Network traffic control methods and terminal equipment

Abstract

This application discloses a network traffic control method and terminal device, belonging to the field of network access technology. In this application, firstly, the terminal device's operating system is configured to include a local traffic interception module and a client main process, and a local communication channel is established between the client main process and the local traffic interception module when the client main process starts. Then, when a business application of the terminal device initiates a network connection, the local traffic interception module captures the network connection and generates a traffic event and connection context. Finally, the client main process matches the corresponding target policy rule from the policy rule set according to the connection context to control the traffic event. Thus, by establishing a traffic control layer including a local traffic interception module and a client main process in the terminal device's operating system, traffic interception and control for different business applications can be implemented locally on the terminal device, ensuring that the traffic of all business applications is taken over, thereby improving the coverage of the network traffic control method.

Description

Technical Field

[0001] This application relates to the field of network access technology, specifically to a network traffic control method and terminal device. Background Technology

[0002] In related technologies, network traffic control for terminal devices mainly relies on system proxy configuration, PAC (Proxy Auto-Configuration) rules, VPN (Virtual Private Network) tunnels, browser plugins, traditional firewalls, kernel extensions, or single network filtering components. These solutions can meet some control needs in scenarios involving ordinary proxy access, basic VPN connections, or simple blacklists and whitelists. However, they cannot guarantee that all business application traffic will be controlled, resulting in low coverage of network traffic control methods. Summary of the Invention

[0003] The main objective of this application is to provide a network traffic control method and terminal device, which aims to at least partially solve the aforementioned technical problems.

[0004] To achieve the above objectives, firstly, a network traffic control method is provided, applied to a terminal device. The operating system of the terminal device includes a local traffic interception module and a client main process. The network traffic control method includes: When the client main process starts, a local communication channel is established between the client main process and the local traffic interception module; The local traffic interception module captures network connections initiated by business applications on terminal devices, generates traffic events, and constructs a connection context based on the traffic events. The connection context includes at least one of the following fields: application identifier field, user identity identifier field, target address field, target port field, domain name field, protocol type field, and network type field. The client main process obtains the policy rule set from the server platform and matches the target policy rule corresponding to the connection context from the policy rule set. The policy rule set includes multiple preset policy rules, and the preset policy rules include at least one of the following: application rule field, user rule field, target rule field, protocol rule field, network rule field, processing action field, and policy version field. The client's main process controls traffic events based on the target processing action corresponding to the target processing action field in the target policy rule.

[0005] In some embodiments, the operating system also includes multiple traffic processing modules, including a local forwarding module and an audit log module; The client's main process controls traffic events based on the target processing action field in the target policy rules, including: When the target processing action is a forwarding action, the traffic event is forwarded to the local forwarding module through the client main process; Traffic events are forwarded through the local forwarding module to access the target network resources corresponding to the traffic events; When the target processing action is an audit-only action or a blocking action, the traffic event is forwarded to the audit log module through the client main process; The first audit record is generated by auditing traffic events through the audit log module. When the target processing action is a direct connection action, the target network resources are accessed through the client main process.

[0006] In some embodiments, traffic events are forwarded via a local forwarding module to access the target network resources corresponding to the traffic events, including: The local forwarding module determines available nodes from a pre-configured list of proxy nodes based on node status information. This node status information includes the proxy node's latency, number of connection failures, number of consecutive successes, load, and availability. Based on the node status information of available nodes, determine the node latency metric, node failure rate metric, and node load metric. Based on node latency metrics, node failure rate metrics, node load metrics, policy penalty metrics corresponding to the target policy rules, and their respective weights, a comprehensive node metric is obtained. Based on the comprehensive indicators of the nodes, the target node is determined from the available nodes; Traffic events are forwarded to the target node to access target network resources through the target node.

[0007] In some embodiments, the connection context also includes a process identifier field, a code signing status field, and a connection capture time field; The local traffic interception module captures network connections initiated by business applications on terminal devices, generates traffic events, and constructs a connection context based on the traffic events, including: The local traffic interception module captures network connections and extracts the five-tuple information of the network connection; the five-tuple information includes local address, local port, remote address, remote port, and transport protocol type; Based on the quintuple information, the process identifier can be retrieved; Based on the process identifier, the application identifier, user identity identifier, and code signing status can be retrieved. Query the outbound network interface card interface of the network connection to obtain the network type; Query the cached records of the Domain Name System; When a domain name corresponding to a remote address exists in the cache record, retrieve the domain name and generate a traffic event; Use the remote address as the target address and the remote port as the target port; Combine process identifier, application identifier, user identifier, target address, target port, domain name, transport protocol type, network type, code signing status, and connection capture time of the captured network connection to construct a connection context; When the cached record does not contain a domain name corresponding to the remote address, the process identifier, application identifier, user identity identifier, target address, target port, transport protocol type, network type, code signing status, and connection capture time of the captured network connection are combined, and the domain name field is set to an empty placeholder to obtain a temporary connection context. Re-query the cached record, and if the domain name exists in the cached record, generate a traffic event, update the domain name field in the temporary connection context to the domain name, and obtain the connection context.

[0008] In some embodiments, matching the target policy rule corresponding to the connection context from the policy rule set includes: For each preset policy rule, when the application rule field matches the application identifier field, the user rule field matches the user identity identifier field, the target rule field matches the target address field, domain name field, and target port field, the protocol rule field matches the protocol type field, and the network rule field matches the network type field, the preset policy rule is used as a candidate policy rule to obtain a candidate policy rule set; the candidate policy rule set includes multiple candidate policy rules. The target strategy rule is determined from multiple candidate strategy rules according to the preset priority order of each field in the candidate strategy rule.

[0009] In some embodiments, it also includes: For each candidate policy rule, the client main process determines the application risk indicator based on the application rule field, the user permission risk indicator based on the user rule field, the target risk indicator based on the target rule field, the network risk indicator based on the network rule field, and the protocol risk indicator based on the protocol rule field. The client main process obtains the connection risk indicators of candidate policy rules based on application risk indicators, user permission risk indicators, target risk indicators, network risk indicators, protocol risk indicators and their corresponding risk weights. The client's main process determines the target policy rule from multiple candidate policy rules based on connection risk indicators.

[0010] In some embodiments, the client main process controls traffic events according to the target processing action corresponding to the target processing action field in the target policy rule, including: Obtain the update time and current time of the target policy rule through the client's main process; When the time difference between the current time and the update time is less than the preset time difference, the client main process controls the traffic event according to the target processing action; When the time difference is greater than or equal to the preset time difference, the flow control function is paused in the preset security mode, and a policy update request is sent to the server platform so that the server platform can return the updated target policy rule according to the policy version identifier carried in the policy update request. The client main process controls traffic events based on the latest processing action corresponding to the latest processing action field in the updated target policy rules; Network traffic control methods also include: When the target policy rule update fails or the client main process fails to obtain the policy rule set, the local policy rules cached locally are obtained through the client main process to control traffic events.

[0011] In some embodiments, establishing a local communication channel between the client main process and the local traffic interception module includes: The client's main process determines whether the local traffic interception module is authorized. When the local traffic interception module is not authorized, it enters a preset security mode to suspend the traffic control function. When the local traffic interception module is authorized, a communication channel with the local system is established.

