A network traffic random data determination method based on multi-dimensional content analysis
The network traffic random data determination method based on multidimensional content analysis solves the problem of unstable determination results in existing technologies, and realizes accurate identification and determination of network traffic data, which is applicable to complex and ever-changing network environments.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- CHENGDU MANYIN TECHNOLOGY CO LTD
- Filing Date
- 2026-04-14
- Publication Date
- 2026-07-14
AI Technical Summary
Existing network traffic analysis methods are effective in processing plaintext data, but they are difficult to effectively determine the randomness of highly disordered random data at the byte level, resulting in insufficient stability and limited applicability of the judgment results.
A multi-dimensional content analysis method is adopted, including randomness judgment rules based on a preset common vocabulary, the average range of bytes, the length of consecutive visible characters, the proportion of visible characters, and the degree of dispersion of byte value distribution, to comprehensively judge network traffic data, and the final result is obtained through weighted calculation.
It effectively distinguishes between plaintext data and random data, improves the stability and applicability of the judgment results, has good versatility and scalability, and is adaptable to complex and ever-changing network environments.
Smart Images
Figure CN122395097A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of network traffic analysis technology, specifically relating to a method for determining random network traffic data based on multidimensional content analysis. Background Technology
[0002] With the development of network communication technology, network traffic data includes plaintext data and encoded, compressed, or encrypted random data. Analyzing and classifying traffic data content is a fundamental issue in network traffic management. Existing network traffic analysis methods mainly include protocol identification, traffic statistical analysis, and feature-matching content detection. While these methods are effective in processing plaintext data, they struggle to effectively determine the randomness of highly disordered random data at the byte level. Specifically: Existing statistical analysis methods often focus only on overall traffic characteristics such as data length and transmission rate, lacking analysis based on the data content itself. Furthermore, existing methods rely heavily on protocol features, keyword matching, or single statistical indicators, making them prone to misjudgment after data processing. They also lack multi-feature analysis and comprehensive judgment mechanisms at the byte level, resulting in insufficient stability and limited applicability of the judgment results. Therefore, there is an urgent need for an effective method for judging random network traffic data based on the data content itself. Summary of the Invention
[0003] To address the problems mentioned in the background, this invention provides a method for determining random network traffic data based on multidimensional content analysis. This method solves the problem that existing technologies lack multi-feature analysis and comprehensive determination mechanisms at the byte level, resulting in insufficient stability and limited applicability of the determination results.
[0004] To achieve the above objectives, the present invention provides the following technical solution: A method for determining random network traffic data based on multidimensional content analysis includes the following steps: S1: Receive traffic logs and convert them into a preset processable format to obtain byte sequence data; S2: Sequentially execute randomness determination rules based on a preset common vocabulary, byte average range, continuous visible character length, visible character ratio, and byte value distribution dispersion to perform randomness determination analysis on the load content of the byte sequence data, and record the determination results under each randomness determination rule respectively; S3: Perform comprehensive processing on the judgment results, obtain a comprehensive judgment score through weighted calculation, and combine it with the preset judgment threshold to complete the final judgment on whether the network traffic data is random data and output the result.
[0005] Compared with the prior art, the beneficial effects of the present invention are: This invention overcomes the limitations of existing technologies that rely on port, protocol type, or single feature analysis by applying multi-dimensional randomness determination rules to the byte content of network traffic payloads. This significantly expands the ability to identify the randomness of network traffic data content and effectively distinguishes between plaintext and random data. Simultaneously, it introduces multiple determination rules and processes the determination results through a weighted synthesis method, avoiding the influence of misjudgments by a single rule, making the final determination result more stable and reliable, and adaptable to complex and ever-changing real-world network environments. Furthermore, the determination rules of this invention are designed based on byte-level statistical and content features, do not depend on specific application protocols or encryption methods, and can flexibly adjust rule weights or add new determination rules, possessing good versatility and scalability, and having high engineering practical value. Attached Figure Description
[0006] Figure 1 This is a flowchart illustrating the process of this application. Detailed Implementation
[0007] To facilitate understanding of the technical content of this invention by those skilled in the art, the invention will be further described in detail below with reference to the accompanying drawings and specific examples. It should be understood that the specific examples described herein are merely illustrative and not intended to limit the scope of the invention.
