Traffic compliance detection method and device, computer device, storage medium and program product

Abstract

This application relates to a traffic compliance detection method, apparatus, computer equipment, storage medium, and program product. The method includes: an Internet Data Center responding to a collaborative tracing request for suspicious encrypted traffic data sent by a regulatory device; determining the target user device corresponding to the suspicious encrypted traffic data based on the outbound public network address and time window of the suspicious encrypted traffic data carried in the collaborative tracing request; and sending instruction information to the target user device; the target user device receiving the instruction information; and decrypting the encrypted traffic data locally on the target user device according to the instruction information and a preset encryption key to obtain the plaintext traffic data corresponding to the encrypted traffic data; and forwarding the plaintext traffic data to the regulatory device through the Internet Data Center, so that the regulatory device can perform compliance detection on the plaintext traffic data, improving the efficiency and accuracy of tracing violations, avoiding the risk of key abuse, and thus improving the security of compliance checks.

Description

Technical Field

[0001] This application relates to the field of network and data security technology, and in particular to a traffic compliance detection method, apparatus, computer equipment, storage medium and program product. Background Technology

[0002] With the acceleration of global digitalization, cross-border data flows are becoming increasingly frequent. To protect information security, a strict regulatory system for data export compliance has been established. Regulatory agencies need to monitor data flows at data export checkpoints to identify whether there are unauthorized, out-of-scope, or sensitive data export activities.

[0003] In related technologies, internet services typically use encryption protocols such as TLS / SSL to encrypt data, so that the majority of traffic collected by regulatory agencies is encrypted. When conducting traffic monitoring, cross-border communication companies need to submit their encryption keys or certificate private keys to regulatory agencies so that the traffic can be fully decrypted and restored before content compliance checks can be performed.

[0004] However, the above methods pose significant security risks. Summary of the Invention

[0005] Therefore, it is necessary to provide a traffic compliance detection method, device, computer equipment, storage medium, and program product to address the aforementioned technical issues.

[0006] Firstly, this application provides a traffic compliance detection method applied to Internet data centers, including:

[0007] In response to a collaborative tracing request for suspicious encrypted traffic data sent by a monitoring device, the target user device corresponding to the suspicious encrypted traffic data is determined based on the outbound public network address and time window of the suspicious encrypted traffic data carried in the collaborative tracing request.

[0008] Send an instruction message to the target user equipment and obtain the plaintext traffic data sent by the target user equipment based on the instruction message; the instruction message is used to instruct the target user equipment to decrypt the encrypted traffic data on the target user equipment's local side according to the preset encryption key to obtain the plaintext traffic data corresponding to the encrypted traffic data;

[0009] Plaintext traffic data is transmitted to the monitoring equipment; the plaintext traffic data is used by the monitoring equipment for compliance testing.

[0010] In one embodiment, the target user device corresponding to the suspicious encrypted traffic data is determined based on the outbound public network address and time window of the suspicious encrypted traffic data carried in the collaborative tracing request, including:

[0011] Retrieve the network address translation log corresponding to the time window;

[0012] Based on the timestamps and network address translation logs corresponding to the suspicious encrypted traffic data within the time window, the outbound public network addresses are converted to internal network server addresses;

[0013] Based on the internal network server address, identify the target user device corresponding to the suspicious encrypted traffic data.

[0014] In one embodiment, determining the target user device corresponding to suspicious encrypted traffic data based on the intranet server address includes:

[0015] Query the business access logs of suspicious encrypted traffic corresponding to the internal network server address;

[0016] Identify the target user devices corresponding to suspicious encrypted traffic based on business access logs.

[0017] Secondly, this application also provides a traffic compliance detection method applied to a target user device, including:

[0018] Receive instruction information sent by the Internet Data Center;

[0019] Based on the instruction information, the encrypted traffic data on the target user device is decrypted according to the preset encryption key to obtain the plaintext traffic data corresponding to the encrypted traffic data;

[0020] Plaintext traffic data is sent to the Internet Data Center for compliance testing.

[0021] In one embodiment, based on the instruction information, the encrypted traffic data locally on the target user device is decrypted according to a preset encryption key to obtain the plaintext traffic data corresponding to the encrypted traffic data, including:

[0022] Obtain encrypted traffic data locally from the target user device based on the target session information in the instruction message;

[0023] The encrypted traffic data on the target user's device is decrypted using a preset encryption key to obtain plaintext traffic data.

