the total number of flows. This 40% threshold is based on extensive data collection and in-depth analysis. Specifically, by capturing and analyzing a large number of data packets generated by various common HTTPS scanning tools on the market, and through rigorous statistical processing, this proportion was finally determined as a reasonable boundary for distinguishing abnormal traffic from normal traffic.
[0062] 2) The maximum number of uplink packets per flow is calculated, and the most prevalent maximum uplink packet count should exceed a certain proportion. Specifically, the algorithm involves calculating the maximum uplink packet count for each flow after initial screening, summing the number of individual flows with the same uplink packet count (8 or more times), and ensuring that the proportion exceeds 40% of the total flows. This 40% threshold is based on extensive data collection and in-depth analysis. Specifically, we captured and analyzed a large number of data packets generated by various common HTTPS scanning tools on the market, and through rigorous statistical processing, ultimately determined this proportion as a reasonable boundary for distinguishing between abnormal and normal traffic.
[0063] 3) Count the amount of Application Data for each flow. The most prevalent Application Data should exceed a certain proportion. The specific algorithm involves counting the Application Data of each flow after initial screening, summing the number of single flows with the same number of uplink packets (8 or more), and ensuring that the proportion exceeds 40% of the total flow. This 40% threshold is based on extensive data collection and in-depth analysis. Specifically, we captured and analyzed a large number of data packets generated by various common HTTPS scanning tools on the market, and after rigorous statistical processing, finally determined this proportion as a reasonable boundary for distinguishing between abnormal and normal traffic.
[0064] In some embodiments, the abnormal behavior points are compared with an attack tool fingerprint database, slow attack detection is performed, and scan success detection is performed, specifically including:
[0065] The abnormal behavior points are further identified and matched against the attack tool's limited domain fingerprint database. If a successful match is found, the attack tool name and attack platform type information are output.
[0066] The abnormal behavior points are then re-evaluated to determine whether they constitute a slow attack.
[0067] The abnormal behavior points are then re-evaluated to determine whether any abnormal behavior indicates a successful scan.
[0068] In some embodiments, the summary results of the abnormal behavior include at least the corresponding attack tool name, attack tool version, attack tool operating platform information, traffic behavior anomaly points, attack frequency, whether it is a slow attack, and whether the attack was successful.
[0069] Specifically, the overall process includes:
[0070] 1. Encrypted HTTPS traffic enters the detection phase for abnormal traffic behavior detection;
[0071] 2. An abnormal traffic behavior detection mechanism is used for detection. Once all abnormal conditions are met, abnormal behavior is identified and an anomaly is output.
[0072] 3. Perform secondary verification by matching the attack tool's limited domain fingerprint database. If a match is found, output information such as the attack tool name and attack platform type.
[0073] 4. Conduct a secondary assessment to determine whether it is a slow attack;
[0074] 5. Conduct a secondary verification to determine if there are any abnormal behaviors indicating a successful scan;
[0075] 6. Perform a summary output of abnormal behavior. The output content includes, but is not limited to, the corresponding attack tool name, attack tool version, attack tool operating platform information, traffic behavior anomalies, attack frequency, whether it is a slow attack, and whether the attack was successful.
[0076] The attack tool fingerprint database refers to web attack tools, excluding scripts. Attack tools are categorized into two attack types: web scanning and detection, and web vulnerability exploitation. Fingerprint collection for attack tools follows the same method as for PC application software, requiring different versions of the attack tool to be run on different operating systems to collect corresponding limited-domain fingerprints. The format for attack tool fingerprint detection names is: tool name + tool version number + system name + system version number, such as burpsuiteV1.2_Win10_V10.0.1.174.
[0077] The attack tools are mainly collected from the internet, with new attack tool fingerprints being added over time.
[0078] A partial list of attack tools is shown in Table 1:
[0079] Table 1
[0080] AcunetixAWVS NetSparker Burp Suite dirmap w3af Nikto OWASP ZAP Vega Appscan Golismero nuclei Arachni metasploit xray Nessus skipfish Sword
[0081] In some embodiments, the abnormal behavior points are further identified to determine whether they constitute a slow attack, specifically including:
[0082] Within 1 minute, there must be at least 10 flows between the same IP address and at least 20 flows between the same IP address, and the number of flows between the same IP address must be less than 5000.
[0083] The duration of each stream after initial screening is recorded, rounded up to the nearest minute. Streams less than one minute are set to zero, and the most frequent duration is less than 5 minutes.
[0084] Specifically, slow attack detection targets the slow scanning behavior of HTTPS scanners after special settings. The biggest difference between slow scanning and normal scanning is that the time interval between each scan request sent in slow scanning is much longer than that in normal scanning, which makes it impossible for general network attack identification mechanisms to function.
[0085] This invention detects HTTPS network attacks through an abnormal traffic behavior detection mechanism, and then performs a secondary verification, using the following detection items to detect slow attacks:
[0086] 1) Within 1 minute, there must be at least 10 flows between the same IP address and at least 20 flows between the same IP address, and the total number of flows between the same IP address must be less than 5000.
