A method and device for detecting cross-border behavior of encrypted VPN violations

Abstract

The application discloses a kind of detection method and device of encrypted VPN illegal cross-border behavior, belong to cross-border traffic detection field.The method includes: to target traffic is full quantity mirror image processing, obtain traffic mirror image data;From traffic mirror image data, identify the first data packet carrying payload, extract first packet characteristic parameter;All data packets in traffic mirror image data are sequentially reorganized, and session interaction characteristic parameter is extracted;From historical network session log data, filter log record, carry out aggregation analysis to log record, and construct feature model baseline;To current TCP session, check whether it meets preset effective session condition;After checking, if first packet characteristic abnormal condition, session interaction abnormal condition and cross-border regional port abnormal condition are all established, then it is judged as encrypted VPN illegal cross-border behavior.The application is based on traffic mirror image data and carries out real-time online detection, and can realize the real-time identification of encrypted VPN illegal cross-border behavior.

Description

Technical Field

[0001] This invention belongs to the field of cross-border traffic detection, and in particular relates to a method and apparatus for detecting illegal cross-border activities of encrypted VPNs. Background Technology

[0002] While encrypted Virtual Private Network (VPN) technology ensures data security, it also makes it difficult to effectively monitor unauthorized cross-border access. How to accurately identify unauthorized cross-border access via encrypted VPNs from massive amounts of network traffic has become a pressing technical challenge in the field of cybersecurity.

[0003] To address the aforementioned issues, current efforts are being made to introduce machine learning techniques to improve recognition capabilities. For example, existing technology discloses a VPN traffic identification scheme based on multi-model fusion. This method concatenates the traffic feature vector from the Pcap file with the geographic feature vector, uses a random forest model and an LSTM network model respectively to predict traffic categories, and then concatenates the prediction results of the two models before inputting them into a meta-model to obtain the final VPN traffic identification result. While this technology incorporates the idea of ​​multi-model fusion and improves the identification accuracy to some extent, it still has the following limitations:

[0004] (1) This method relies on a complete Pcap file as input and requires waiting for the session to end or the file to be collected before feature extraction and recognition can be performed, thus failing to achieve real-time online detection of network traffic;

[0005] (2) This method only makes judgments based on the static statistical characteristics and geographical attributes of a single session, resulting in limited ability to characterize the behavior of encrypted VPN traffic;

[0006] (3) This method only makes independent judgments on the current session, and the accuracy and robustness of the recognition results need to be further improved. Summary of the Invention

[0007] The purpose of this invention is to overcome the shortcomings of the prior art and provide a method and device for detecting illegal cross-border activities of encrypted VPNs. Based on traffic mirroring data, it performs real-time online detection without waiting for the end of the complete session, and can realize real-time identification of illegal cross-border activities of encrypted VPNs.

[0008] This invention is achieved through the following technical solution:

[0009] The first aspect of this invention discloses a method for detecting unauthorized cross-border activities via encrypted VPNs, comprising:

[0010] Perform full mirroring of the target traffic to obtain traffic mirroring data;

[0011] Identify the first data packet carrying a payload sent by the client after the TCP session completes the three-way handshake from the traffic mirroring data, and extract the first packet feature parameters of the data packet. The first packet feature parameters include quantitative indicators reflecting the characteristics of encrypted traffic based on the statistics of the payload content.

[0012] Based on the TCP sequence number, all data packets belonging to the same TCP session in the traffic mirror data are reassembled in an orderly manner to obtain a complete session data stream. Session interaction feature parameters are extracted from the complete session data stream. The session interaction feature parameters include quantitative indicators that reflect the asymmetry of data volume between the server and the client.

[0013] Historical network session log data is obtained, and log records that meet preset valid session conditions are filtered from the historical network session log data. The filtered log records are aggregated and analyzed to construct a feature model baseline for identifying encrypted VPN cross-border behavior. The feature model baseline includes first packet feature threshold, session interaction feature threshold, and regional port constraints.

[0014] For the current TCP session, verify whether it meets the preset valid session conditions;

[0015] After the verification is successful, the following matching steps are performed: the first packet feature parameters are compared with the first packet feature threshold to determine whether the first packet feature abnormality condition is met; the session interaction feature parameters are compared with the session interaction feature threshold to determine whether the session interaction abnormality condition is met; the client region, server region, and service port obtained from the current TCP session are compared with the region and port constraints to determine whether the cross-border region and port abnormality condition is met.