[0012] In some embodiments, the server platform is a local service platform or a cloud service platform; after the client main process controls traffic events according to the target processing action corresponding to the target processing action field in the target policy rule, the network traffic control method further includes: The client-side main process generates a second audit record based on the handling process of traffic events and reports the second audit record to the server platform. When the server platform returns a confirmation response, mark the second audit record as reported. When the server platform does not return a confirmation response, the second audit record is written to the local encrypted reporting queue, and the reporting status of the second audit record is marked as pending retry. According to the preset reporting retry interval, the second audit record is periodically retrieved from the local encrypted reporting queue and re-reported to the server platform.

[0013] Secondly, a terminal device is also provided, including a memory and a processor. The operating system of the processor includes a local traffic interception module and a client main process. The memory stores a computer program, which, when executed by the processor, implements the network traffic control method as described in any of the above embodiments.

[0014] In summary, this application first configures the terminal device's operating system to include a local traffic interception module and a client main process, establishing a local communication channel with the local traffic interception module upon startup of the client main process. Then, when a business application on the terminal device initiates a network connection, the local traffic interception module captures the connection and generates traffic events and connection contexts. Finally, the client main process matches the corresponding target policy rule from the policy rule set based on the connection context to control the traffic events. Thus, this application establishes a traffic control layer locally on the terminal device's operating system, including a local traffic interception module and a client main process. The local traffic interception module is responsible for traffic interception and basic event reporting, while the client main process is responsible for policy management and traffic control. This allows for traffic interception and control of different business applications locally on the terminal device, ensuring that the traffic of all business applications is managed and improving the coverage of the network traffic control method. Attached Figure Description

[0015] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1 This is a flowchart illustrating a network traffic control method provided in an exemplary embodiment of this application; Figure 2 This is a schematic diagram of the modules of the operating system provided in an exemplary embodiment of this application; Figure 3 This is another schematic flowchart of the network traffic control method provided in an exemplary embodiment of this application; Figure 4 This is a schematic diagram of the structure of a terminal device provided in an exemplary embodiment of this application.

[0017] The realization of the objectives, functional features and advantages of the embodiments of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0018] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0019] In the description of this application, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the stated features. In the description of this application, "multiple" means two or more, unless otherwise explicitly specified. The use of "based on" or "according to" implies openness and inclusivity, because processes, steps, calculations, or other actions "based on" or "according to" one or more of the stated conditions or values ​​may in practice be based on additional conditions or beyond the stated values.

[0020] Additionally, in this application, the term "exemplary" is used to mean "used as an example, illustration, or description." Any embodiment described as "exemplary" in this application is not necessarily to be construed as being more preferred or advantageous than other embodiments. The following description is provided to enable any person skilled in the art to implement and use this application. Details are set forth in the following description for purposes of explanation. It should be understood that those skilled in the art will recognize that this application can be implemented without using these specific details. In other instances, well-known structures and processes will not be described in detail to avoid obscuring the description of this application with unnecessary detail. Therefore, this application is not intended to be limited to the embodiments shown, but is consistent with the broadest scope of the principles and features disclosed in this application.

[0021] First, to facilitate understanding of the implementation schemes provided in the embodiments of this application, the background technology involved in the network traffic control method and terminal device provided in the embodiments of this application will be further explained.

[0022] Network traffic control is mainly applied in scenarios such as enterprise terminal security auditing, local transparent proxy and traffic takeover, traffic splitting and policy routing, zero trust and access control, data leakage prevention and risk interception, connection management in multi-network environments, and client-server collaborative control.

[0023] In related technologies, network traffic control for terminal devices mainly relies on system proxy configuration, PAC rules, VPN tunnels, browser plugins, traditional firewalls, kernel extensions, or single network filtering components. Control schemes based on system proxy configuration or PAC rules forward traffic conforming to the rules to a proxy service by configuring the terminal device's operating system's HTTP / HTTPS / SOCKS proxy or PAC file; their advantages are low implementation cost and simple deployment, but they are mainly suitable for applications that follow system proxy configurations. Control schemes based on traditional VPNs or global tunnels establish virtual network channels through VPN clients, directing terminal traffic to remote gateways or proxy nodes, where the server performs access control, auditing, and forwarding; their advantages are relatively broad coverage, but they are prone to full traffic takeover, and their traffic splitting accuracy and local real-time control capabilities are limited. Control schemes based on browser plugins or in-application SDKs (Software Development Kits) implement access control and log collection in browsers or specific business applications, suitable for web access or specific application access scenarios, but cannot cover system-level, cross-application, background service, and command-line tool traffic. Control solutions based on local firewalls, packet filtering, or rule blocking allow or block traffic based on IP (Internet Protocol) addresses, ports, protocols, or application signatures. While suitable for basic security control, they lack sufficient support for transparent proxies, dynamic traffic splitting, user identity association, node scheduling, and comprehensive auditing. Control solutions based on kernel extensions or low-level network extensions intercept network traffic at a lower level. However, some operating systems (e.g., macOS, Macintosh Operating System, Macintosh OS) are increasingly restricting kernel extensions, resulting in high deployment, licensing, stability, and system compatibility costs, making them unsuitable for long-term, large-scale distribution to enterprise terminals.

[0024] In summary, system proxies and PACs reside at the proxy configuration layer that applications voluntarily follow, and are inherently unable to constrain applications that do not comply with proxy rules; browser plugins and SDKs reside within a single application and cannot cover system-level traffic; traditional VPNs focus more on tunnel establishment and global forwarding, lacking real-time control over local processes, application behavior, and fine-grained policies; ordinary firewalls focus on blocking and struggle to achieve transparent proxying and dynamic traffic splitting; traditional kernel extensions, although located at a lower level, are limited by the security policies and compatibility of terminal systems, making them unsuitable for long-term stable evolution. Therefore, the main shortcomings of network traffic control solutions lie in coverage, control granularity, stability, audit integrity, deployment cost, and system compatibility.

[0025] Specifically, in terms of coverage, system proxy configurations, PAC, and browser plugins cannot guarantee that all application traffic is intercepted, especially for network traffic from non-browser applications, command-line programs, background services, directly connected IPs, UDP (User Datagram Protocol), DNS (Domain Name System), and QUIC (Quick UDP Internet Connections). For security auditing systems, this creates blind spots, making access records unable to fully reflect the actual network behavior of the endpoints. Regarding control granularity, traditional VPNs or global proxies typically operate at the network or tunnel layer, making it difficult to simultaneously combine processes, users, domains, IPs, ports, protocols, node status, and security policies for local real-time judgment. Some solutions can only provide global proxying or simple blacklists and whitelists, failing to support common enterprise scenarios such as application-based traffic routing, resource-based traffic routing, identity-based access control, risk-based blocking, and dynamic switching based on node status. In terms of stability, network changes, VPN reconnections, node unavailability, DNS changes, policy updates, or system wake-up from hibernation can lead to inconsistent paths, connection remnants, rule invalidation, or repeated reconnections. For users, this manifests as access failures, slower connections, application lag, or the need to manually restart the client. In terms of performance, traditional global tunnels tend to direct unwanted traffic to remote nodes, increasing bandwidth consumption, node load, and access latency. For enterprise scenarios with a large number of terminals, this results in higher outbound bandwidth costs, server costs, and maintenance costs. In contrast, if the terminal side cannot perform fine-grained traffic routing, it is difficult to reduce the proportion of irrelevant traffic entering the secure link. Regarding auditing, some solutions can only record proxy layer requests or VPN tunnel connections, failing to reliably correlate them with local initiation processes, user identities, policy hit results, and final processing actions. Logs may only reflect "traffic passing through the proxy," rather than "all actual access behaviors generated by the terminal," which is detrimental to compliance auditing, anomaly tracing, and risk analysis. In terms of deployment and compatibility, kernel extension solutions are restricted by the security mechanisms of the terminal system, requiring higher privileges and more complex installation and authorization processes, and there are compatibility risks after system upgrades; browser plugins or in-application SDKs require adaptation for each application, resulting in high maintenance costs and making them unsuitable as a unified terminal network control capability.