[0024] Thirdly, this application also provides a method for traffic compliance detection applied to regulatory devices, including:

[0025] The collaborative tracing request for suspicious encrypted traffic data is sent to the Internet Data Center. The collaborative tracing request includes the outbound public network address and time window of the suspicious encrypted traffic data. The collaborative tracing request is used to instruct the Internet Data Center to determine the target user device corresponding to the suspicious encrypted traffic data based on the outbound public network address and time window of the suspicious encrypted traffic data, and to send instruction information to the target user device.

[0026] Receive plaintext traffic data from the target user device sent by the Internet Data Center; the plaintext traffic data is obtained by the target user device decrypting the encrypted traffic data on its local machine according to a preset encryption key under the instruction of the Internet Data Center.

[0027] Perform compliance checks on plaintext traffic data to obtain compliance check results.

[0028] In one embodiment, before sending a collaborative attribution request for suspicious encrypted traffic data to an Internet data center, the method further includes:

[0029] Initial encrypted traffic data is obtained by collecting data from devices installed at exit checkpoints;

[0030] Perform a preliminary compliance check on the initial encrypted traffic data to obtain preliminary compliance check results;

[0031] Initial encrypted traffic whose preliminary compliance test results meet the preset suspicious conditions is identified as suspicious encrypted traffic.

[0032] Fourthly, this application also provides a traffic compliance detection device, including:

[0033] The first determination module is used to respond to the collaborative tracing request for suspicious encrypted traffic data sent by the regulatory device, and determine the target user device corresponding to the suspicious encrypted traffic data based on the outbound public network address and time window of the suspicious encrypted traffic data carried in the collaborative tracing request.

[0034] The first acquisition module is used to send an instruction message to the target user equipment and acquire the plaintext traffic data sent by the target user equipment based on the instruction message; the instruction message is used to instruct the target user equipment to decrypt the encrypted traffic data on the target user equipment local according to the preset encryption key to obtain the plaintext traffic data corresponding to the encrypted traffic data.

[0035] The first transmission module is used to transmit plaintext traffic data to the monitoring equipment; the plaintext traffic data is used by the monitoring equipment for compliance testing.

[0036] Fifthly, this application also provides a traffic compliance detection device, including:

[0037] The first receiving module is used to receive instruction information sent by the Internet Data Center;

[0038] The decryption module is used to decrypt the encrypted traffic data on the target user device's local device based on the instruction information and according to the preset encryption key, so as to obtain the plaintext traffic data corresponding to the encrypted traffic data.

[0039] The second transmission module is used to send plaintext traffic data to the Internet data center. The plaintext traffic data is used for compliance testing.

[0040] Sixthly, this application also provides a traffic compliance detection device, including:

[0041] The third transmission module is used to send a collaborative tracing request for suspicious encrypted traffic data to the Internet Data Center. The collaborative tracing request includes the outbound public network address and time window of the suspicious encrypted traffic data. The collaborative tracing request is used to instruct the Internet Data Center to determine the target user device corresponding to the suspicious encrypted traffic data based on the outbound public network address and time window of the suspicious encrypted traffic data, and to send instruction information to the target user device.

[0042] The second receiving module is used to receive plaintext traffic data of the target user device sent by the Internet Data Center; the plaintext traffic data is obtained by the target user device decrypting the encrypted traffic data on its local device according to a preset encryption key under the instruction of the Internet Data Center.

[0043] The compliance detection module is used to perform compliance checks on plaintext traffic data to obtain compliance detection results.

[0044] Seventhly, this application also provides a traffic compliance detection system, which includes: an Internet data center, target user equipment, and monitoring equipment;

[0045] The Internet data center is used to perform the steps of any of the methods in the first aspect above;

[0046] The target user equipment is used to perform the steps of any of the methods in the second aspect above;

[0047] The monitoring device is used to perform the steps of any of the methods in the third aspect above.

[0048] Eighthly, this application also provides a computer device including a memory and a processor, the memory storing a computer program, the processor executing the computer program to implement the steps of any of the above methods.