[0016] If the first packet feature anomaly, the session interaction anomaly, and the cross-border regional port anomaly are all met, it is determined to be an illegal cross-border activity by the encrypted VPN, and the detection result is output.

[0017] Furthermore, the first packet feature parameters include the average number of bits per byte, the number of consecutive visible characters at the beginning of the payload, the percentage of visible characters, the longest consecutive visible character count, the payload entropy value, the payload length, and the session protocol.

[0018] Furthermore, the first packet feature parameters include the average number of bits per byte, the number of consecutive visible characters at the beginning of the payload, the proportion of visible characters to the total payload bytes, the number of consecutive longest visible characters in the payload, the payload entropy value, the payload length, and the session protocol.

[0019] Furthermore, the first packet feature thresholds include: the average number of bits per byte is greater than or equal to 3.4 and less than or equal to 4.6, the load entropy value is greater than or equal to 5, the proportion of visible characters is less than 0.5, and the longest consecutive visible character count is less than 20.

[0020] Furthermore, the geographical port constraints include: the client region is within the territory, the server region is outside the territory, and the service port is not a preset normal protocol port. The preset normal protocol ports include 80, 443, 853, and the hundreds offset port of port 443.

[0021] Furthermore, the session interaction characteristic threshold includes: within a preset time window, after grouping by client IP, server IP and server port, the number of sessions in the same group is greater than 10, the total payload bytes are greater than 1MB, and the proportion of the payload bytes sent by the server to the total payload bytes is greater than 80%.

[0022] Furthermore, the preset valid session conditions include: the event mask is a normal event, and the TCP connection state satisfies the condition that the full handshake is completed and there is no abnormal interruption; wherein, an event mask of 0 indicates a normal event, and the result of a bitwise AND operation between the TCP connection state and 0xe is 0xe, indicating that the full handshake is completed and there is no abnormal interruption.

[0023] Furthermore, based on the TCP sequence number, all data packets belonging to the same TCP session in the traffic mirror data are reassembled in an ordered manner to obtain a complete session data stream, including:

[0024] Using the source IP address, destination IP address, source port, destination port, and protocol type as unique session identifiers, all data packets belonging to the same TCP session are filtered out.

[0025] Based on the sequence number and acknowledgment number of the TCP packet, the packets are sorted according to the order in which they were sent.

[0026] The sequence number continuity is used to determine whether there are missing messages. The detected missing messages are marked through a timeout retransmission mechanism to form a complete session data stream.

[0027] A second aspect of the present invention discloses a device for detecting cross-border unauthorized activities via encrypted VPNs, comprising:

[0028] The traffic mirroring module is used to perform full mirroring of the target traffic to obtain traffic mirroring data;

[0029] The first packet feature extraction module is used to identify the first data packet carrying the payload sent by the client after the TCP session completes the three-way handshake from the traffic mirror data, and to extract the first packet feature parameters of the data packet. The first packet feature parameters include quantitative indicators reflecting the characteristics of encrypted traffic based on the payload content statistics.

[0030] The session reassembly module is used to reassemble all data packets belonging to the same TCP session in the traffic mirror data in an orderly manner based on the TCP sequence number to obtain a complete session data stream, and to extract session interaction feature parameters from the complete session data stream. The session interaction feature parameters include quantitative indicators that reflect the asymmetry of data volume between the server and the client.

[0031] The historical log analysis and modeling module is used to acquire historical network session log data, filter log records that meet preset valid session conditions from the historical network session log data, perform aggregate analysis on the filtered log records, and construct a feature model baseline for identifying encrypted VPN cross-border behavior; the feature model baseline includes first packet feature threshold, session interaction feature threshold, and regional port constraints.

[0032] The session verification module is used to verify whether the current TCP session meets the preset valid session conditions;

[0033] The comprehensive verification module performs the following matching steps after successful verification: It compares the first packet feature parameters with the first packet feature threshold to determine if the first packet feature anomaly condition is met; it compares the session interaction feature parameters with the session interaction feature threshold to determine if the session interaction anomaly condition is met; it compares the client region, server region, and service port obtained from the current TCP session with the region and port constraints to determine if the cross-border region and port anomaly condition is met; if the first packet feature anomaly condition, session interaction anomaly condition, and cross-border region and port anomaly condition are all met, it is determined to be an illegal cross-border activity by the encrypted VPN, and the detection result is output.