[0026] It is evident that the relevant technologies lack a unified traffic control scheme that is local to the terminal device, system-level, auditable, policy-based, traffic-distributed, and conforms to the operating system's security architecture.

[0027] Therefore, this application provides a network traffic control method and terminal device. A traffic control layer including a local traffic interception module and a client main process is established locally on the operating system of the terminal device. The local traffic interception module is responsible for traffic interception and basic event reporting, while the client main process is responsible for policy management and traffic control. This method can realize traffic interception and control of different business applications locally on the terminal device, ensuring that all application traffic is taken over and providing coverage of the network traffic control method.

[0028] In addition, this application can achieve corresponding effects in different use scenarios, as illustrated below.

[0029] In enterprise endpoint security audit scenarios, this application can achieve functions such as enterprise compliance auditing, security tracing, abnormal access analysis, and sensitive data external connection detection by uniformly recording and auditing local outbound network connections on terminal devices, identifying access targets, application processes, user identities, network protocols, domain names, IPs, ports, connection times, and traffic flows.

[0030] In local transparent proxy and traffic takeover scenarios, this application enables policy-compliant traffic to be transparently accessed through proxy channels, VPN channels, security gateways, or local filtering links without the user's awareness or the business application needing to configure a proxy, achieving unified access control, access acceleration, security checks, or cross-network access.

[0031] In traffic splitting and policy routing scenarios, this application applies different processing strategies to traffic based on conditions such as application, domain name, IP segment, port, protocol, user identity, network environment, geographical region, node status, or business tag. These strategies include direct connection, proxy, blocking, bypass, auditing, and encrypted channel forwarding. This is applicable to enterprise internal and external network access, SaaS (Software as a Service) access, development and testing networks, cross-regional node selection, and fine-grained traffic splitting control.

[0032] In zero-trust and access control scenarios, this application combines local traffic control with user identity, device status, application trustworthiness, and policy permissions to implement identity and policy-based access control on the terminal side, preventing unauthorized applications, unknown processes, or devices that do not meet security requirements from accessing protected resources.

[0033] In data leakage prevention and risk interception scenarios, this application identifies and blocks connections to external networks, sensitive domains, unauthorized addresses, abnormal ports, or high-risk protocols, thereby preventing enterprise data from bypassing proxies, VPNs, or security gateways and directly sending it out, thus reducing the risk of data leakage and malicious external connections.

[0034] In connection management scenarios in multi-network environments, this application is applicable to Wi-Fi, wired networks, hotspots, enterprise networks, home networks, public networks, and network switching scenarios. When the network changes, nodes become unavailable, connections fail, or policies are updated, it can re-match, reconnect, downgrade, bypass, or block local connections, ensuring the continued effectiveness of access control policies.

[0035] In a client-server collaborative control scenario, this application uses the local client on the terminal device to be responsible for local traffic interception, policy execution, connection establishment and status reporting, while the server is responsible for policy configuration, user permissions, node scheduling, log aggregation, risk analysis and remote control, thereby forming a traffic security control system that coordinates end-side execution and cloud management.

[0036] Next, the specific implementation methods of the network traffic control method and terminal device provided in the embodiments of this application will be described in detail.

[0037] Firstly, this embodiment provides a network traffic control method applied to terminal devices, such as... Figure 2 As shown, the operating system of the terminal device may include a local traffic interception module and a client main process. In this embodiment, the terminal device can access the network, initiate / receive service requests, and is an end-user device that does not perform core routing forwarding but only acts as the last node in the network. The terminal device may include personal consumer terminals, office and commercial terminals, IoT terminals, communication and network dedicated terminals, and industrial control and special terminals, etc. The operating system may be Android, Windows, macOS, etc. As an example, a terminal device with a macOS operating system is used for illustration. The operating system of the terminal device is located in the processor and may include a local traffic interception module and a client main process. The local traffic interception module may be a system extension. In addition, the operating system may also include multiple traffic processing modules for handling traffic events. The traffic processing modules may include a local forwarding module and an audit log module. The local forwarding module may include a local proxy forwarding service and a VPN tunnel forwarding service, etc.

[0038] like Figure 1 As shown, the network traffic control method may include the following steps: S101: When the client main process starts, a local communication channel is established between the client main process and the local traffic interception module. In this embodiment, after the client main process starts, it can load and activate the local traffic interception module, and then establish a local communication channel with the extended process of the local traffic interception module. The local communication channel can be used to implement functions such as policy distribution, state synchronization, connection decision-making, log feedback, and exception notification.

[0039] In some embodiments, in S101, when the client main process starts, it can first determine whether the local traffic interception module is authorized. Then, if the local traffic interception module is not authorized, it enters a preset security mode to suspend the traffic control function. If the local traffic interception module is authorized, a communication channel with the local system is established.

[0040] In this embodiment, after the client main process starts, it can first complete the initialization of the operating system. The initialization actions may include: checking whether the system extension is authorized and enabled; checking whether the local proxy forwarding service and VPN tunnel forwarding service are available; obtaining the current user identity, device identity, client version, system version, and network environment; pulling or reading the locally cached local policy rule set; initializing the policy version number, node status table, connection status table, audit queue, and exception counter; and synchronizing the current policy summary and running status to the system extension. Specifically, the client main process can check whether the system extension is installed and authorized by the operating system; if the system extension is not authorized, it prompts the user to complete the authorization and enters a preset security mode; in the preset security mode, it can only record the connection status visible to the client main process itself, or suspend the flow control function according to a preset security policy; if the system extension is authorized, the client main process starts the local proxy forwarding service and VPN tunnel forwarding service, and establishes a local communication channel with the system extension. Thus, the initialization phase ensures that traffic interception, policy execution, and local forwarding capabilities are available. By completing authorization checks and module initialization during the startup phase, policy failures due to module unavailability can be avoided during subsequent connection processing.