[0008] In network communication, different types of data exhibit different structural characteristics at the byte level. Plaintext data typically contains a certain proportion of readable characters or a fixed structure, and its byte value distribution and character arrangement show certain regularities; while random data lacks a stable structure in terms of byte distribution and character continuity, exhibiting overall random characteristics. Based on these differences, it is possible to determine whether network traffic data is random by analyzing its content.
[0009] A method for determining random network traffic data based on multidimensional content analysis, such as Figure 1 As shown, it includes the following steps: S1: Receive traffic logs and convert them into a processable format, specifically including: S10: Input target traffic and output traffic analysis logs; First, other traffic analysis devices independently access the target traffic and output traffic analysis logs at the packet level. The log content includes transport layer load information, as well as basic information such as IP, port, transport layer protocol, and packet sequence number.
[0010] S11: Convert to a processable format; Receive and parse the traffic analysis log output by the traffic analysis device in S10, and convert the transport layer payload in the log into a processable format of byte sequence.
[0011] S2: Execute the judgment rules, analyze the load content, and record the results, specifically including: S20: Randomness determination based on commonly used thesaurus; For the byte sequence data obtained in S11, the main process involves calling a pre-configured network vocabulary dictionary. Starting from the beginning of the target byte sequence, the search window step is set using the byte length of the longest word in the network vocabulary dictionary. The following operation is performed repeatedly, moving the window until no more data is processed: 1) Compare each entry in the commonly used dictionary with the byte sequence within the window, and save the start and end positions of all hit offsets as a hit interval tree; 2) If the hit interval tree is not empty, add the lengths of the intervals covered by the hit interval tree to get the current window's hit coverage length, and add it to the total cumulative hit length, then continue; if the hit interval tree is empty, continue. 3) Use the next position of the current search window as the new starting position of the search window, move the search window, and if the search window does not contain byte sequence data, end directly; if there is still data in the search window, continue to perform the search according to the matching operation.
[0012] Calculate the ratio of the cumulative total hit length to the total length of processed data. When the result exceeds 0.5, the data content is determined not to meet the randomness requirement, and the corresponding randomness determination result is recorded. When the result is less than 0.5, the data content under this rule is recorded to meet the randomness requirement, and the determination result is saved for later use.
[0013] S21: Randomness determination based on the range of average byte values; For the byte sequence data obtained in S11, the values of all bytes in the data content are statistically analyzed, and the average value of the byte values is calculated.
[0014] When the average value of the bytes is greater than 127, the data content is determined to satisfy randomness under the determination rule, and the corresponding determination result is recorded; when the average value of the bytes is not greater than 127, the data content is determined not to satisfy randomness under the determination rule, and the determination result is saved for subsequent processing.
[0015] S22: Randomness determination based on the length of consecutive visible characters; For the byte sequence data obtained in S11, identify the bytes that belong to the visible character range and calculate the maximum length of consecutive visible character segments. Parse the byte sequence to identify the bytes or byte combinations corresponding to the visible characters, and then calculate the maximum length of consecutive visible character segments based on this.
[0016] When the maximum length of the continuously visible characters is less than 5, the data content is determined to satisfy randomness under the determination rule, and the corresponding determination result is recorded; when the maximum length is not less than 5, the data content is determined not to satisfy randomness under the determination rule, and the determination result is saved for subsequent processing.
[0017] S23: Randomness determination based on the proportion of visible characters; For the byte sequence data obtained in S11, count the number of visible character bytes and calculate the ratio of the number of visible character bytes to the total number of bytes in the data content.
[0018] When the proportion of visible characters is less than 0.5, the data content is determined to meet the randomness determination condition under the determination rule, and the corresponding determination result is recorded; when the proportion is not less than 0.5, the data content is determined not to meet the randomness determination condition under the determination rule, and the determination result is saved for subsequent processing.
[0019] S24: Randomness determination based on the degree of dispersion of byte value distribution; For the byte sequence data obtained in S11, firstly, the frequency of each byte value in the overall data is counted, and the proportion of each byte value's occurrence in the total number of bytes is calculated, thus obtaining the complete frequency distribution of each byte value. Based on this, the frequency of all byte values is processed to calculate their average frequency. The specific method is as follows: The average frequency of each byte value is calculated by summing its occurrence frequencies and then dividing by the total number of byte values. Next, the difference between the occurrence frequency of each byte value and the average frequency is calculated, and this difference is squared. All squared results are then summed and divided by the total number of byte values to obtain the mean squared frequency deviation. Finally, the square root of the mean squared frequency deviation is taken to obtain the standard deviation of the byte value distribution, which characterizes the dispersion of the byte value distribution.
