Method and device for processing network packet capture data

Abstract

The invention provides a network packet capture data processing method and device. The method comprises the following steps: acquiring a network packet capture file; the network capture package file comprises communication data streams of at least two communication ends; performing data extraction on the network packet capture file to obtain target data and an encrypted data packet; the target data comprises an encryption algorithm, a key exchange mechanism and certificate information; obtaining risk data according to preset weak algorithm data and the target data; obtaining interaction data according to a preset key field and the target data; and performing visual display according to the network capture package file, the target data, the encrypted data packet, the risk data and the interaction data. According to the method, the encryption and decryption algorithm and the key parameters used in the network packet capture file can be automatically detected and identified, the workload of manual inference and verification is reduced, and the processing efficiency and accuracy of the network packet capture data are improved.

Description

Technical Field

[0001] This invention relates to the field of network packet capture data technology, and also to a method and apparatus for processing network packet capture data. Background Technology

[0002] With the rapid development of information networks, network communication protocols play a core role in data transmission, identity authentication, and information encryption. Especially in fields such as finance, e-commerce, healthcare, and government, large amounts of sensitive data rely on secure protocols for reliable transmission. However, in the current network security environment, there are numerous protocols and complex communication processes. Different protocols differ significantly in encryption / decryption algorithms, key exchange mechanisms, and message structures. When network security personnel or researchers need to analyze communication processes, they typically need to use multiple tools in combination, parsing packet capture files layer by layer, and manually identifying protocol types, extracting keys, and algorithms—a tedious and error-prone process. Currently, most common packet capture analysis tools are based on low-level libraries for data display and are often limited to parsing static message structures, lacking the ability to dynamically reconstruct protocol processes or automatically identify key algorithms. Furthermore, these tools lack intuitive visualization, failing to clearly reflect the interaction logic during communication, posing significant challenges to security auditing and vulnerability detection. Summary of the Invention

[0003] The technical problem to be solved by the present invention is to provide a method and apparatus for processing network packet capture data, so as to improve the automatic identification capability of network packet capture data.

[0004] To solve the above-mentioned technical problems, the technical solution of the present invention is as follows: A first aspect of the present invention provides a method for processing network packet capture data, comprising: Obtain network packet capture files; the network packet capture files include communication data streams from at least two communication ends; Data is extracted from the network packet capture file to obtain target data and encrypted data packets; the target data includes: encryption algorithm, key exchange mechanism and certificate information; Risk data is obtained based on the preset weak algorithm data and the target data; Based on the preset key fields and the target data, the interactive data is obtained; The network packet capture file, the target data, the encrypted data packet, the risk data, and the interaction data are visualized.

[0005] Optionally, data extraction is performed on the network packet capture file to obtain target data and encrypted data packets, including: The network packet capture file is analyzed to identify its format type. Data is extracted from the network packet capture file according to the preset parsing file corresponding to the format type to obtain target data and encrypted data packets.

[0006] Optionally, the network packet capture file is processed according to a preset parsing file corresponding to the format type to extract target data and encrypted data packets, including: The network packet capture file is processed according to the preset parsing file corresponding to the specified format type to extract the raw data. The raw data is classified to obtain target data and encrypted data packets.

[0007] Optionally, risk data is obtained based on preset weak algorithm data and the target data, including: The target data is compared with the preset weak algorithm data to obtain the comparison result; Risk data is obtained based on the comparison results and the preset risk level.

[0008] Optionally, interactive data is obtained according to preset key fields and the target data, including: The target data is extracted according to preset key fields to obtain key field data; The target data is sorted according to the timestamps in the key field data to obtain ordered data; The ordered data is marked according to a preset display method to obtain interactive data.

[0009] Optionally, the ordered data is marked according to a preset display method to obtain interactive data, including: Obtain a preset display mode; the preset display mode includes communication direction color markings and display content; The ordered data is marked according to the communication direction color marking in the preset display method to obtain marked data; The marked data is filtered according to the display content in the preset display mode to obtain interactive data.

[0010] Optionally, the network packet capture file, the target data, the encrypted data packet, the risk data, and the interaction data can be visualized, including: Obtain the preset data model; The preset data model is assigned values ​​based on the network packet capture file, the target data, the encrypted data packet, the risk data, and the interaction data to obtain the assigned value model; The assignment model is visualized.