[0049] Ninthly, this application also provides a computer-readable storage medium having a computer program stored thereon that, when executed by a processor, implements the steps of any of the above methods.

[0050] In a tenth aspect, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of any of the above methods.

[0051] The aforementioned traffic compliance detection method, device, computer equipment, storage medium, and program products allow the regulatory equipment to send a collaborative tracing request for suspicious encrypted traffic data to the Internet Data Center. In response to the collaborative tracing request, the Internet Data Center determines the target user device corresponding to the suspicious encrypted traffic data based on the outbound public network address and time window of the suspicious encrypted traffic data carried in the request, and sends instruction information to the target user device. The target user device receives the instruction information from the Internet Data Center, decrypts the encrypted traffic data locally using a preset encryption key, obtains the plaintext traffic data corresponding to the encrypted traffic data, and forwards the plaintext traffic data to the regulatory equipment through the Internet Data Center, enabling the regulatory equipment to perform compliance detection on the plaintext traffic data and obtain a compliance detection result. In this embodiment, upon discovering highly suspicious behavior, i.e., obtaining suspicious encrypted traffic data, a targeted verification process is initiated: firstly, using the outbound public network address and time window as clues, the specific target user device is located through the Internet Data Center, improving the efficiency and accuracy of tracing violations. In addition, plaintext data is processed locally by the user equipment using its own key, and the regulatory equipment does not hold general decryption rights, which avoids the risk of key abuse and prevents privacy leaks caused by key abuse, thereby improving the security of compliance checks. Attached Figure Description

[0052] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0053] Figure 1 This is an application environment diagram of a traffic compliance detection method provided in an embodiment of this application;

[0054] Figure 2 This is a flowchart illustrating a traffic compliance detection method provided in an embodiment of this application;

[0055] Figure 3 This is a flowchart illustrating a method for determining a target user equipment provided in an embodiment of this application;

[0056] Figure 4 This is a flowchart illustrating another method for determining a target user equipment provided in an embodiment of this application;

[0057] Figure 5 This is a flowchart illustrating another traffic compliance detection method provided in an embodiment of this application;

[0058] Figure 6 This is a flowchart illustrating a method for obtaining plaintext traffic data provided in an embodiment of this application;

[0059] Figure 7 This is a flowchart illustrating another traffic compliance detection method provided in the embodiments of this application;

[0060] Figure 8 This is a flowchart illustrating a method for determining suspicious encrypted traffic provided in an embodiment of this application;

[0061] Figure 9 This is a flowchart illustrating a method for compliant tracing of encrypted traffic data provided in an embodiment of this application;

[0062] Figure 10 This is a structural block diagram of a traffic compliance detection device provided in an embodiment of this application;

[0063] Figure 11 This is a structural block diagram of another traffic compliance detection device provided in the embodiments of this application;

[0064] Figure 12 This is a structural block diagram of another traffic compliance detection device provided in the embodiments of this application;

[0065] Figure 13 This is an internal structural diagram of a computer device provided in an embodiment of this application. Detailed Implementation

[0066] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0067] It should be noted that the terms "first," "second," etc., used in this application can be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from the second element. The terms "comprising" and "having," and any variations thereof, used in this application, are intended to cover non-exclusive inclusion. The term "multiple" used in this application refers to two or more. The term "and / or" used in this application refers to one of the embodiments, or any combination of multiple embodiments.

[0068] With the acceleration of global digitalization, cross-border data flows are becoming increasingly frequent. To protect information security, a strict regulatory system for data export compliance has been established. Regulatory agencies need to monitor data flows at data export checkpoints to identify whether there are unauthorized, out-of-scope, or sensitive data export activities.

[0069] In related technologies, internet services typically use encryption protocols such as TLS / SSL to encrypt data, so that the majority of traffic collected by regulatory agencies is encrypted. When conducting traffic monitoring, cross-border communication companies need to submit their encryption keys or certificate private keys to regulatory agencies so that the traffic can be fully decrypted and restored before content compliance checks can be performed.

[0070] However, the above methods pose significant security risks.