[0041] As an example, preset security modes can include multiple modes, such as: Open mode, which prioritizes allowing traffic in case of anomalies to minimize the impact on user access; Balanced mode, which allows normal traffic while blocking or forcing proxying of high-risk traffic; Strict mode, which blocks traffic by default when policies are unavailable, nodes are unavailable, or identities cannot be verified; Observation mode, which only audits and does not intervene, used for canary deployments or policy verification; and Emergency mode, where the server issues temporary policies to quickly block specific targets or applications. Preset security modes can be switched according to actual use case requirements.

[0042] S102: The local traffic interception module captures network connections initiated by business applications on the terminal device, generates traffic events, and constructs a connection context based on the traffic events. The connection context includes at least one of the following fields: application identifier, user identity identifier, target address, target port, domain name, protocol type, and network type. In this embodiment, the business application can be any business application on the terminal device itself. Specifically, after authorization and initialization, the local traffic interception module monitors and captures the network traffic of the terminal device in real time, identifies and processes network connections initiated by various business applications on the terminal device, generates traffic events through traffic parsing and data extraction, and extracts relevant information from the input information of the traffic events to construct a connection context. The input information of the traffic events may include at least one of the following: 5-tuple information, transmission protocol type, application process information, currently logged-in user or device identity, network type, DNS query result, current client connection status, proxy node status, VPN tunnel status, current policy version, cache hit status, and the last policy update time. The 5-tuple information may include local address, local port, remote address, and remote port. Transport protocol types can include TCP, UDP, etc. Application process information can include process ID, process path, Bundle ID, Team ID, code signing status, etc. Network type can include Wi-Fi, wired network, hotspot, virtual interface, etc. DNS query results can include domain name, SNI, ALPN, HTTPCONNECT target, other identifiable access targets, etc.

[0043] In some embodiments, the connection context may further include a process identifier field, a code signing status field, and a connection capture time field. In S102, the network connection can first be captured by the local traffic interception module, and the five-tuple information of the network connection can be extracted. This five-tuple information includes the local address, local port, remote address, remote port, and transport protocol type. Then, based on the five-tuple information, the process identifier is retrieved; based on the process identifier, the application identifier, user identity identifier, and code signing status are retrieved; the network type is obtained by querying the outbound network interface card of the network connection; the DNS cache record is queried; when a domain name corresponding to the remote address exists in the cache record, the domain name is obtained, and a traffic event is generated. Finally, the remote address is used as the target address, and the remote port is used as the target port; the process identifier, application identifier, user identity identifier, target address, target port, domain name, transport protocol type, network type, code signing status, and connection capture time of the captured network connection are combined to construct the connection context.

[0044] In this embodiment, the connection context C can be represented as: C={pid,appId,userId,dstIp,dstPort,domain,proto,netType,signState,timestamp}; Among them, pid represents the process identifier field; appId represents the application identifier field; userId represents the user identity identifier field; dstIp represents the target address field; dstPort represents the target port field; domain represents the domain name field, which is empty if it cannot be obtained temporarily; proto represents the protocol type field; netType represents the network type field; signState represents the code signing status field; and timestamp represents the connection capture time field.

[0045] In the specific implementation, the system extension can first intercept newly established network connections, parse the five-tuple information from the packet header, and generate the original traffic event; then, enable full table lookup matching of the five-tuple to match the process identifier, and match the application identifier, user identity identifier, and code signing status through the process identifier table lookup; then, perform a reverse lookup through the routing table to query the outbound network interface of the network connection packet to obtain the network type, and query the cached records of the Domain Name System to obtain the domain name; finally, combine the fields according to the field mapping relationship defined in the connection context C to obtain the connection context.

[0046] As an example, when the cached record does not contain a domain name corresponding to the remote address, the process identifier, application identifier, user identifier, target address, target port, transport protocol type, network type, code signing status, and connection capture time of the captured network connection are combined, and the domain name field is set to an empty placeholder to obtain the temporary connection context. The cached record is queried again, and if the domain name exists in the cached record, a traffic event is generated, and the domain name field in the temporary connection context is updated to the domain name to obtain the connection context.

[0047] In this embodiment, the domain name may not be immediately available when the network connection is first established. The system extension can first use the secondary information to construct a temporary connection context, and send the temporary connection context to the client main process for a policy matching. Then, after the DNS query result or TLS handshake information is completed, the domain name field in the temporary connection context is completed, the connection context is obtained, and the connection context is sent to the client main process for a second policy matching, thereby avoiding the inability to achieve policy matching due to the delay of domain name information.

[0048] S103: Obtain the policy rule set from the server platform through the client's main process, and match the target policy rule corresponding to the connection context from the policy rule set. The policy rule set includes multiple preset policy rules, which include at least one of the following: application rule field, user rule field, target rule field, protocol rule field, network rule field, processing action field, and policy version field.

[0049] In this embodiment, the policy rule can be expressed as: Rule={App,User,Target,Protocol,Network,Action,Priority,Version}; In this context, App represents the application rule field; User represents the user rule field; Target represents the target rule field; Protocol represents the protocol rule field; Network represents the network rule field; Action represents the processing action field; Priority represents the rule priority field; and Version represents the policy version field. The application rule field can include at least one of the following: application name, BundleID, process path, signing entity, and whether it is a system process. The user rule field can include at least one of the following: user account, organization, role, and permission group. The target rule field can include at least one of the following: domain name, domain name suffix, IP address, CIDR network segment, port, and protocol. The protocol rule field can include at least one of the following protocols: TCP, UDP, DNS, HTTP / HTTPS, and QUIC. The network rule field can include at least one of the following: current network type, network trust level, SSID, gateway, and DNS server. The processing action field can include direct connection actions, blocking actions, forwarding actions, and audit-only actions. Forwarding actions can include proxy forwarding actions and VPN forwarding actions. Understandably, the client master process can determine the matching degree between the preset policy rule and the connection context based on the number of matches between at least one field in the connection context and the corresponding rule field in the preset policy rule, so as to match the target policy rule.

[0050] In some embodiments, in S103, for each preset policy rule, if the application rule field matches the application identifier field, the user rule field matches the user identity identifier field, the target rule field matches the target address field, domain name field, and target port field, the protocol rule field matches the protocol type field, and the network rule field matches the network type field, then the preset policy rule is used as a candidate policy rule to obtain a candidate policy rule set; the candidate policy rule set includes multiple candidate policy rules. Then, according to the preset priority order of each field in the candidate policy rule, the target policy rule is determined from the multiple candidate policy rules.

[0051] In this embodiment, the hit condition of the policy rule can be expressed as: Match(C,Rule)= AppMatch(C.appId, Rule.App) ANDUserMatch(C.userId,Rule.User) ANDTargetMatch(C.dstIp,C.domain,C.dstPort,Rule.Target) ANDProtoMatch(C.proto,Rule.Protocol) ANDNetworkMatch(C.netType,Rule.Network).

[0052] The process involves matching a preset policy rule against the connection context across five dimensions. Only when all five dimensions match is the preset policy rule considered a candidate policy rule. If multiple candidate policy rules match simultaneously, the final target policy rule is determined according to the following preset priority order. For example, the preset priority order might include: a candidate policy rule whose processing action is a blocking action has higher priority than one whose processing action is another; a candidate policy rule whose application rule field specifies a precise application has higher priority than one whose application rule field specifies a general application; a candidate policy rule whose target rule field specifies a precise domain name or IP address has higher priority than one whose target rule field specifies a wildcard target; a candidate policy rule whose user rule field specifies a precise user has higher priority than one whose user rule field specifies a default user; and a candidate policy rule whose policy version field specifies a higher version has higher priority than one whose policy version field specifies a lower version. Therefore, the client's main process can sort multiple candidate policy rules according to the preset priority order and determine the target policy rule based on the sorting result.