[0011] A second aspect of the present invention provides a processing apparatus for network packet capture data, comprising: The acquisition module is used to acquire network packet capture files; the network packet capture files include communication data streams from at least two communication ends; The processing module is used to extract data from the network packet capture file to obtain target data and encrypted data packets; the target data includes: encryption algorithm, key exchange mechanism and certificate information; risk data is obtained based on preset weak algorithm data and the target data; interactive data is obtained according to preset key fields and the target data; and the network packet capture file, the target data, the encrypted data packets, the risk data and the interactive data are visualized.

[0012] A third aspect of the present invention provides a computing device, comprising: a processor and a memory storing a computer program, wherein the computer program, when executed by the processor, performs the method described in the first aspect.

[0013] A fourth aspect of the present invention provides a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the method as described in the first aspect.

[0014] The above-described solution of the present invention has at least the following beneficial effects: The above-described solution of the present invention acquires a network packet capture file, which includes communication data streams from at least two communication ends. Then, it extracts data from the network packet capture file to obtain target data and encrypted data packets. The target data includes encryption algorithms, key exchange mechanisms, and certificate information. Based on preset weak algorithm data and target data, risk data is obtained. Based on preset key fields and target data, interactive data is obtained. The network packet capture file, target data, encrypted data packets, risk data, and interactive data are then visualized. This method can automatically detect and identify the encryption / decryption algorithms and key parameters used in the network packet capture file, reducing the workload of manual inference and verification, and improving the processing efficiency and accuracy of network packet capture data. Attached Figure Description

[0015] Figure 1 This is a flowchart illustrating the method for processing network packet capture data in an embodiment of the present invention; Figure 2 This is a schematic diagram of the network packet capture data processing device in an embodiment of the present invention. Detailed Implementation

[0016] Exemplary embodiments of the invention will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the invention are shown in the drawings, it should be understood that the invention may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this invention will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art.

[0017] like Figure 1 As shown, an embodiment of the present invention proposes a method for processing network packet capture data, including the following steps: Step 101: Obtain a network packet capture file; the network packet capture file includes communication data streams from at least two communication ends; Step 102: Extract data from the network packet capture file to obtain target data and encrypted data packets; the target data includes: encryption algorithm, key exchange mechanism and certificate information; Step 103: Obtain risk data based on the preset weak algorithm data and the target data; Step 104: Obtain interactive data according to the preset key fields and the target data; Step 105: Visualize the network packet capture file, the target data, the encrypted data packet, the risk data, and the interaction data.

[0018] The network packet capture data processing method of this invention involves acquiring a network packet capture file, which includes communication data streams from at least two communication ends, and then extracting data from the network packet capture file to obtain target data and encrypted data packets. The target data includes encryption algorithms, key exchange mechanisms, and certificate information. Based on preset weak algorithm data and target data, risk data is obtained. Based on preset key fields and target data, interactive data is obtained. The network packet capture file, target data, encrypted data packets, risk data, and interactive data are then visualized. This method can automatically detect and identify the encryption and decryption algorithms and key parameters used in the network packet capture file, reducing the workload of manual inference and verification, and improving the processing efficiency and accuracy of network packet capture data.

[0019] In an optional embodiment of the present invention, in step 101, a network packet capture file is obtained; the network packet capture file includes communication data streams from at least two communication ends. Here, the obtained network packet capture file may be provided by the user or actively obtained from the Internet.

[0020] In an optional embodiment of the present invention, step 102, extracting data from the network packet capture file to obtain target data and encrypted data packets, may include: Step 1021: Identify the file format of the network packet capture file to obtain the format type; Specifically, the format of network packet capture files may be PCAP (a network packet capture technology and file format standard used to record and analyze network traffic) or PCAPNG (the next-generation format of PCAP). Therefore, it is necessary to identify the file format of the network packet capture file to obtain its format type, which facilitates the subsequent extraction of target data from it using different methods based on the specific format type. In a specific embodiment, the magic number (the characteristic value of the starting byte of the file type identifier) ​​of the first 4 bytes of the network packet capture file is read first to determine the format type: if the magic number is 0xa1b2c3d4 / 0xd4c3b2a1, the corresponding format type is PCAP; if the magic number is 0x0a0d0d0a, the corresponding format type is PCAPNG. Here, the format type is either PCAP or PCAPNG. PCAP files are divided into a file header and a data packet record, both of which are stored in binary. PCAPNG uses a block-based storage structure and supports multiple interfaces, multiple timestamp precisions, and custom data.