[0071] The traffic compliance detection method provided in this application embodiment can be applied to, for example... Figure 1 The application environment is illustrated. The Internet Data Center (IDC) communicates with both the regulatory equipment and the user equipment. The regulatory equipment can acquire traffic data flowing through the Internet data exit points and perform compliance checks. User equipment can be, but is not limited to, various personal computers, laptops, smartphones, tablets, drones, low-altitude aircraft, IoT devices, and portable wearable devices. IoT devices can include smart speakers, smart TVs, smart air conditioners, smart in-vehicle devices, and projection devices. Portable wearable devices can include smartwatches, smart bracelets, and head-mounted displays. Head-mounted displays can be virtual reality (VR) devices, augmented reality (AR) devices, and smart glasses. The regulatory equipment can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.

[0072] In one exemplary embodiment, such as Figure 2 As shown, Figure 2 This is a flowchart illustrating a traffic compliance detection method provided in an embodiment of this application, applied to... Figure 1 Taking the Internet data center in China as an example, this method includes the following steps:

[0073] S201, in response to a collaborative tracing request for suspicious encrypted traffic data sent by the regulatory device, determines the target user device corresponding to the suspicious encrypted traffic data based on the outbound public network address and time window of the suspicious encrypted traffic data carried in the collaborative tracing request.

[0074] In this embodiment, a data collection device can be set up at the Internet data exit point. The monitoring device can obtain the initial traffic data flowing through the Internet data exit point through the data collection device, and then analyze the metadata of the initial traffic data to filter out suspicious encrypted traffic data from the initial traffic data, and record the five-tuple information and timestamp of the suspicious encrypted traffic data.

[0075] The metadata of the initial traffic data may include, for example, the destination Internet Protocol address (IP), the communication protocol, the traffic size and pattern, etc. The 5-tuple information includes the source IP, destination IP, source port, destination port, and communication protocol.

[0076] Optionally, after obtaining suspicious encrypted traffic data, the monitoring device can generate a collaborative tracing request based on the outbound public network address and time window of the suspicious encrypted traffic data, and send the collaborative tracing request to the Internet Data Center (IDC).

[0077] The outbound public IP address is captured and analyzed by the monitoring equipment at the data outbound checkpoint and then marked. For example, if the monitoring equipment detects TCP traffic from a high-risk overseas region to the target IP between 2:00 AM and 3:00 AM on a certain day, the recorded outbound public IP address will be 203.0.113.100, and the time window will be from 2:00:00 AM to 3:00:00 AM on that day.

[0078] In this embodiment, after receiving the collaborative tracing request, the IDC can map the outbound public network address and time window to the user entity of the service deployed in the IDC based on the outbound public network address and time window in the collaborative tracing request, combined with the log information related to the outbound public network address in the IDC within the time window, that is, determine the target user device and specific business operation session corresponding to the suspicious encrypted traffic data.

[0079] S202, send an instruction message to the target user equipment and obtain the plaintext traffic data sent by the target user equipment based on the instruction message.

[0080] The instruction information is used to instruct the target user equipment to decrypt the encrypted traffic data on its local device according to the preset encryption key, so as to obtain the plaintext traffic data corresponding to the encrypted traffic data.

[0081] In this embodiment, after the target user equipment (User Equipment) is located in the Internet Data Center (IDC), an instruction message for the target User Equipment (User Equipment) can be generated and sent to the User Equipment. Upon receiving the instruction message, the User Equipment can extract the encrypted traffic data of the service operation session within the corresponding time period from its local full traffic log or historical data backup. Then, the User Equipment can decrypt the extracted encrypted traffic data using the locally stored encryption key corresponding to the time window to obtain plaintext traffic data, which is then sent to the IDC.

[0082] Optionally, the target user equipment can perform integrity verification on the decrypted plaintext traffic data and the log information used for verification. After the verification is passed, the plaintext traffic data and the log information used for verification are encapsulated according to a preset format and fed back to the IDC through a secure channel. The log information used for verification may include, for example, NAT translation logs within a time window, service access logs, and the TLS certificate serial number or session identifier used during decryption.

[0083] S203 transmits plaintext traffic data to the monitoring equipment.

[0084] Plaintext traffic data is used for compliance testing of monitoring equipment.

[0085] Optionally, after receiving plaintext traffic data from the target user device, the IDC can forward the plaintext traffic data to the monitoring device. Upon receiving the plaintext traffic data, the monitoring device can perform integrity verification on the plaintext traffic data. After successful verification, it can perform compliance testing on the plaintext traffic data and obtain the compliance test result.