[0053] In other embodiments, the network control method may further include: for each candidate policy rule, determining an application risk indicator based on an application rule field, a user permission risk indicator based on a user rule field, a target risk indicator based on a target rule field, a network risk indicator based on a network rule field, and a protocol risk indicator based on a protocol rule field through the client main process; obtaining a connection risk indicator for the candidate policy rule through the client main process based on the application risk indicator, user permission risk indicator, target risk indicator, network risk indicator, protocol risk indicator, and their respective risk weights; and determining the target policy rule from multiple candidate policy rules through the client main process based on the connection risk indicator.

[0054] In this embodiment, the formula for calculating the connection risk indicator can be: R=100×(wa×A+wu×U+wt×T+wn×N+wp×P); Wherein, R represents the connection risk indicator, with a value ranging from 0 to 100. A represents the application risk indicator, with a value ranging from 0 to 1; for example, when the application rule field corresponds to a trusted application with a known signature, the application risk indicator value is lower, and when the application rule field corresponds to an application with an unknown signature or an abnormal path, the application risk indicator value is higher. U represents the user permission risk indicator, with a value ranging from 0 to 1; for example, when the user rule field corresponds to a user with normal authorization, the user permission risk indicator value is lower, and when the user rule field corresponds to a user who is not logged in or has insufficient permissions, the user permission risk indicator value is higher. T represents the target risk indicator, with a value ranging from 0 to 1; for example, when the domain name in the target rule field is a trusted domain name, the target risk indicator value is lower, and when the target rule field includes an external unknown IP, a high-risk domain name, or a sensitive port, the target risk indicator value is higher. N represents the network risk indicator, ranging from 0 to 1. For example, when the network rule field corresponds to a trusted network, the network risk indicator value is lower; when the network rule field corresponds to a public or unknown network, the network risk indicator value is higher. P represents the protocol risk indicator, ranging from 0 to 1. For example, when the protocol rule field corresponds to a known controlled protocol, the protocol risk indicator value is lower; when the protocol rule field corresponds to an unknown UDP, an abnormal port, or a protocol that circumvents proxies, the protocol risk indicator value is higher. wa, wu, wt, wn, and wp are risk weights, and wa+wu+wt+wn+wp=1. As an example, wa is 0.25, wu is 0.15, wt is 0.30, wn is 0.15, and wp is 0.15.

[0055] Understandably, when the target policy rule fails to match, the client's main process can calculate the connection risk index of the connection context using this formula, and then perform traffic control based on the connection risk index. For example, when R is greater than or equal to 80, a blocking action can be executed by default, or a preset security mode can be forced; when R is greater than or equal to 50 and less than 80, local proxy forwarding or VPN tunnel forwarding can be executed by default; when R is less than 50, direct connection action or only auditing action can be allowed. The threshold for R can be adjusted according to business requirements. For example, in strict mode, the blocking action threshold can be lowered to 70; in observation mode, only audit logs can be recorded without executing a blocking action.

[0056] In addition, in scenarios where the number of candidate policy rules is small or the boundaries between policy rules are clear, the client main process can also filter target policy rules based on the rule priority field configured in the policy rules to reduce the complexity of rule matching.

[0057] S104: The client main process controls traffic events according to the target processing action corresponding to the target processing action field in the target policy rule. In this embodiment, the target processing action corresponding to the target processing action field may include at least one of the following: direct connection action, blocking action, forwarding action, and audit-only action; direct connection action means not entering local proxy forwarding or VPN tunnel forwarding; blocking action means refusing connection and recording the blocking reason; forwarding action includes local proxy forwarding and VPN tunnel forwarding, proxy forwarding means directing traffic to a local transparent proxy or remote proxy node, VPN tunnel forwarding means directing traffic to a specified secure channel; audit-only action means not changing the connection path and only recording access behavior. In addition, the target processing action corresponding to the target processing action field may also include at least one of the following: allow action and bypass action. Allow action means allowing the connection to be established directly; bypass action means temporarily bypassing the processing link under abnormal or specific network conditions. In addition, when the target policy rule fails to match, the client main process can also generate a delayed action or a rematch action. The delayed action can mean waiting for the domain name, DNS, node status, or server policy to return before processing; the rematch action can mean that when the target policy rule, network type, or node status changes, the existing network connection needs to be re-evaluated.

[0058] In some embodiments, in S104, such as Figure 2 and Figure 3As shown, when the target processing action is a forwarding action, the client main process forwards the traffic event to the local forwarding module; the local forwarding module then forwards the traffic event to access the target network resource corresponding to the traffic event. When the target processing action is an audit-only action or a blocking action, the client main process forwards the network connection to the audit log module; the audit log module audits the traffic event and generates the first audit record. When the target processing action is a direct connection action, the client main process accesses the target network resource.

[0059] In this embodiment, when the target processing action is local proxy forwarding, the client main process redirects the traffic corresponding to the traffic event to the local proxy forwarding service, which then establishes a connection with the remote proxy node or security gateway. This forwarding process is transparent to the business application, eliminating the need to configure system proxies, PACs, environment variables, or SDKs in the business application to complete network traffic forwarding. Similarly, when the target processing action is VPN tunnel forwarding, the client main process imports the traffic corresponding to the traffic event into a designated secure channel and can further establish a connection with the remote proxy node or security gateway through the VPN tunnel forwarding service. When the target processing action is blocking, the client main process can refuse to establish a network connection corresponding to the traffic event or interrupt the existing network connection corresponding to the traffic event, and generate a first audit record containing the blocking reason, hit rule, application information, and target information; or forward the traffic event and blocking action to the audit log module, which generates the first audit record. When the target processing action is audit-only, the client main process does not change the network connection path, but only audits the traffic event through the audit log module, generating a first audit record for low-risk networks, debug mode, gray-scale policies, or observation period policies. When the target processing action is a direct connection action, the client main process allows the network connection to access the target network resources along the original path and audits the traffic events through the audit log module, generating the first audit record. It should be noted that when the local forwarding module is unavailable, the client main process can enter a preset security mode and perform network traffic control according to this preset security mode.

[0060] Thus, this embodiment eliminates the need to configure system proxies, PACs, environment variables, or SDKs in business applications, enabling different business applications to be uniformly included in the local traffic control scope, thereby reducing the possibility of business applications bypassing proxies or audit links.

[0061] As an example, when forwarding traffic events through a local forwarding module, the module first determines available nodes from a pre-defined list of proxy nodes based on node status information. This node status information includes the proxy node's latency, number of connection failures, number of consecutive successes, load, and availability. Then, based on the available nodes' status information, the module determines node latency, failure rate, and load metrics. Finally, based on these metrics, the penalty metrics corresponding to the target policy rule, and their respective weights, a comprehensive node metric is obtained. Finally, based on this comprehensive metric, the target node is identified from the available nodes, and traffic events are forwarded to it to access target network resources.