[0021] Step 1022: Extract data from the network packet capture file according to the preset parsing file corresponding to the format type to obtain target data and encrypted data packets.

[0022] Specifically, when the format type is PCAP, read the 2-byte global file header to record the link layer type and snapshot length; read the 16-byte packet record header in a loop, and then read the binary data of the capture length bytes to obtain the link layer frame; until the end of the file, collect all link layer frame data.

[0023] When the format type is PCAPNG, read the SHB block to obtain the byte order and version information; read the IDB block to record the link layer type of the interface (subsequently match data packets by interface ID); read the EPB / SPB blocks in a loop to extract the link layer frame binary data in the blocks; ignore other irrelevant blocks (such as NRB) until the end of the file.

[0024] After parsing the link layer, the payload data of the network layer and the upper-layer protocol type identifier are obtained. Based on the protocol type identifier of the link layer, the network layer data is parsed to obtain the payload data of the transport layer and the transport layer protocol type identifier. After parsing the transport layer, the payload data and port information of the application layer are obtained. Based on port mapping, feature fields, or protocol specifications, the application layer is parsed to obtain the target data, which contains the interaction data of multiple communication ends, encrypted data, and the interaction protocols used.

[0025] In one specific embodiment, tools such as Wireshark (a network protocol analysis tool) can also be used to extract data from network packet capture files to obtain target data and encrypted data packets. The encrypted data packets contain encrypted communication data from the communicating parties. The target data varies depending on the communication method. In one specific embodiment, when the communication method is the SSH security protocol (a security protocol used for encrypted remote login), the target data includes: the IP addresses and port numbers of both communicating parties, cookies (small text files) of both communicating parties, SSH versions of both communicating parties, and key and algorithm negotiation phase data; when the communication method is the SSL (Secure Sockets Layer) security protocol, the target data... The target data includes: IP addresses and port numbers of both communicating parties, handshake protocol phase data (such as communication protocol version, client random number, cipher suite, server random number, cipher suite, cipher suite composition, authentication category, server certificate, server key exchange, client certificate, client key exchange, and client certificate verification); when the communication method is IPSec security protocol (Internet Security Protocol), the target data includes: IP addresses of both communicating parties, SPI of both communicating parties, key exchange protocol (including ISAKMP version number, encryption algorithm, cryptographic hash algorithm, authentication method, public key algorithm type, initiator certificate, responder certificate, identification information, and signature value). The above are just examples; depending on the actual situation, the target data may also include other types of data.

[0026] In an optional embodiment of the present invention, step 1022 includes: Step 10221: Extract data from the network packet capture file according to the preset parsing file corresponding to the format type to obtain the raw data; Specifically, encryption algorithms, key exchange mechanisms, and certificate information are transmitted in plaintext only during the handshake phase, and are encrypted during the application layer data transmission phase. Therefore, the target data must meet the following screening criteria: Includes a complete handshake process: at least the core messages such as Client Hello → Server Hello → Certificate → Server Key Exchange → Client Key Exchange; No session reuse: If the client and server use session reuse (such as session ID / ticket), the handshake phase will skip key exchange and certificate transmission, making it impossible to extract complete information; Packet capture location is correct: Capture packets in the client / server communication link (such as on the client's local machine or on the server's gateway) to ensure that bidirectional TLS (Transport Layer Security) handshake messages can be captured.

[0027] Extract the target data that meets the above filtering criteria and use it as the original data.

[0028] Step 10222: Classify the raw data to obtain target data and encrypted data packets.