[0086] It should be noted that during the transmission of the aforementioned plaintext traffic data, the IDC, as a neutral data relay party, is only responsible for securely receiving and temporarily storing the plaintext traffic data, and does not parse the content of the plaintext traffic data, thereby ensuring the confidentiality of customer data during the transmission process.

[0087] For example, the integrity verification of plaintext traffic data can be implemented based on hash values, that is, verifying whether the hash value attached to the plaintext traffic data received by the monitoring device is consistent with the hash value calculated from the plaintext traffic data after being decrypted by the target user device, so as to ensure the integrity of the plaintext traffic data during transmission.

[0088] In this embodiment, the monitoring device sends a collaborative tracing request for suspicious encrypted traffic data to the Internet Data Center. Responding to the request, the Internet Data Center determines the target user device corresponding to the suspicious encrypted traffic data based on the outbound public network address and time window of the suspicious encrypted traffic data carried in the request, and sends an instruction to the target user device. The target user device receives the instruction from the Internet Data Center, decrypts the encrypted traffic data locally using a preset encryption key, obtains the plaintext traffic data corresponding to the encrypted traffic data, and forwards the plaintext traffic data to the monitoring device through the Internet Data Center, enabling the monitoring device to perform compliance testing on the plaintext traffic data and obtain a compliance test result. In this embodiment, upon discovering highly suspicious behavior, i.e., obtaining suspicious encrypted traffic data, a targeted verification process is initiated: first, using the outbound public network address and time window as clues, the specific target user device is located through the Internet Data Center, improving the efficiency and accuracy of tracing violations. In addition, plaintext data is processed locally by the user equipment using its own key, and the regulatory equipment does not hold general decryption rights, which avoids the risk of key abuse and prevents privacy leaks caused by key abuse, thereby improving the security of compliance checks.

[0089] Reference Figure 3 , Figure 3 This is a flowchart illustrating a method for determining a target user equipment (User Equipment) according to an embodiment of this application. This embodiment relates to a possible implementation of how to determine the target User Equipment corresponding to suspicious encrypted traffic data based on the outbound public network address and time window of the suspicious encrypted traffic data carried in a collaborative tracing request. Based on the above embodiment, step S201 includes the following steps:

[0090] S301, retrieve the network address translation log corresponding to the time window.

[0091] In this embodiment, after parsing the time window in the collaborative tracing request from the Internet Data Center, the NAT translation log corresponding to that time period can be queried from the full network address (NAT) translation log of the IDC network layer based on the time window.

[0092] For example, NAT translation logs may include fields such as public IP address, public port, private IP address, private port, translation protocol, and session start and end times.

[0093] S302, based on the timestamps and network address translation logs corresponding to the suspicious encrypted traffic data in the time window, convert the outbound public network address to the internal network server address.

[0094] Optionally, the collaborative tracing request also includes the precise timestamp corresponding to the suspicious encrypted traffic data. Since the NAT translation log corresponding to a time window may contain multiple NAT session records, the NAT session record corresponding to the suspicious encrypted traffic data can be filtered from multiple NAT session records based on the specific timestamp. Then, the outbound public network address is mapped to the internal network server address based on this NAT session record.

[0095] For example, if the NAT translation log is checked and it is found that at 02:15:30 on a certain day, the internal IP 10.1.2.101 was mapped to port 443 of the public IP 203.0.113.100 through NAT, then the public IP 203.0.113.100 can be mapped to the internal server address 10.1.2.101.

[0096] S303 determines the target user device corresponding to suspicious encrypted traffic data based on the internal network server address.

[0097] In this embodiment, after obtaining the internal network server address based on the mapping of the outbound public network address, the internal network server address can be further used as a query index to query the target account corresponding to the internal network server address and obtain the relevant business operation session among multiple user accounts managed by the IDC. The user device corresponding to the target account is the aforementioned target user device.

[0098] For example, if a query finds that the internal network IP 10.1.2.101 belongs to a cloud server of user A, then the user device corresponding to user A is identified as the target user device.