[0087] 2) Calculate the duration of each stream after the initial screening, rounding up to the nearest minute. Streams shorter than 1 minute are set to 0. The most frequent occurrence of a stream with a duration of less than 5 minutes (single stream duration less than 5 seconds) is considered a valid stream.
[0088] In some embodiments, the abnormal behavior points are further identified to determine whether there are any abnormal behaviors that resulted in successful scanning, specifically including:
[0089] Let the number of downlink packets in the multi-stream be x1, x2, x3...x. n ;
[0090] Take the average number M and the standard deviation S of these downlink packets. If there is a downlink packet count greater than the average number plus the standard deviation multiplied by 3, the scan is considered successful.
[0091] Specifically, the successful scan detection is for cases where the HTTPS scanner successfully scans for or exploits vulnerabilities. When the HTTPS scanner is scanning, the server will return a response packet. When a vulnerability is successfully scanned or exploited through scanning or exploitation, the response packet returned by the server is significantly different from that of a normal scan. We identify whether the scan is successful by counting the number of downlink packets.
[0092] Let the number of downlink packets in the multi-stream be x1, x2, x3...x. n Then, take the average M and standard deviation S of these downlink packet counts. If there is a downlink packet count greater than the average + standard deviation * 3, the scan is considered successful.
[0093] x n >M+S*3.
[0094] In the above specific embodiments, the HTTPS network attack detection method based on traffic behavior detection provided by the present invention acquires the target HTTPS traffic to be identified, utilizes a preset abnormal traffic behavior detection mechanism to perform preliminary anomaly identification on the target HTTPS traffic to obtain behavioral anomalies; and compares the behavioral anomalies with an attack tool fingerprint database, detects slow attacks, and detects successful scans to obtain a summary result of behavioral anomalies. Thus, for HTTPS attack traffic, fingerprinting is used to identify attack tools, and a behavioral mechanism is added to solve the problems of fingerprint collision and the interpretability of attack tool behavior, ultimately confirming the attack tools and attack behavior anomalies, thereby achieving encrypted HTTPS traffic detection.
[0095] In addition to the methods described above, the present invention also provides an HTTPS network attack detection device based on traffic behavior detection, the device comprising:
[0096] The traffic acquisition unit is used to acquire the target HTTPS traffic to be identified.
[0097] Anomaly detection unit is used to perform preliminary anomaly identification on the target HTTPS traffic using a preset abnormal traffic behavior detection mechanism to obtain behavioral anomalies;
[0098] The secondary detection unit is used to compare the abnormal behavior points with the attack tool fingerprint database, detect slow attacks, and detect successful scans to obtain a summary result of abnormal behavior.
[0099] In some embodiments, the preset abnormal traffic behavior detection mechanism includes:
[0100] Within a preset time frame, there must be at least a preset number of single streams for each IP address pair, and the number of single streams for each IP address pair must be less than the preset number.
[0101] The duration of each stream is recorded, and the duration is within a preset range;
[0102] The client port numbers of multi-stream applications exhibit a continuous distribution.
[0103] Count the number of uplink packets for each stream; if the number of uplink packets exceeds a preset percentage.
[0104] Count the maximum number of uplink packets for each stream; if the maximum number of uplink packets exceeds a preset percentage.
[0105] The number of Application Data in each stream is counted, and the number of Application Data exceeds a preset proportion;
[0106] Detection points that meet all of the above conditions are considered abnormal traffic behavior points.
[0107] In some embodiments, the abnormal behavior points are compared with an attack tool fingerprint database, slow attack detection is performed, and scan success detection is performed, specifically including:
[0108] The abnormal behavior points are further identified and matched against the attack tool's limited domain fingerprint database. If a successful match is found, the attack tool name and attack platform type information are output.
[0109] The abnormal behavior points are then re-evaluated to determine whether they constitute a slow attack.
[0110] The abnormal behavior points are then re-evaluated to determine whether any abnormal behavior indicates a successful scan.
[0111] In some embodiments, the summary results of the abnormal behavior include at least the corresponding attack tool name, attack tool version, attack tool operating platform information, traffic behavior anomaly points, attack frequency, whether it is a slow attack, and whether the attack was successful.
[0112] In some embodiments, the abnormal behavior points are further identified to determine whether they constitute a slow attack, specifically including:
[0113] Within 1 minute, there must be at least 10 flows between the same IP address and at least 20 flows between the same IP address, and the number of flows between the same IP address must be less than 5000.
[0114] The duration of each stream after initial screening is recorded, rounded up to the nearest minute. Streams less than one minute are set to zero, and the most frequent duration is less than 5 minutes.
[0115] In some embodiments, the abnormal behavior points are further identified to determine whether there are any abnormal behaviors that resulted in successful scanning, specifically including:
[0116] Let the number of downlink packets in the multi-stream be x1, x2, x3...x. n ;
[0117] Take the average number M and the standard deviation S of these downlink packets. If there is a downlink packet count greater than the average number plus the standard deviation multiplied by 3, the scan is considered successful.