[0029] Specifically, the handshake phase is the process by which two communicating parties (such as the client and server) negotiate encryption parameters and exchange certificates and keys. Therefore, the cipher suites (listing all cipher suites supported by the client) can be extracted from the handshake message (Server Hello) in the original data. The key exchange mechanism and symmetric encryption algorithm can then be directly extracted from these cipher suites. The certificate entries (the data format of digital certificates) extracted from the handshake message can be obtained, directly leading to the certificate chain (server certificate, intermediate certificates). If the key exchange mechanism is ECDHE (Elliptic Curve Temporary Diffie-Hellman Key Exchange) / DSA (Digital Signature Algorithm), elliptic curve parameters (such as curve type P-256) and temporary public keys can be extracted from the Server Key Exchange (a crucial step in the handshake protocol used to negotiate session keys between the client and server to ensure secure communication) message. The extracted encryption algorithms, key exchange mechanisms, and certificate information are all used as target data, and the encrypted data is an encrypted data packet.

[0030] In an optional embodiment of the present invention, step 103, obtaining risk data based on preset weak algorithm data and the target data, may include: Step 1031: Compare the target data with the preset weak algorithm data to obtain the comparison result; Specifically, the preset weak algorithm data includes various weak encryption algorithms, such as Message Digest Algorithm 5 (MD5), Rivers Cipher 4 (RC4, also known as a stream cipher), Data Encryption Standard (DES), and insecure protocol versions, such as Transport Layer Security 1.0 (TLS 1.0). A network protocol analysis tool is used to extract handshake messages from the target data, extracting the protocol version number and cipher suite. The protocol version number and cipher suite are then compared with the preset weak algorithm data to obtain the comparison result. Here, a match is considered complete when the protocol version number matches at least one insecure protocol version in the preset weak algorithm data, or when the cipher suite matches at least one weak encryption algorithm in the preset weak algorithm data; otherwise, a mismatch is considered complete.

[0031] In one specific embodiment, through Extract the protocol version number from the target data; where V is the protocol version number. The decimal value of the 6th byte of the handshake message containing the target data. The decimal value of the 7th byte of the handshake message; via The protocol matching result is obtained; where, For the matching results, 1 indicates a match with an insecure protocol, and 0 indicates a match. This is a set of insecure protocol versions in the preset weak algorithm data.

[0032] In one specific embodiment, through Obtain the plaintext name of the cipher suite for the target data; through We obtain the weak algorithm matching results; where, For the plaintext name of the cipher suite, For a predefined hash table (key = value, value = plaintext name). Let k be the cipher suite value of the target data, and k be the weak algorithm keyword. The keyword is a substring of the cipher suite name. This represents the matching result of a weak algorithm, where 1 indicates a successful match and 0 indicates a no-match. It is a collection of multiple weak encryption algorithms in the preset weak algorithm data.

[0033] Here, the comparison results include protocol matching results and weak algorithm matching results.

[0034] In addition, the comparison results may also include the name of the weak encryption algorithm (such as at least one of MD5, RC4, DES, etc.) and / or the insecure protocol version (such as TLS1.0, etc.) that match (or are hit) between the target data and the preset weak algorithm data.

[0035] Step 1032: Obtain risk data based on the comparison results and the preset risk level.

[0036] Specifically, the preset risk level can include the risk levels corresponding to weak encryption algorithms and insecure protocol versions. For example, the risk level corresponding to Message Digest Algorithm 5, Rivers Cipher 4, or the Data Encryption Standard is 1, while the risk level corresponding to Transport Layer Security 1.0 is 2. The sum of the risk levels corresponding to the weak encryption algorithms and insecure protocol versions matched in the comparison results is used as the target risk level. The risk data includes the comparison results and the target risk level. In a specific embodiment, the comparison results include: the matched weak encryption algorithms are Message Digest Algorithm 5 and Rivers Cipher 4, and the matched insecure protocol version is Transport Layer Security 1.0, then the target risk level is 1+1+2=4.

[0037] In an optional embodiment of the present invention, step 104, obtaining interactive data according to preset key fields and the target data, may include: Step 1041: Extract fields from the target data according to preset key fields to obtain key field data; Specifically, preset key fields may include: Basic identifiers: unique packet ID, capture timestamp (core, used for time sorting); Communication information: source IP, destination IP, source port, destination port; Protocol information: Protocol type (TCP / UDP / HTTP / MQTT, etc.), packet description (e.g., TCPSYN, HTTP GET request); Data information: data packet length, raw data, and parsed protocol object (for detailed display); Visual markers: Communication direction (client → server / server → client), selected status (for highlighting).