[0062] In this embodiment, the local forwarding module can directly filter available nodes based on availability information. Proxy nodes marked as unavailable, under maintenance, blocked, or offline are determined as unavailable nodes, while only proxy nodes marked as normally online are determined as available nodes. The local forwarding module can also combine availability information with at least one of other node status information for available node filtering. For example, the local forwarding module can preset maximum node latency, maximum number of connection failures, and load limit. When the node latency of a proxy node is greater than or equal to the maximum node latency, the proxy node is considered unavailable; when the number of connection failures of a proxy node is greater than or equal to the maximum number of connection failures, the proxy node is considered unavailable; when the load of a proxy node is greater than or equal to the load limit, the proxy node is considered unavailable.

[0063] Subsequently, the local forwarding module can calculate the comprehensive node index of each available node based on the node index calculation formula. Then, it selects the available node with the lowest comprehensive node index as the target node and accesses the target network resource corresponding to the traffic event through this target node. The node index calculation formula is as follows: Qj=α×Lj+β×Fj+γ×Bj+δ×Gj; Qj represents the overall node performance index of the j-th available node; a lower overall node performance index indicates that the available node is more suitable for selection. Lj represents the node latency index, which can be a normalized value of node latency. Fj represents the node failure rate index, which can be a normalized value of node connection failure rate. Bj represents the node load index, which can be a normalized value of load. Gj represents the policy penalty index; for example, when the region of an available node does not conform to the target policy rules, the policy penalty index takes a higher value. α, β, γ, and δ are the index weights, and α+β+γ+δ=1. Thus, since the availability of proxy nodes is mainly affected by node latency, node connection failure rate, load, and policy matching degree, the local forwarding module normalizes these factors and then weights them, which can stably select a better target node under different network conditions, ensuring the stability of network access.

[0064] Additionally, the target nodes can include multiple target available nodes whose overall node performance index is greater than or equal to a preset index. The local forwarding module can sort the multiple target available nodes in ascending order of their overall node performance index to obtain a node ranking; then, it establishes connections with the target available nodes according to the node ranking. When the first target available node in the ranking fails to connect a preset number of times, a connection is established with the second target available node in the ranking; the node switching judgment formula can be expressed as: If FailCount(node) >= K, switch to the second available node for the target. Here, FailCount(node) represents the number of consecutive failures of a target available node, and K represents the preset number of failures. If K is too small, it will lead to frequent node switching, and if K is too large, it will increase the time of user access failure. As an example, K can take the value of 2 to 5, and in enterprise network scenarios, K can be 3.

[0065] Additionally, it should be noted that in scenarios with a small number of proxy nodes or where the server already has mature scheduling capabilities, the selection of the target node can be determined without using the above node indicator calculation formula. Instead, it can be determined using methods such as fixed priority, region priority, lowest latency priority, or server-specified nodes. When all proxy nodes are unavailable, the client's main process can choose to block, connect directly, or wait for recovery according to the preset security mode.

[0066] In other embodiments, in S104, the update time and current time of the target policy rule can be obtained first through the client main process. Then, when the time difference between the current time and the update time is less than a preset time difference, the traffic event is controlled by the client main process according to the target processing action corresponding to the target processing action field. Alternatively, when the time difference is greater than or equal to the preset time difference, the traffic control function is paused in a preset security mode, and a policy update request is sent to the server platform, so that the server platform returns the updated target policy rule according to the policy version identifier carried in the policy update request; and the traffic event is controlled by the client main process according to the latest processing action corresponding to the latest processing action field in the updated target policy rule.

[0067] In this embodiment, the client main process can determine whether the target policy rule needs to be updated using a policy expiration check. The policy expiration check can be expressed as: When CurrentTime - PolicyUpdateTime > T, enter the preset safe mode; Where CurrentTime represents the current time, PolicyUpdateTime represents the most recent update time of the target policy rule, and T represents the longest preset time difference allowed for policy rule updates. In ordinary office scenarios, T can take a larger value, while in strict security scenarios, T can take a smaller value. As an example, T can take a value of 5 minutes to 60 minutes.

[0068] As an example, in network traffic control methods, when the target policy rule update fails or the client main process fails to obtain the policy rule set, the local policy rules cached locally can be obtained by the client main process to control traffic events.

[0069] In this embodiment, when communication between the client main process and the server platform is disconnected, the target policy rules cannot be updated and the policy rule set cannot be obtained. At this time, the client main process can read the most recently valid local policy rule to control traffic events, thereby avoiding network traffic outages or client main process unavailability.

[0070] In some embodiments, the server platform can be a local service platform or a cloud service platform. In this embodiment, the server platform can be configured as a local service platform in the terminal device, or it can be configured as a cloud service platform on another server outside the terminal device. When the server platform is a local service platform, the client main process establishes a local communication connection with the local service platform during the initialization phase; when the server platform is a cloud service platform, the client main process establishes a network communication connection with the cloud service platform during the initialization phase.

[0071] Correspondingly, in this network traffic control method, the client's main process can first generate a second audit record based on the traffic event processing procedure and report the second audit record to the server platform. Then, when the server platform returns a confirmation response, the second audit record is marked as reported. Alternatively, if the server platform does not return a confirmation response, the second audit record is written to a local encrypted reporting queue, and the reporting status of the second audit record is marked as pending retry; and according to a preset reporting retry interval, the second audit record is periodically retrieved from the local encrypted reporting queue and re-reported to the server platform.

[0072] In this embodiment, the client main process can generate a second audit record for the local traffic processing of all types of target processing actions and report it to the server platform. The audit record may include: user identity and device identity, application process information, access domain name, IP address, port and protocol, target policy rule ID, policy version and rule priority, target processing action, target node information and connection result, connection start time, end time, duration and failure reason, network environment and client status, connection risk indicators or anomaly tags, etc. The second audit record can be reported in real time or in batches according to a preset time window. Real-time reporting is suitable for scenarios with high security requirements, while batch reporting is suitable for scenarios that reduce network and server pressure. An exemplary preset time window can be set to 5 seconds, 30 seconds, 1 minute or longer.

[0073] Furthermore, when the client's main process loses connection with the server platform, it cannot complete the reporting of the second audit record. Instead, the second audit record can be written to a local encrypted reporting queue and reported in batches after the connection between the client's main process and the server platform is restored. Additionally, to prevent the local encrypted reporting queue from growing indefinitely, a maximum cache capacity and / or maximum retention time can be set for the local encrypted reporting queue. When the local encrypted reporting queue exceeds the maximum cache capacity and / or maximum retention time, priority should be given to retaining blocked, high-risk, and policy-abnormal second audit records, while low-risk directly connected second audit records should be discarded.

[0074] It is understandable that, such as Figure 2 and 3 As shown, the audit log module can also connect to the server platform and report the first audit record to the server platform. The reporting method for the first audit record is the same as that for the second audit record.

[0075] Next, the test results of the network traffic control method according to the embodiments of this application will be described.