[0020] The calculation process for the standard deviation of the byte value distribution is as follows: Standard deviation of byte value distribution = Square root of the sum of squares of the differences between the frequency of all byte values and the average frequency of all byte values, divided by the total number of byte values. This can be expressed by the following formula: σ=√((1 / N)×∑(f i -f) 2 ); The corresponding meanings are as follows: σ represents the standard deviation of the byte value distribution; N represents the total number of byte values; f irepresents the frequency of the i-th byte value in the byte sequence; f represents the average frequency of all byte values.
[0021] When the standard deviation of the byte value distribution is greater than 64, the data content is determined to satisfy randomness under the determination rule, and the corresponding determination result is recorded; when the standard deviation is not greater than 64, the data content is determined not to satisfy randomness under the determination rule, and the determination result is saved for subsequent processing.
[0022] S3: Comprehensive processing and final judgment of judgment results, specifically including; S30: Quantification of judgment results and weight calculation; The judgment results of each judgment rule in S2 are summarized and processed. For each judgment rule, its judgment result is converted into a corresponding rule judgment value. If the data content judged by the rule meets the characteristics of random data, the rule judgment value is recorded as 1; if the data content judged by the rule does not meet the characteristics of random data, the rule judgment value is recorded as 0.
[0023] A weight coefficient is pre-set for each judgment rule. The weight coefficient for the randomness judgment rule based on the common vocabulary is 0.35; the weight coefficient for the randomness judgment rule based on the average range of bytes is 0.20; the weight coefficient for the randomness judgment rule based on the length of consecutive visible characters is 0.20; the weight coefficient for the randomness judgment rule based on the proportion of visible characters is 0.15; and the weight coefficient for the randomness judgment rule based on the dispersion of byte value distribution is 0.10.
[0024] Calculate the overall judgment score. Multiply the judgment value of each rule by its corresponding weight coefficient, and sum the calculation results of all rules to obtain the overall judgment score S.
[0025] S31: Final randomness determination; The comprehensive judgment score S in S30 is compared with the preset judgment threshold. When the comprehensive judgment score S is greater than or equal to 0.5, the network traffic data content is judged as random data, and the corresponding randomness judgment result is output; when the comprehensive judgment score S is less than 0.5, the network traffic data content is judged as non-random data, and the corresponding non-randomness judgment result is output.
[0026] Explanation of keywords and terms in this embodiment: Commonly Used Network Terms: These are plaintext content features that frequently appear in normal network communication, including commonly used terms in natural language, keyword strings commonly used in network protocols, and general plaintext identifier strings.
[0027] Visible characters: include visible characters that conform to the ASCII encoding standard, and characters that conform to the Chinese character encoding standard, including GBK encoding and UTF-8 encoding.
[0028] Standard deviation: A commonly used indicator in statistics to measure the dispersion (variability) of a set of data, representing the average deviation of data points from the mean.
[0029] Interval Tree: An interval tree is a data structure used to store and manage multiple intervals. By organizing and indexing the start and end positions of each interval, an interval tree can quickly determine whether there is an overlap between different intervals, and can calculate the range of intervals that are commonly covered or separately covered by multiple intervals. For example, it can determine the continuous coverage segment formed after merging multiple intervals and its start and end positions. Compared with traversing all intervals one by one, interval trees can more efficiently complete the calculation of interval coverage and related queries, making them suitable for technical scenarios that require rapid processing of interval coverage.
[0030] Those skilled in the art should understand that the above embodiments are merely illustrative of the technical principles of the present invention and are not intended to limit the scope of protection of the present invention. Any reasonable modifications, equivalent substitutions, or adaptive improvements made based on the technical concepts disclosed in this invention without departing from the essential spirit of the invention should be considered to fall within the scope of protection defined by the claims of this invention.
Claims
1. A method for determining random network traffic data based on multidimensional content analysis, characterized in that, Includes the following steps: S1: Receive traffic logs and convert them into a preset processable format to obtain byte sequence data; S2: Sequentially execute randomness determination rules based on a preset common vocabulary, byte average range, continuous visible character length, visible character ratio, and byte value distribution dispersion to perform randomness determination analysis on the load content of the byte sequence data, and record the determination results under each randomness determination rule respectively; S3: Perform comprehensive processing on the judgment results, obtain a comprehensive judgment score through weighted calculation, and combine it with the preset judgment threshold to complete the final judgment on whether the network traffic data is random data and output the result.