[0038] Based on the aforementioned preset key fields, key field data is extracted from the target data for subsequent display and determination of interactive data.

[0039] Step 1042: Sort the target data according to the timestamps in the key field data to obtain ordered data; Specifically, multiple data packets in the target data are sorted according to the timestamps in the key field data to obtain ordered data, so as to make the data packets ordered when determining the interaction data in the future, thereby improving the accuracy of the interaction data.

[0040] Step 1043: Mark the ordered data according to a preset display method to obtain interactive data.

[0041] In an optional embodiment of the present invention, step 1043 includes: Step 10431: Obtain a preset display mode; the preset display mode includes communication direction color markings and display content; Specifically, since network packet capture files include communication data streams from at least two communicating ends, different colors can be used to distinguish the communication direction (e.g., blue = client to server, green = server to client, gray = unknown direction). The displayed content is what needs to be shown, which may include key information such as capture time, communication direction + IP / port, protocol type, packet description, and length.

[0042] Step 10432: Mark the ordered data according to the communication direction color marking in the preset display mode to obtain marked data; Specifically, different communication directions are color-coded according to the preset display method to obtain coded data, which can improve the intuitiveness of subsequent interactive data display.

[0043] Step 10433: Filter the marked data according to the display content in the preset display mode to obtain interactive data.

[0044] Specifically, the tagged data is filtered according to the display content in the preset display mode, and data that matches the display content is retained as interactive data. In subsequent visualizations and reports, only data that matches the display content is displayed, thus improving the accuracy of the interactive data. Interactive data may include encrypted data packets.

[0045] In an optional embodiment of the present invention, step 105, visualizing the network packet capture file, the target data, the encrypted data packet, the risk data, and the interaction data, may include: Step 1051: Obtain the preset data model; Specifically, the preset data model can be a model class file in a visualization tool (such as TimedPacketModel.cs).

[0046] Step 1052: Assign values ​​to the preset data model based on the network packet capture file, the target data, the encrypted data packet, the risk data, and the interaction data to obtain the assignment model; Specifically, following the steps in step 1051 for extracting fields from the target data, key field data is extracted from the network packet capture file, the target data, risk data, and interaction data according to preset key fields. The extracted key field data is then assigned to the attributes of the preset data model along with the encrypted data packet to obtain the assignment model.

[0047] Step 1053: Visualize the value assignment model.

[0048] Specifically, all assigned models are placed into a list collection, sorted in ascending order by capture timestamp (ensuring chronological order from top to bottom). The model list is saved as a global variable for visualization. In the visualization interface, the sorted assigned model list is traversed, and the drawing area (rectangle) for each data packet item is calculated from top to bottom. Background (highlighted when selected), text (key information), and direction indicators (such as arrows) are drawn according to the drawing rules. If the number of assigned models exceeds the height of the visualization area, drawing stops (the Y-coordinate is recalculated while scrolling). Risk data can be marked with preset risk colors to improve intuitiveness.

[0049] In an optional embodiment of the present invention, the method further includes step 106, obtaining a network packet capture data report based on the network packet capture file, the target data, the encrypted data packet, the risk data, and the interaction data; In an optional embodiment of the present invention, step 106, obtaining a network packet capture data report based on the network packet capture file, the target data, the encrypted data packet, the risk data, and the interaction data, may include: Step 1061: Obtain the preset report template and preset report format; Specifically, preset report templates can be set according to user needs or historical experience, making it easier to directly fill in the preset report templates later and improving the efficiency of report generation; the preset report format can be determined according to user needs, and the preset report format can be multiple formats such as PDF, HTML, DOCX, etc., to meet the needs of users in different scenarios such as archiving, auditing, and security assessment.

[0050] Step 1062: Fill the preset report template with the network packet capture file, the target data, the encrypted data packet, the risk data, and the interaction data to obtain the original report; Specifically, according to the data required in the preset report template, the network packet capture file, target data, encrypted data packet, risk data, and interaction data are filled into the preset report template one by one to quickly and accurately generate the original report. In a specific embodiment, the original report may include the name, number, and acquisition time of the network packet capture file, as well as the encryption algorithm, key exchange mechanism, and certificate information in the target data, the risk level in the risk data, and all data in the interaction data.