[0034] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0035] (1) This invention performs real-time online detection based on traffic mirroring data, without waiting for the complete session to end, and can realize real-time identification of illegal cross-border behavior of encrypted VPNs, meeting the requirements of network security management for immediacy;

[0036] (2) By deeply analyzing the multi-dimensional quantitative characteristics of the first packet of a TCP session (such as bit distribution density, visible character characteristics, load entropy value, etc.), this invention can accurately characterize the essential attributes of encrypted traffic, effectively distinguish between encrypted VPN protocols and normal application protocols, and overcome the limitations of traditional DPI relying on fixed feature signatures.

[0037] (3) By orderly reassembling discrete data packets of the same TCP session, this invention extracts the interactive behavior characteristics of the entire life cycle of the session (such as the asymmetry of data volume between the server and the client), which can accurately capture the typical pattern of the server pushing a large amount of data to the client in the encrypted VPN cross-border session, and provides session-level behavioral evidence for detection.

[0038] (4) By constructing a feature model baseline based on historical network session logs, this invention jointly models the first packet feature threshold, session interaction feature threshold, and regional port constraints to achieve multi-dimensional comprehensive verification of historical behavior patterns and real-time sessions, thereby improving the accuracy and robustness of detection. Attached Figure Description

[0039] The accompanying drawings, which are included to provide a further understanding of embodiments of the invention and form part of this application, do not constitute a limitation thereof. In the drawings:

[0040] Figure 1 This is a flowchart of one detection method in the present invention;

[0041] Figure 2 This is a flowchart illustrating the extraction of first-package feature parameters according to the present invention.

[0042] Figure 3 This is a flowchart illustrating the construction of a feature model baseline and matching verification in this invention;

[0043] Figure 4 This is a block diagram of one component of the detection device in this invention. Detailed Implementation

[0044] The technical solution of the present invention will be further described below with reference to the accompanying drawings and specific embodiments.

[0045] The accompanying drawings are for illustrative purposes only and are schematic diagrams, not actual pictures. They should not be construed as limiting the invention. To better illustrate the embodiments of the invention, some parts in the drawings may be omitted, enlarged, or reduced, and do not represent the actual product dimensions. It is understandable to those skilled in the art that some well-known structures and their descriptions may be omitted in the drawings.

[0046] In the accompanying drawings of the embodiments of the present invention, the same or similar reference numerals correspond to the same or similar components. In the description of the present invention, it should be understood that if terms such as "upper," "lower," "left," "right," "inner," and "outer" indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings, they are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, the terms used to describe positional relationships in the accompanying drawings are only for illustrative purposes and should not be construed as limiting the present invention. For those skilled in the art, the specific meaning of the above terms can be understood according to the specific circumstances.

[0047] In the description of this invention, unless otherwise explicitly specified and limited, the term "connection" or similar designation indicating a connection between components should be interpreted broadly. For example, it can refer to a fixed connection, a detachable connection, or an integral part; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium; it can refer to the internal communication between two components or the interaction between two components. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0048] like Figures 1 to 4 As shown in the figure, this embodiment discloses a method and apparatus for detecting illegal cross-border activities of encrypted VPNs.

[0049] The first aspect of this embodiment discloses a method for detecting illegal cross-border activities via encrypted VPNs, such as... Figure 1 As shown, the detection method includes steps S100 to S600.

[0050] Step S100. Perform full mirroring on the target traffic to obtain traffic mirroring data.

[0051] In this step, a full mirror of the traffic accessing the target network is performed using a traffic acquisition device. The original network data packets are completely copied and output to the detection system as input data for subsequent analysis. This traffic mirror data includes information on all network sessions that passed through, ensuring no omissions.

[0052] Step S200. Identify the first data packet carrying a payload sent by the client after the TCP session completes the three-way handshake from the traffic mirroring data, and extract the first packet feature parameters of the data packet. The first packet feature parameters include quantitative indicators reflecting the characteristics of encrypted traffic based on the statistics of the payload content.

[0053] In this step, based on the TCP three-way handshake mechanism, the first data packet carrying a valid payload sent by the client to the server after completing the "SYN-SYN+ACK-ACK" handshake is identified and filtered (i.e., excluding handshake packets and empty payload packets). This data packet is the initial data carrier for network session interaction, and its characteristics can directly reflect the interaction attributes of the session (normal protocol interaction or encrypted interaction). Then, a preset feature extraction algorithm is used to calculate the multi-dimensional parameters of the filtered first packet payload, and the calculated multi-dimensional parameters are recorded as the first packet feature parameters.