[0118] In the above specific embodiments, the HTTPS network attack detection device based on traffic behavior detection provided by the present invention acquires the target HTTPS traffic to be identified, and uses a preset abnormal traffic behavior detection mechanism to perform preliminary anomaly identification on the target HTTPS traffic to obtain behavioral anomalies. These behavioral anomalies are then compared with an attack tool fingerprint database, slow attack detection is performed, and successful scan detection is conducted to obtain a summary result of behavioral anomalies. Thus, for HTTPS attack traffic, fingerprinting is used to identify attack tools, and a behavioral mechanism is added to solve the problems of fingerprint collision and the interpretability of attack tool behavior, ultimately confirming the attack tools and abnormal attack behavior, thereby achieving encrypted HTTPS traffic detection.
[0119] The electronic device provided by this invention may include a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other via the communication bus. The processor can invoke logical instructions in the memory to execute the method described above.
[0120] Furthermore, the logical instructions in the aforementioned memory can be implemented as software functional units and sold or used as independent products, and can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.
[0121] On the other hand, the present invention also provides a computer program product, the computer program product including a computer program, the computer program being stored on a non-transitory computer-readable storage medium, and the computer being executed by a processor, the computer being able to perform the methods described above.
[0122] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the methods described above.
[0123] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.
[0124] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.
[0125] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.
Claims
1. A method for detecting HTTPS network attacks based on traffic behavior detection, characterized in that, The method includes: Obtain the target HTTPS traffic to be identified; Using a pre-defined abnormal traffic behavior detection mechanism, the target HTTPS traffic is initially identified as abnormal to obtain behavioral anomalies. The abnormal behavior points are compared with the attack tool fingerprint database, slow attack detection is performed, and successful scan detection is performed to obtain a summary result of the abnormal behavior.
2. The HTTPS network attack detection method based on traffic behavior detection according to claim 1, characterized in that, The pre-defined abnormal traffic behavior detection mechanisms include: Within a preset time frame, there must be at least a preset number of single streams for each IP address pair, and the number of single streams for each IP address pair must be less than the preset number. The duration of each stream is recorded, and the duration is within a preset range; The client port numbers of multi-stream applications exhibit a continuous distribution. Count the number of uplink packets for each stream; if the number of uplink packets exceeds a preset percentage. Count the maximum number of uplink packets for each stream; if the maximum number of uplink packets exceeds a preset percentage. The number of Application Data in each stream is counted, and the number of Application Data exceeds a preset proportion; Detection points that meet all of the above conditions are considered abnormal traffic behavior points.
3. The HTTPS network attack detection method based on traffic behavior detection according to claim 2, characterized in that, The aforementioned behavioral anomalies are compared against an attack tool fingerprint database, slow attack detection is performed, and successful scan detection is conducted. Specifically, this includes: The abnormal behavior points are further identified and matched against the attack tool's limited domain fingerprint database. If a successful match is found, the attack tool name and attack platform type information are output. The abnormal behavior points are then re-evaluated to determine whether they constitute a slow attack. The abnormal behavior points are then re-evaluated to determine whether any abnormal behavior indicates a successful scan.
4. The HTTPS network attack detection method based on traffic behavior detection according to claim 3, characterized in that, The summary results of the abnormal behavior should include at least the corresponding attack tool name, attack tool version, attack tool operating platform information, traffic behavior anomaly points, attack frequency, whether it is a slow attack, and whether the attack was successful.
5. The HTTPS network attack detection method based on traffic behavior detection according to claim 4, characterized in that, The aforementioned abnormal behavior points are then re-evaluated to determine whether they constitute a slow attack. This includes: Within 1 minute, there must be at least 10 flows between the same IP address and at least 20 flows between the same IP address, and the number of flows between the same IP address must be less than 5000. The duration of each stream after initial screening is recorded, rounded up to the nearest minute. Streams less than one minute are set to zero, and the most frequent duration is less than 5 minutes.
6. The HTTPS network attack detection method based on traffic behavior detection according to claim 5, characterized in that, The aforementioned behavioral anomalies are then re-evaluated to determine whether any abnormal behaviors that resulted in successful scanning exist. This includes: Let the number of downlink packets in the multi-stream be x1, x2, x3...x. n ; Take the average number M and the standard deviation S of these downlink packets. If there is a downlink packet count greater than the average number plus the standard deviation multiplied by 3, the scan is considered successful.
7. An HTTPS network attack detection device based on traffic behavior detection, characterized in that, The device includes: The traffic acquisition unit is used to acquire the target HTTPS traffic to be identified. Anomaly detection unit is used to perform preliminary anomaly identification on the target HTTPS traffic using a preset abnormal traffic behavior detection mechanism to obtain behavioral anomalies; The secondary detection unit is used to compare the abnormal behavior points with the attack tool fingerprint database, detect slow attacks, and detect successful scans to obtain a summary result of abnormal behavior.
8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the method as described in any one of claims 1 to 6.
9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1 to 6.
10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1 to 6.