[0051] Step 1063: Convert the original report according to the preset report format to obtain a network packet capture data report.

[0052] Specifically, the original report is converted according to the preset report format to obtain a network packet capture data report that meets the user's requirements. This helps to improve user experience and satisfaction, and meets the needs of users in different scenarios such as archiving, auditing, and security assessment.

[0053] A specific embodiment of the network packet capture data processing method of the present invention includes: Step 111: Obtain the network packet capture file; the network packet capture file includes communication data streams from at least two communication ends; Receive network packet capture files provided by users or obtained from the network. The network packet capture files include communication data streams (a series of data transmitted or processed continuously in chronological order) between at least two communication ends. The data streams in the network packet capture files can be binary or hexadecimal data.

[0054] Step 112: Extract data from the network packet capture file to obtain target data and encrypted data packets; the target data includes: encryption algorithm, key exchange mechanism and certificate information; It parses the captured network packets to obtain target data and encrypted data packets, supports common formats (such as PCAP, PCAPNG, etc.), can automatically identify network protocols at different levels, complete data stream reconstruction and session restoration, and has the ability to detect and tolerate abnormal data packets, providing an accurate and reliable data foundation for subsequent protocol identification and security analysis.

[0055] Step 113: Obtain risk data based on the preset weak algorithm data and the target data; Based on the preset weak algorithm data, weak encryption algorithms (such as MD5, RC4, DES, etc.) and insecure protocol versions (such as TLS1.0, etc.) used in the communication process of the target data are identified and displayed in bold red font in the visualization. When generating the report, the corresponding risk warnings are output and a list of potential security vulnerabilities is generated to provide users with targeted security improvement references.

[0056] Step 114: Obtain interactive data according to the preset key fields and the target data; It visualizes communication sessions in target data, visually displaying the protocol interaction process in the form of a session tree. It also supports packet-by-packet viewing, browsing in ASN.1 digital certificate mode, and viewing raw data, helping users quickly understand and locate key steps in the communication process.

[0057] Step 115: Visualize the network packet capture file, the target data, the encrypted data packet, the risk data, and the interaction data. Based on the actual situation, network packet capture files, target data, encrypted data packets, risk data, and interactive data are displayed on the interface for visual presentation. Risk data can be marked with preset risk colors to improve intuitiveness.

[0058] Step 116: Obtain a network packet capture data report based on the network packet capture file, the target data, the encrypted data packet, the risk data, and the interaction data.

[0059] It structures and organizes network packet capture files, target data, encrypted data packets, risk data, and interaction data, automatically generating a comprehensive analysis report that includes communication process, protocol usage, encryption algorithms, and potential risks. It also supports exporting to multiple formats such as PDF, HTML, and DOCX to meet the needs of different scenarios such as archiving, auditing, and security assessment.

[0060] In another specific embodiment, the network packet capture file to be analyzed and detected is selected through a user interface; the data structure and content of the network packet capture file are analyzed to extract key information such as protocols, handshake processes, digital certificates, and encrypted data packets; after identifying the algorithm and handshake interaction process, the communication algorithm, key, and parameters are identified and extracted, and the extracted key algorithm / protocol version data is identified and marked; based on the graphical interactive operation environment provided by .NET, the complete interaction process of the data packets is displayed in chronological order from top to bottom; a comprehensive analysis report containing the communication process, protocol usage, encryption algorithms, and potential risks is generated, and it supports exporting to multiple formats such as PDF, HTML, and DOCX.

[0061] The network packet capture data processing method of this invention can parse various transmission protocols, algorithms, keys, and parameters. It can automatically model and reconstruct the complete communication process from the packet capture data, no longer limited to the static display of a single message, significantly improving the understandability of protocol interaction logic. It can automatically detect and identify the encryption / decryption algorithms and key parameters used in the protocol, reducing the workload of manual inference and verification, and improving analysis efficiency and accuracy. Integrating packet capture parsing, protocol analysis, algorithm identification, and result display, it avoids the cumbersome process of requiring multiple tools in traditional technologies, achieving an efficient and unified analysis environment. Utilizing the visualization capabilities of the .NET platform, the communication process, protocol structure, and encryption / decryption information are displayed in a graphical interface, intuitively reflecting timing relationships and security attributes, lowering the analysis threshold for security personnel. Based on the .NET technology framework, this invention is not only applicable to the Windows environment but can also be extended to other platforms, facilitating subsequent function upgrades and protocol expansion.