[0054] In some embodiments of this example, the first packet feature parameters include the average number of bits per byte, the number of consecutive visible characters at the beginning of the payload, the proportion of visible characters to the total payload bytes, the longest consecutive visible character in the payload, the payload entropy value, the payload length, and the session protocol.

[0055] like Figure 2 As shown, in this step, the first packet feature parameters are extracted from aspects such as byte-level features, visible character-related features, load entropy value, and basic attributes.

[0056] The method for extracting byte-level features is as follows: by parsing the payload data byte by byte, counting the number of 1 bits in each byte, and calculating the average of all bytes, denoted as the average number of 1 bits per byte (popcount_per_byte). This feature reflects the binary distribution density of the payload data; encrypted data typically has a more uniform 1-bit distribution due to its encoding characteristics.

[0057] The method for extracting visible character-related features is as follows: Based on the ASCII code table (0-127), identify bytes in the payload that belong to visible characters (32-126), and count the number of consecutive visible characters at the beginning of the payload (first_ascii_count), the proportion of visible characters to the total payload bytes (ascii_ratio), and the longest consecutive visible character count in the payload (continuous_ascii_count). Normal protocols (such as HTTP) typically contain a large number of visible characters in the first packet payload (such as request lines and header fields), while encrypted VPN traffic, due to encryption processing, has a very low proportion of visible characters and a short consecutive length in the first packet payload.

[0058] The method for extracting the load entropy is as follows: The entropy of the first packet load is calculated based on the information theory entropy formula, where H = -Σp(i)log2p(i), and p(i) is the probability of the i-th byte appearing in the load. Entropy reflects the degree of disorder in the data; encrypted data, due to the scrambling effect of the encryption algorithm, has an entropy close to the theoretical maximum value, which is 8; while normal protocol data, due to its fixed format (such as protocol headers and field identifiers), has a relatively low entropy.

[0059] The basic attribute extraction method is to directly extract the length of the first packet payload (first_payload_len) and the session protocol (protocol, such as TCP or UDP). The payload length reflects the scale of the initial interaction data. The first packet payload length of different normal protocols usually has a fixed range, while the first packet payload length of encrypted VPNs is often random.

[0060] Step S300. Based on the TCP sequence number, all data packets belonging to the same TCP session in the traffic mirror data are reassembled in an orderly manner to obtain a complete session data stream, and session interaction feature parameters are extracted from the complete session data stream. The session interaction feature parameters include quantitative indicators that reflect the asymmetry of data volume between the server and the client.

[0061] In this step, based on the connection-oriented nature of the TCP protocol, key information such as source IP, destination IP, source port, destination port, sequence number, and acknowledgment number in the packet header is used to reassemble all discrete data packets belonging to the same TCP session in an orderly manner, restore the complete session interaction process, and then extract session-level metadata information, which is recorded as session interaction feature parameters.

[0062] In some embodiments of this example, all data packets belonging to the same TCP session in the traffic mirror data are reassembled in an orderly manner to obtain a complete session data stream, and session interaction feature parameters are extracted from the complete session data stream, including steps S310 to S330.

[0063] Step S310. Using “source IP + destination IP + source port + destination port + protocol type” as a unique session identifier, filter out all TCP packets belonging to the same identifier from the mirrored traffic.

[0064] Step S320. Based on the sequence number and acknowledgment number of the TCP packets, sort them according to the order in which the packets were sent, use the timeout retransmission mechanism to identify and mark potentially lost packet segments, and complete the potentially lost packet segments to form a complete session data stream.

[0065] Step S330. Extract core metadata for the entire session lifecycle from the reassembled session data stream, including session duration (the time difference between the first handshake message and the last FIN / RST message), total payload size sent by the client to the server, total payload size sent by the server to the client, and frequency of interactions between the client and server. This metadata reflects the interaction strength and data flow characteristics of the session. Encrypted VPN cross-border sessions typically involve the server pushing a large amount of data to the client (e.g., the server sending a very high percentage of payload), therefore, special attention should be paid to the proportion of the server-sent payload bytes to the total payload bytes.

[0066] In some implementations of this embodiment, the session interaction characteristic parameters include session duration, total payload sent by the client to the server, total payload sent by the server to the client, and frequency of interaction between the client and the server.