[0076] In the traffic coverage effect test, the test indicators include local traffic coverage, proxy bypass rate, and the proportion of unidentified connections. The test method is as follows: on no less than 3 versions of macOS and more than 10 terminal devices, no less than 30 types of common business applications such as browsers, office software, command line tools, development tools, background services, and instant messaging tools are selected, and no less than 1,000 connection samples are constructed, including TCP, UDP, DNS, HTTP / HTTPS, QUIC, direct IP connection, and domain name access. The number of captured connections, the number of connections that successfully establish context, the number of connections processed by the policy, and the number of connections that are not taken over are counted. Compared with system proxy / PAC, browser plugins, traditional VPNs, and network control schemes without local interception, the results show that the network traffic control method provided in this application embodiment can cover applications that do not follow system proxy, command line tools, background services, and some UDP / DNS traffic; and the local traffic coverage is improved from about 60% to 80% to more than 95% compared with traditional network control schemes, the proxy bypass rate can be reduced to the range of 1% to 3%, and the identification coverage of command line tools and background services can be stably maintained at more than 90%.

[0077] In the test of the execution effect of policy rules, the test indicators include policy hit accuracy, false allow rate, false block rate, policy activation delay, and traffic routing path accuracy. The test method is to construct policy combinations such as application rules, domain name rules, IP / CIDR rules, port rules, user rules, network environment rules, and node status rules, with no less than 500 rule samples. The tests are conducted to see if actions such as direct connection, proxy, VPN forwarding, blocking, auditing only, and bypass are consistent with expectations, and the activation time of the new policy is statistically analyzed after the policy is updated. Compared with client-side fixed traffic routing rules, traditional global VPNs, and proxy rules based solely on domain names or IPs, the results show that the network control method of this application embodiment can extend the execution of policy rules from a single network layer judgment to a comprehensive judgment of "application + user + target + protocol + network environment + node status"; the policy hit accuracy can stably reach over 98%; the false allow rate and false block rate can be controlled within 1%; the activation delay for new connections after policy updates can be controlled within 1 second; and existing connections can be maintained, disconnected, or re-matched according to policy requirements.

[0078] In the audit integrity effectiveness test, the test indicators include audit log integrity rate, log field integrity rate, connection and application association success rate, and log reporting success rate. The test method involves recording actual connection samples generated by the terminal during continuous 24-72 hours of terminal usage and reconciling them with the audit logs generated by the client. Sampling points include stages such as connection initiation, policy hit, action execution, connection termination, node switching, exception failure, and log reporting. Compared with network control methods that only use proxy layer logs, VPN gateway logs, or do not enable local auditing, the network traffic control method provided in this application embodiment can record application source, user identity, access target, hit rules, processing actions, and failure reasons on the terminal side; the audit log integrity rate can reach over 95%; the application and connection association success rate can reach over 90%; and when the network is temporarily unavailable, logs can first enter a local queue and continue to be reported after the network recovers, with a stable reporting success rate of over 99%.

[0079] In performance and resource consumption testing, the test metrics included connection decision time, proxy forwarding latency, throughput reduction rate, CPU usage, and memory usage. The testing method involved sampling under various scenarios, including idle time, normal office work, high-concurrency connections, large file downloads, video conferencing, and frequent DNS queries. Each scenario lasted at least 30 minutes, and P50 and P95 latency were recorded, along with changes in CPU, memory, and network throughput. Compared to traditional global VPNs, legacy proxy clients, and direct connection baselines without enabled policies, this application reduces irrelevant traffic entering the proxy link through local policy rule caching, connection state tables, node state tables, and traffic splitting strategies. Policy decision time for normal connections can be controlled in milliseconds, and P95 decision time can be controlled within the range of 10ms to 50ms. Compared to global VPN forwarding, traffic without a proxy can connect directly, reducing bandwidth usage and forwarding latency at remote nodes. Client-side CPU usage can be controlled at a low single-digit percentage, and memory usage remains within acceptable limits for enterprise clients.

[0080] In the anomaly recovery and stability performance testing, the test indicators include network switchover recovery time, node failure switchover time, availability after policy retrieval failure, extension anomaly recovery rate, and client crash rate after long-term operation. The testing methods include simulating Wi-Fi / wired network switching, system hibernation recovery, proxy node unavailability, server unreachability, policy update failure, local proxy process restart, and SystemExtension communication interruption. Each type of anomaly is tested at least 30 times, and the recovery time, number of failures, and final handling actions are recorded. Compared with older solutions without anomaly degradation mechanisms, traditional VPN clients, and system proxy-only solutions, this application can automatically switch to a backup node when a node is unavailable, use the most recently valid policy when a policy is unreachable, and enter the local queue when log reporting failures occur; the policy recovery time after network switchover can be controlled within the range of 1 to 5 seconds; a switchover can be triggered after 2 to 5 consecutive node failures; and local policy execution can be maintained even when the server is temporarily unreachable, avoiding complete policy failure or traffic loss.

[0081] Secondly, this embodiment also provides a terminal device, including a memory and a processor. The operating system of the processor includes a local traffic interception module and a client main process. The memory stores a computer program, and when the computer program is executed by the processor, it implements the network traffic control method as described in any of the above embodiments.

[0082] like Figure 4 As shown, the terminal device may include components such as a processor 401 with one or more processing cores, a memory 402 with one or more computer-readable storage media, a power supply 403, and an input unit 404. Those skilled in the art will understand that... Figure 4 The structure of the terminal device shown does not constitute a limitation on the terminal device. It may include more or fewer components than shown, or combine certain components, or have different component arrangements. The processor 401 is the control center of the terminal device, connecting various parts of the terminal device through various interfaces and lines. It performs various functions and processes data by running or executing software programs and / or modules stored in the memory 402, and by calling data stored in the memory 402, thereby providing overall monitoring of the terminal device. Optionally, the processor 401 may include one or more processing cores; preferably, the processor 401 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and computer programs, and the modem processor mainly handles wireless communication. It is understood that the modem processor may not be integrated into the processor 401.

[0083] The memory 402 can be used to store software programs and modules. The processor 401 executes various functional applications and data processing by running the software programs and modules stored in the memory 402. The memory 402 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, computer programs required for at least one function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the server, etc. In addition, the memory 402 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device. Accordingly, the memory 402 may also include a memory controller to provide the processor 401 with access to the memory 402.

[0084] The terminal device also includes a power supply 403 that supplies power to the various components. Preferably, the power supply 403 can be logically connected to the processor 401 through a power management system, thereby enabling functions such as charging, discharging, and power consumption management through the power management system. The power supply 403 may also include one or more DC or AC power supplies, recharging systems, power fault detection circuits, power converters or inverters, power status indicators, and other arbitrary components.

[0085] The terminal device may also include an input unit 404, which can be used to receive input digital or character information, and generate keyboard, mouse, joystick, optical or trackball signal inputs related to user settings and function control.

[0086] Although not shown, the terminal device may also include a display unit, etc., which will not be described in detail here. Specifically, in this embodiment, when the terminal device is a model training terminal device, the processor 401 in the terminal device will load the executable files corresponding to the processes of one or more computer programs into the memory 402 according to the following instructions, and the processor 401 will run the computer programs stored in the memory 402 to execute the network traffic control method as described in any of the above embodiments.