[0062] The network packet capture data processing method of this invention, through means such as wider protocol parsing range, automatic reconstruction of communication process, encryption algorithm and key identification, integrated analysis platform, intuitive visualization effect, and strong cross-platform and scalability, brings about a significant improvement in analysis speed and accuracy, intuitiveness and scalability, and optimization of user experience, helping to automate, intuitively and efficiently analyze network security protocols.

[0063] like Figure 2 As shown, an embodiment of the present invention provides a network packet capture data processing device 200, comprising: The acquisition module 201 is used to acquire network packet capture files; the network packet capture files include communication data streams from at least two communication ends; The processing module 202 is used to extract data from the network packet capture file to obtain target data and encrypted data packets; the target data includes: encryption algorithm, key exchange mechanism and certificate information; risk data is obtained according to preset weak algorithm data and the target data; interactive data is obtained according to preset key fields and the target data; and the network packet capture file, the target data, the encrypted data packets, the risk data and the interactive data are visualized.

[0064] Optionally, data extraction is performed on the network packet capture file to obtain target data and encrypted data packets, including: The network packet capture file is analyzed to identify its format type. Data is extracted from the network packet capture file according to the preset parsing file corresponding to the format type to obtain target data and encrypted data packets.

[0065] Optionally, the network packet capture file is processed according to a preset parsing file corresponding to the format type to extract target data and encrypted data packets, including: The network packet capture file is processed according to the preset parsing file corresponding to the specified format type to extract the raw data. The raw data is classified to obtain target data and encrypted data packets.

[0066] Optionally, risk data is obtained based on preset weak algorithm data and the target data, including: The target data is compared with the preset weak algorithm data to obtain the comparison result; Risk data is obtained based on the comparison results and the preset risk level.

[0067] Optionally, interactive data is obtained according to preset key fields and the target data, including: The target data is extracted according to preset key fields to obtain key field data; The target data is sorted according to the timestamps in the key field data to obtain ordered data; The ordered data is marked according to a preset display method to obtain interactive data.

[0068] Optionally, the ordered data is marked according to a preset display method to obtain interactive data, including: Obtain a preset display mode; the preset display mode includes communication direction color markings and display content; The ordered data is marked according to the communication direction color marking in the preset display method to obtain marked data; The marked data is filtered according to the display content in the preset display mode to obtain interactive data.

[0069] Optionally, the network packet capture file, the target data, the encrypted data packet, the risk data, and the interaction data can be visualized, including: Obtain the preset data model; The preset data model is assigned values ​​based on the network packet capture file, the target data, the encrypted data packet, the risk data, and the interaction data to obtain the assigned value model; The assignment model is visualized.

[0070] Optionally, a network packet capture data report is obtained based on the network packet capture file, the target data, the encrypted data packet, the risk data, and the interaction data, including: Get the preset report template and preset report format; The original report is obtained by filling the preset report template with the network packet capture file, the target data, the encrypted data packet, the risk data, and the interaction data; The original report is converted according to the preset report format to obtain a network packet capture data report.

[0071] The network packet capture data processing device of this invention acquires a network packet capture file, which includes communication data streams from at least two communication ends. It then extracts data from the network packet capture file to obtain target data and encrypted data packets. The target data includes encryption algorithms, key exchange mechanisms, and certificate information. Based on preset weak algorithm data and target data, risk data is obtained. Interaction data is obtained according to preset key fields and target data. The device visualizes the network packet capture file, target data, encrypted data packets, risk data, and interaction data. It can automatically detect and identify the encryption / decryption algorithms and key parameters used in the network packet capture file, reducing the workload of manual inference and verification, and improving the processing efficiency and accuracy of network packet capture data.

[0072] It should be noted that this device corresponds to the method described above, and all implementations in the method embodiments described above are applicable to the embodiments of this device and can achieve the same technical effect. Further details are omitted in this embodiment.