[0067] Step S400. Obtain historical network session log data, filter log records that meet preset valid session conditions from the historical network session log data, perform aggregate analysis on the filtered log records, and construct a feature model baseline for identifying encrypted VPN cross-border behavior; the feature model baseline includes first packet feature threshold, session interaction feature threshold, and regional port constraints.

[0068] In this step, based on preset filtering rules and statistical aggregation logic, a structured analysis of historical network session logs is performed to build a baseline feature model of encrypted VPN cross-border behavior.

[0069] like Figure 3As shown, the filtering method for historical network session logs is as follows: Full TCP session log data (corresponding to the data table netlink_2.tcp_flow_log_1s) within a specified historical period (e.g., 3 months) is collected and stored. The collection scope is limited to logs that meet the basic valid session conditions, namely, valid TCP sessions with a clear session start time, an event mask of 0 (normal event), and a TCP connection state that satisfies the requirement of a full handshake and no abnormal interruption (the bitwise AND operation between tcp_acc_status and 0xe results in 0xe). The log storage content includes session start time (flow_start_time), client IP (client_ip), server IP (server_ip), server port (server_port), first packet characteristic parameters (such as popcount_per_byte, entropy, ascii_ratio, etc.), total session payload bytes (total_payload_byte), server-sent payload bytes (server_payload_byte), client country ID (client_country_id), and server country ID (server_country_id).

[0070] In some embodiments of this example, the first packet feature thresholds include: the average number of bits 1 per byte is greater than or equal to 3.4 and less than or equal to 4.6, the load entropy value is greater than or equal to 5, the proportion of visible characters is less than 0.5, and the longest consecutive visible character count is less than 20.

[0071] In some implementations of this embodiment, the geographical port constraint conditions include: the client region is within the territory, the server region is outside the territory, and the service port does not belong to the preset normal protocol port. The preset normal protocol ports include 80, 443, 853 and the hundreds digit offset port of port 443 (e.g., 10443, 8443, etc.).

[0072] In some embodiments of this example, the session interaction characteristic threshold includes: within a preset time window (such as the most recent 5 minutes or a dynamic window set according to historical data distribution), after grouping by client IP, server IP, and server port, the number of sessions in the same group is greater than 10, the total payload bytes are greater than 1MB, and the proportion of payload bytes sent by the server to the total payload bytes is greater than 80%. The value of this preset time window can be adjusted according to network traffic characteristics to ensure the stability and real-time nature of the statistical results.

[0073] Step S500. For the current TCP session, verify whether it meets the preset valid session conditions.

[0074] In some implementations of this embodiment, the preset valid session conditions include: the event mask is a normal event, and the TCP connection state satisfies the condition of a full handshake completed without abnormal interruption. Specifically, an event mask of 0 indicates a normal event, and a bitwise AND operation between the TCP connection state and 0xe results in 0xe, indicating a full handshake completed without abnormal interruption. If the verification fails, the current session will not be included in the subsequent anomaly detection process.

[0075] Step S600. After the verification is passed, perform the following matching steps: compare the first packet feature parameters of the current TCP session with the first packet feature threshold to determine whether the first packet feature abnormality condition is met; compare the session interaction feature parameters of the current TCP session with the session interaction feature threshold to determine whether the session interaction abnormality condition is met; compare the client region, server region, and service port obtained from the current TCP session with the region and port constraints to determine whether the cross-border region and port abnormality condition is met.

[0076] If the first packet feature anomaly condition, the session interaction anomaly condition, and the cross-border regional port anomaly condition are all met, it is determined to be an illegal cross-border activity by the encrypted VPN, and the detection result is output. The second aspect of this embodiment discloses a detection device for illegal cross-border activities by an encrypted VPN, such as... Figure 4 As shown, the detection device includes a traffic mirroring module, a first packet feature extraction module, a session reconstruction module, a historical log analysis and modeling module, a session verification module, and a comprehensive verification module.

[0077] The traffic mirroring module is used to perform full mirroring of the target traffic to obtain traffic mirroring data.

[0078] The first packet feature extraction module is used to identify the first data packet carrying the payload sent by the client after the TCP session completes the three-way handshake from the traffic mirroring data, and to extract the first packet feature parameters of the data packet. The first packet feature parameters include quantitative indicators reflecting the characteristics of encrypted traffic based on the payload content statistics.