2. The method for determining random network traffic data based on multidimensional content analysis according to claim 1, characterized in that, S1 specifically includes: S10: Access the target traffic through the traffic analysis device and output a packet-level traffic analysis log containing transport layer payload content, IP, port, transport layer protocol and packet sequence number; S11: Parse the traffic analysis log and convert the transport layer payload content in the log into a preset format of byte sequence.
3. The method for determining random network traffic data based on multidimensional content analysis according to claim 2, characterized in that, In S2, the execution process of the randomness determination rule based on the preset commonly used vocabulary is as follows: Using the byte length of the longest word in the preset common vocabulary as the search window step size, the window is cyclically moved from the starting position of the byte sequence data and matched with the vocabulary entries. The hit interval tree is saved and the cumulative total hit length is calculated. The randomness is determined by the ratio of the cumulative total hit length to the total length of the byte sequence data. If the ratio exceeds the preset value X1, it is determined that the randomness is not satisfied. If it is lower than X1, it is determined that the randomness is satisfied.
4. The method for determining random network traffic data based on multidimensional content analysis according to claim 2, characterized in that, In S2, the execution process of the randomness determination rule based on the range of byte average values is as follows: The values of all bytes in the byte sequence data are counted and the average value is calculated. If the average value is greater than a preset value Y, it is determined that the randomness is satisfied; if it is not greater than Y, it is determined that the randomness is not satisfied.
5. The method for determining random network traffic data based on multidimensional content analysis according to claim 2, characterized in that, In S2, the execution process of the randomness determination rule based on the length of continuously visible characters is as follows: The visible characters in the byte sequence data are identified, and the maximum length of consecutive visible character segments is counted. If the maximum length is less than a preset value Z, it is determined that the randomness is satisfied; if it is not less than Z, it is determined that the randomness is not satisfied.
6. The method for determining random network traffic data based on multidimensional content analysis according to claim 2, characterized in that, In S2, the execution process of the randomness determination rule based on the proportion of visible characters is as follows: The number of visible character bytes in the byte sequence data is counted, and the ratio of the visible character bytes to the total number of bytes in the byte sequence data is calculated. If the ratio is less than a preset value of X2, it is determined that the randomness is satisfied; if it is not less than X2, it is determined that the randomness is not satisfied.
7. The method for determining random network traffic data based on multidimensional content analysis according to claim 2, characterized in that, In S2, the execution process of the randomness determination rule based on the dispersion of byte value distribution is as follows: Statistically analyze the frequency of occurrence of each byte value in the byte sequence data and calculate the average frequency. Then, calculate the standard deviation of the byte value distribution using the following formula: σ=√((1 / N)×∑(f i −f) 2 ); If the standard deviation is greater than the preset value M, it is determined that the randomness is satisfied; if it is not greater than M, it is determined that the randomness is not satisfied; where σ is the standard deviation of the byte value distribution, N is the total number of byte values, and f i Let f be the frequency of occurrence of the i-th byte value, and let f be the average frequency of occurrence of all byte values.
8. The method for determining random network traffic data based on multidimensional content analysis according to claim 1, characterized in that, The process of comprehensively processing the judgment results in S3 is as follows: The judgment results of each rule are converted into rule judgment values. If the random data characteristics are met, they are recorded as 1, and if not, they are recorded as 0. Configure preset weight coefficients for each randomness judgment rule, multiply each rule judgment value by its corresponding weight coefficient, and sum them to obtain the comprehensive judgment score; The weight coefficients of the randomness determination rules based on the preset commonly used vocabulary, the average range of bytes, the length of consecutive visible characters, the proportion of visible characters, and the degree of dispersion of byte value distribution are W1, W2, W2, W3, and W4, respectively.
9. The method for determining random network traffic data based on multidimensional content analysis according to claim 8, characterized in that, The weight coefficients mentioned above satisfy: W1+W2+W2+W3+W4=1.
10. The method for determining random network traffic data based on multidimensional content analysis according to claim 1, characterized in that, The final determination process in S3 is as follows: the preset determination threshold is X3. If the comprehensive determination score is greater than or equal to X3, the network traffic data is determined to be random data; if the comprehensive determination score is less than X3, the network traffic data is determined to be non-random data, and the corresponding determination result is output.