[0087] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0088] The above provides a detailed description of a network traffic control method and terminal device provided in the embodiments of this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A network traffic control method, characterized in that, Applied to terminal devices, the operating system of the terminal devices includes a local traffic interception module and a client main process, and the network traffic control method includes: When the client main process starts, a local communication channel is established between the client main process and the local traffic interception module; The local traffic interception module captures network connections initiated by the business applications of the terminal device, generates traffic events, and constructs a connection context based on the traffic events. The connection context includes at least one of the following: application identifier field, user identity identifier field, target address field, target port field, domain name field, protocol type field, and network type field. The client main process obtains a policy rule set from the server platform and matches the target policy rule corresponding to the connection context from the policy rule set. The policy rule set includes multiple preset policy rules, and the preset policy rule includes at least one of the following: application rule field, user rule field, target rule field, protocol rule field, network rule field, processing action field, and policy version field. The client main process controls the traffic events according to the target processing action corresponding to the target processing action field in the target policy rule.

2. The network traffic control method according to claim 1, characterized in that, The operating system also includes multiple traffic processing modules, including a local forwarding module and an audit log module; The step of controlling the traffic event through the client main process according to the target processing action field in the target policy rule includes: When the target processing action is a forwarding action, the traffic event is forwarded to the local forwarding module through the client main process; The traffic event is forwarded by the local forwarding module to access the target network resource corresponding to the traffic event; When the target processing action is an audit-only action or a blocking action, the traffic event is forwarded to the audit log module through the client main process; The traffic events are audited through the audit log module to generate a first audit record; When the target processing action is a direct connection action, the target network resources are accessed through the client main process.

3. The network traffic control method according to claim 2, characterized in that, The step of forwarding the traffic event through the local forwarding module to access the target network resource corresponding to the traffic event includes: The local forwarding module determines available nodes from a pre-set list of proxy nodes based on node status information. The node status information includes the proxy node's node latency, number of connection failures, number of consecutive successes, load, and availability. Based on the node status information of the available nodes, determine the node latency index, node failure rate index, and node load index; Based on the node latency metric, the node failure rate metric, the node load metric, the policy penalty metric corresponding to the target policy rule, and their respective metric weights, a comprehensive node metric is obtained. Based on the comprehensive node indicators, the target node is determined from the available nodes; The traffic event is forwarded to the target node so that the target network resources can be accessed through the target node.

4. The network traffic control method according to claim 1, characterized in that, The connection context also includes a process identifier field, a code signing status field, and a connection capture time field; The step of capturing network connections initiated by the service applications of the terminal device through the local traffic interception module, generating traffic events, and constructing a connection context based on the traffic events includes: The network connection is captured by the local traffic interception module, and the five-tuple information of the network connection is extracted; the five-tuple information includes local address, local port, remote address, remote port and transport protocol type; Based on the quintuple information, the process identifier can be retrieved; Based on the process identifier, the application identifier, user identity identifier, and code signing status can be retrieved. Query the outbound network interface card interface of the network connection to obtain the network type; Query the cached records of the Domain Name System; When the cache record contains a domain name corresponding to the remote address, the domain name is retrieved and the traffic event is generated. Use the remote address as the target address and the remote port as the target port; The connection context is constructed by combining the process identifier, the application identifier, the user identity identifier, the target address, the target port, the domain name, the transport protocol type, the network type, the code signing status, and the connection capture time that captured the network connection. When the cache record does not contain the domain name corresponding to the remote address, the process identifier, the application identifier, the user identity identifier, the target address, the target port, the transport protocol type, the network type, the code signing status, and the connection capture time that captured the network connection are combined, and the domain name field is set to an empty placeholder to obtain a temporary connection context; The cached record is queried again, and if the domain name exists in the cached record, the traffic event is generated, the domain name field in the temporary connection context is updated to the domain name, and the connection context is obtained.

5. The network traffic control method according to claim 1, characterized in that, The step of matching the target policy rule corresponding to the connection context from the policy rule set includes: For each preset policy rule, when the application rule field matches the application identifier field, the user rule field matches the user identity identifier field, the target rule field matches the target address field, the domain name field, and the target port field, the protocol rule field matches the protocol type field, and the network rule field matches the network type field, the preset policy rule is used as a candidate policy rule to obtain a candidate policy rule set; the candidate policy rule set includes multiple candidate policy rules. The target strategy rule is determined from multiple candidate strategy rules according to the preset priority order of each field in the candidate strategy rule.

6. The network traffic control method according to claim 5, characterized in that, Also includes: For each candidate policy rule, the client main process determines the application risk indicator based on the application rule field, the user permission risk indicator based on the user rule field, the target risk indicator based on the target rule field, the network risk indicator based on the network rule field, and the protocol risk indicator based on the protocol rule field. The client main process obtains the connection risk index of the candidate policy rule based on the application risk index, the user permission risk index, the target risk index, the network risk index, the protocol risk index, and their respective risk weights. The client main process determines the target policy rule from multiple candidate policy rules based on the connection risk indicators.

7. The network traffic control method according to claim 1, characterized in that, The step of controlling the traffic event through the client main process according to the target processing action corresponding to the target processing action field in the target policy rule includes: The client's main process obtains the update time and current time of the target policy rule. When the time difference between the current time and the update time is less than a preset time difference, the client main process controls the traffic event according to the target processing action; When the time difference is greater than or equal to the preset time difference, the flow control function is paused in the preset security mode, and a policy update request is sent to the server platform so that the server platform returns the updated target policy rule according to the policy version identifier carried in the policy update request. The client main process controls the traffic events according to the latest processing action corresponding to the latest processing action field in the updated target policy rules; The network traffic control method further includes: When the target policy rule update fails or the client main process fails to obtain the policy rule set, the client main process obtains the locally cached local policy rules to control the traffic event.

8. The network traffic control method according to claim 1, characterized in that, Establishing a local communication channel between the client main process and the local traffic interception module includes: The client's main process determines whether the local traffic interception module is authorized. When the local traffic interception module is unauthorized, it enters a preset security mode to suspend the traffic control function. When the local traffic interception module is authorized, a communication channel is established with the local system.

9. The network traffic control method according to any one of claims 1 to 8, characterized in that, The server platform is a local service platform or a cloud service platform; after the client main process controls the traffic event according to the target processing action corresponding to the target processing action field in the target policy rule, the network traffic control method further includes: The client main process generates a second audit record based on the processing of the traffic event, and reports the second audit record to the server platform. When the server platform returns a confirmation response, the second audit record is marked as reported. When the server platform does not return the confirmation response, the second audit record is written to the local encrypted reporting queue, and the reporting status of the second audit record is marked as pending retry. According to the preset reporting retry interval, the second audit record is periodically retrieved from the local encrypted reporting queue and re-reported to the server platform.

10. A terminal device, characterized in that, The device includes a memory and a processor. The operating system of the processor includes a local traffic interception module and a client main process. The memory stores a computer program, which, when executed by the processor, implements the network traffic control method as described in any one of claims 1-9.

Images