[0079] The session reassembly module is used to reassemble all data packets belonging to the same TCP session in the traffic mirror data in an orderly manner based on the TCP sequence number to obtain a complete session data stream, and to extract session interaction feature parameters from the complete session data stream. The session interaction feature parameters include quantitative indicators that reflect the asymmetry of data volume between the server and the client.

[0080] The historical log analysis and modeling module is used to acquire historical network session log data, filter log records that meet preset valid session conditions from the historical network session log data, perform aggregate analysis on the filtered log records, and construct a feature model baseline for identifying encrypted VPN cross-border behavior; the feature model baseline includes first packet feature threshold, session interaction feature threshold, and regional port constraints.

[0081] The session verification module is used to verify whether the current TCP session meets the preset valid session conditions.

[0082] The comprehensive verification module is used to perform the following matching steps after the verification is passed: compare the first packet feature parameters with the first packet feature threshold to determine whether the first packet feature abnormality condition is met; compare the session interaction feature parameters with the session interaction feature threshold to determine whether the session interaction abnormality condition is met; compare the client region, server region, and service port obtained from the current TCP session with the region and port constraints to determine whether the cross-border region and port abnormality condition is met; if the first packet feature abnormality condition, session interaction abnormality condition, and cross-border region and port abnormality condition are all met, it is determined to be an illegal cross-border behavior of encrypted VPN, and the detection result is output.

[0083] It should be noted that those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the system or device described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0084] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for detecting illegal cross-border activities via encrypted VPNs, characterized in that, include: Perform full mirroring of the target traffic to obtain traffic mirroring data; Identify the first data packet carrying a payload sent by the client after the TCP session completes the three-way handshake from the traffic mirroring data, and extract the first packet feature parameters of the data packet. The first packet feature parameters include quantitative indicators reflecting the characteristics of encrypted traffic based on the statistics of the payload content. Based on the TCP sequence number, all data packets belonging to the same TCP session in the traffic mirror data are reassembled in an orderly manner to obtain a complete session data stream. Session interaction feature parameters are extracted from the complete session data stream. The session interaction feature parameters include quantitative indicators that reflect the asymmetry of data volume between the server and the client. Obtain historical network session log data, filter log records that meet preset valid session conditions from the historical network session log data, perform aggregate analysis on the filtered log records, and construct a feature model baseline for identifying encrypted VPN cross-border behavior; The feature model baseline includes the first packet feature threshold, the session interaction feature threshold, and the regional port constraint conditions. For the current TCP session, verify whether it meets the preset valid session conditions; After the verification is passed, the following matching steps are performed: the first packet feature parameters are compared with the first packet feature threshold to determine whether the first packet feature anomaly condition is met; The session interaction feature parameters are compared with the session interaction feature threshold to determine whether the session interaction abnormal conditions are met; the client region, server region and service port obtained from the current TCP session are compared with the region and port constraints to determine whether the cross-border region and port abnormal conditions are met. If the first packet feature anomaly condition, the session interaction anomaly condition, and the cross-border regional port anomaly condition are all met, it is determined to be an illegal cross-border behavior of the encrypted VPN, and the detection result is output. The preset valid session conditions include: the event mask is a normal event, and the TCP connection state satisfies the condition that the full handshake is completed and there is no abnormal interruption; wherein, an event mask of 0 indicates a normal event, and the result of a bitwise AND operation between the TCP connection state and 0xe is 0xe, indicating that the full handshake is completed and there is no abnormal interruption. The first packet feature parameters include the average number of bits per byte, the number of consecutive visible characters at the beginning of the payload, the proportion of visible characters, the longest consecutive visible character count, the payload entropy value, the payload length, and the session protocol. The visible characters correspond to bits 32-126 in the ASCII table. The method for calculating the average number of bits per byte is as follows: by parsing the payload data byte by byte, count the number of binary bits that are 1 in each byte, and calculate the average of all bytes, which is recorded as the average number of bits per byte. The session interaction characteristic parameters include session duration, total payload sent by the client to the server, total payload sent by the server to the client, and frequency of interaction between the client and the server.

2. The method for detecting illegal cross-border activities via encrypted VPNs according to claim 1, characterized in that, The first packet feature parameters include the average number of bits per byte, the number of consecutive visible characters at the beginning of the payload, the proportion of visible characters to the total payload bytes, the longest consecutive visible character in the payload, the payload entropy value, the payload length, and the session protocol.