[0073] This invention also provides a computing device, including: a processor and a memory storing a computer program, wherein the computer program, when executed by the processor, performs the method as described in any of the above embodiments. All implementations in the above method embodiments are applicable to the embodiments of this device and can achieve the same technical effects. Further details are omitted in this embodiment.

[0074] This invention also provides a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the method as described in any of the above embodiments. All implementations in the above method embodiments are applicable to the embodiments of this device and can achieve the same technical effects. Further details are omitted in this embodiment.

[0075] It should be noted that in the apparatus and method of the present invention, the components or steps can obviously be decomposed and / or recombined. These decompositions and / or recombinations should be considered equivalent solutions of the present invention. Furthermore, the steps for performing the above series of processes can naturally be performed in the order described and in chronological order, but are not necessarily required to be performed in chronological order. Some steps can be performed in parallel, overlapping, or independently of each other.

[0076] It should be noted that in the above embodiments, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments described above is not limited to performing functions in the order shown or discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0077] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for processing network packet data, the method comprising: The method comprises the following steps: obtaining a network packet capture file; the network packet capture file comprises communication data streams of at least two communication terminals; performing data extraction on the network packet capture file to obtain target data and encrypted data packets; the target data comprises an encryption algorithm, a key exchange mechanism and certificate information; obtaining risk data according to preset weak algorithm data and the target data; obtaining interaction data according to a preset key field and the target data; performing visual display according to the network packet capture file, the target data, the encrypted data packets, the risk data and the interaction data.

2. The network packet data processing method of claim 1, wherein, performing data extraction on the network packet capture file to obtain target data and encrypted data packets, comprising: performing file format identification on the network packet capture file to obtain a format type; performing data extraction on the network packet capture file according to a preset analysis file corresponding to the format type to obtain target data and encrypted data packets.

3. The network packet data processing method of claim 2, wherein, performing data extraction on the network packet capture file according to a preset analysis file corresponding to the format type to obtain target data and encrypted data packets, comprising: performing data extraction on the network packet capture file according to a preset analysis file corresponding to the format type to obtain original data; performing classification on the original data to obtain target data and encrypted data packets.

4. The network packet data processing method of claim 1, wherein, obtaining risk data according to preset weak algorithm data and the target data, comprising: comparing the target data with the preset weak algorithm data to obtain a comparison result; obtaining risk data according to the comparison result and a preset risk level.

5. The method of claim 1, wherein, obtaining interaction data according to a preset key field and the target data, comprising: performing field extraction on the target data according to a preset key field to obtain key field data; performing sorting on the target data according to a time stamp in the key field data to obtain ordered data; performing marking processing on the ordered data according to a preset display mode to obtain interaction data.

6. The network packet data processing method of claim 5, wherein, performing marking processing on the ordered data according to a preset display mode to obtain interaction data, comprising: obtaining a preset display mode; the preset display mode comprises a communication direction color mark and display content; performing marking processing on the ordered data according to the communication direction color mark in the preset display mode to obtain marked data; performing filtering on the marked data according to the display content in the preset display mode to obtain interaction data.

7. The method of claim 1, wherein, performing visual display according to the network packet capture file, the target data, the encrypted data packets, the risk data and the interaction data, comprising: obtaining a preset data model; performing assignment on the preset data model according to the network packet capture file, the target data, the encrypted data packets, the risk data and the interaction data to obtain an assigned model; performing visual display according to the assigned model.

8. A network packet data processing apparatus, characterized by comprising: The method comprises the following steps: an obtaining module is configured to obtain a network packet capture file; the network packet capture file comprises communication data streams of at least two communication terminals; a processing module is configured to perform data extraction on the network packet capture file to obtain target data and encrypted data packets; The target data includes: an encryption algorithm, a key exchange mechanism and certificate information; risk data is obtained according to preset weak algorithm data and the target data; interaction data is obtained according to a preset key field and the target data; and visual display is performed according to the network packet capture file, the target data, the encrypted data packet, the risk data and the interaction data.

9. A computing device, comprising: Comprising: A processor, a memory having a computer program stored therein, the computer program being executed by the processor to perform the method of any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, An instruction stored in a computer, when the instruction is executed on the computer, the computer executes the method of any one of claims 1 to 7.

Images