3. The method for detecting illegal cross-border activities via encrypted VPNs according to claim 1, characterized in that, The first packet feature thresholds include: the average number of bits per byte is greater than or equal to 3.4 and less than or equal to 4.6, the load entropy value is greater than or equal to 5, the proportion of visible characters is less than 0.5, and the longest consecutive visible character count is less than 20.

4. The method for detecting illegal cross-border activities via encrypted VPNs according to claim 1, characterized in that, The geographical port constraints include: the client region is within China, the server region is outside China, and the service port is not a preset normal protocol port. The preset normal protocol ports include 80, 443, 853, and the hundreds offset port of port 443.

5. The method for detecting illegal cross-border activities via encrypted VPNs according to claim 1, characterized in that, The session interaction characteristic thresholds include: within a preset time window, after grouping by client IP, server IP, and server port, the number of sessions in the same group is greater than 10, the total payload bytes are greater than 1MB, and the proportion of the payload bytes sent by the server to the total payload bytes is greater than 80%.

6. The method for detecting illegal cross-border activities via encrypted VPNs according to claim 1, characterized in that, Based on TCP sequence numbers, all data packets belonging to the same TCP session in the traffic mirroring data are reassembled in an ordered manner to obtain a complete session data stream, including: Using the source IP address, destination IP address, source port, destination port, and protocol type as unique session identifiers, all data packets belonging to the same TCP session are filtered out. Based on the sequence number and acknowledgment number of the TCP packet, the packets are sorted according to the order in which they were sent. The sequence number continuity is used to determine whether there are missing messages. The detected missing messages are marked through a timeout retransmission mechanism to form a complete session data stream.

7. A device for detecting illegal cross-border activities via encrypted VPNs, characterized in that, include: The traffic mirroring module is used to perform full mirroring of the target traffic to obtain traffic mirroring data; The first packet feature extraction module is used to identify the first data packet carrying the payload sent by the client after the TCP session completes the three-way handshake from the traffic mirror data, and to extract the first packet feature parameters of the data packet. The first packet feature parameters include quantitative indicators reflecting the characteristics of encrypted traffic based on the payload content statistics. The session reassembly module is used to reassemble all data packets belonging to the same TCP session in the traffic mirror data in an orderly manner based on the TCP sequence number to obtain a complete session data stream, and to extract session interaction feature parameters from the complete session data stream. The session interaction feature parameters include quantitative indicators that reflect the asymmetry of data volume between the server and the client. The historical log analysis and modeling module is used to acquire historical network session log data, filter log records that meet preset valid session conditions from the historical network session log data, perform aggregate analysis on the filtered log records, and construct a feature model baseline for identifying encrypted VPN cross-border behavior. The feature model baseline includes the first packet feature threshold, the session interaction feature threshold, and the regional port constraint conditions. The session verification module is used to verify whether the current TCP session meets the preset valid session conditions; The comprehensive verification module is used to perform the following matching steps after the verification is passed: compare the first packet feature parameters with the first packet feature threshold to determine whether the first packet feature anomaly condition is met; The session interaction feature parameters are compared with the session interaction feature threshold to determine whether the session interaction abnormality condition is met; the client region, server region and service port obtained from the current TCP session are compared with the region and port constraints to determine whether the cross-border region and port abnormality condition is met; if the first packet feature abnormality condition, the session interaction abnormality condition and the cross-border region and port abnormality condition are all met, it is determined to be an illegal cross-border behavior of encrypted VPN, and the detection result is output. The preset valid session conditions include: the event mask is a normal event, and the TCP connection state satisfies the condition that the full handshake is completed and there is no abnormal interruption; wherein, an event mask of 0 indicates a normal event, and the result of a bitwise AND operation between the TCP connection state and 0xe is 0xe, indicating that the full handshake is completed and there is no abnormal interruption. The first packet feature parameters include the average number of bits per byte, the number of consecutive visible characters at the beginning of the payload, the proportion of visible characters, the longest consecutive visible character count, the payload entropy value, the payload length, and the session protocol. The visible characters correspond to bits 32-126 in the ASCII table. The method for calculating the average number of bits per byte is as follows: by parsing the payload data byte by byte, count the number of binary bits that are 1 in each byte, and calculate the average of all bytes, which is recorded as the average number of bits per byte. The session interaction characteristic parameters include session duration, total payload sent by the client to the server, total payload sent by the server to the client, and frequency of interaction between the client and the server.

Images