[0099] In this embodiment, the network address translation log corresponding to the time window is obtained; based on the timestamp and network address translation log corresponding to the suspicious encrypted traffic data in the time window, the outbound public network address is converted to the internal network server address; based on the internal network server address, the target user device corresponding to the suspicious encrypted traffic data is determined. Thus, by utilizing the NAT translation log within the time window in the IDC, combined with the accurate timestamp corresponding to the suspicious encrypted traffic data, the outbound public network IP is mapped to a unique internal network server address, thereby determining the accurate user range. This lays the foundation for accurately locating the target account and business session in the future, and further improves the accuracy and security of traffic compliance detection.

[0100] Reference Figure 4 , Figure 4 This is a flowchart illustrating another method for determining a target user equipment (User Equipment) provided in this application embodiment. This embodiment relates to a possible implementation of how to determine the target User Equipment corresponding to suspicious encrypted traffic data based on the address of an intranet server. Based on the above embodiment, step S303 includes the following steps:

[0101] S401, query the business access logs of suspicious encrypted traffic corresponding to the internal network server address.

[0102] For example, the business access log stream may include web server access logs, database access logs, API gateway logs, etc.

[0103] In this embodiment, after obtaining the intranet server address, the application layer service access logs related to that intranet server address within a time window can be further queried. These service access logs are generated by various application services deployed by the user on the IDC platform.

[0104] S402, determine the target user device corresponding to the suspicious encrypted traffic based on the business access log.

[0105] In this embodiment, the IDC can parse key fields in the business access logs to determine the business information corresponding to the suspicious encrypted traffic, and then determine the responsible party, i.e., the target account, based on the business information, and then determine the target user device based on the target account.

[0106] Key fields in the business access logs may include Uniform Resource Identifiers (URIs), request methods (GET / POST), the amount of data transmitted, and the specific parameters of the API call. For example, if IDC discovers that internal IP address 10.1.2.101 initiated a database export request to an external IP address at 02:15:30, and the size of the data packets recorded in the logs matches the size of suspicious encrypted traffic detected by the monitoring equipment, then this session can be identified as the suspicious behavior that triggered the monitoring alarm. Account A, which initiated the database export request, is the target account, and the user device corresponding to account A is the target user device.

[0107] In this embodiment, the business access logs of suspicious encrypted traffic corresponding to the intranet server address are queried; the target user device corresponding to the suspicious encrypted traffic is determined based on the business access logs. This can associate the intranet server address with the target account, accurately locate the suspected violator corresponding to the suspicious encrypted traffic, and further improve the accuracy and security of traffic compliance detection.

[0108] In one exemplary embodiment, such as Figure 5 As shown, Figure 5 This is a flowchart illustrating another traffic compliance detection method provided in an embodiment of this application, applied to... Figure 1 Taking a user device as an example, the method includes the following steps:

[0109] S501 receives instruction information sent by the Internet Data Center.

[0110] S502, based on the instruction information, decrypts the encrypted traffic data on the target user device's local device according to the preset encryption key to obtain the plaintext traffic data corresponding to the encrypted traffic data.

[0111] S503 sends plaintext traffic data to the Internet Data Center for compliance testing.

[0112] The solution provided by the traffic compliance detection method applied to target user devices is similar to the solution described in the traffic compliance detection method applied to Internet data centers. Therefore, the specific limitations in the embodiments provided above can be found in the limitations of the traffic compliance detection method applied to Internet data centers above, and will not be repeated here.

[0113] Reference Figure 6 , Figure 6 This is a flowchart illustrating a method for obtaining plaintext traffic data according to an embodiment of this application. This embodiment relates to a possible implementation of how to decrypt encrypted traffic data locally on a target user device based on indication information and a preset encryption key to obtain the plaintext traffic data corresponding to the encrypted traffic data. Based on the above embodiment, S502 includes the following steps:

[0114] S601, based on the target session information in the instruction information, obtains encrypted traffic data locally from the target user device.

[0115] In this embodiment, the target user equipment can parse the target session information from the indication information and locate the specific service operation session based on the target session information. Then, based on the timestamp of the encrypted traffic data in the indication information, the encrypted traffic data is extracted from the full traffic data corresponding to the specific service operation session stored locally on the target user equipment.

[0116] S602 decrypts the encrypted traffic data on the target user device's local device based on a preset encryption key to obtain plaintext traffic data.

[0117] In this embodiment, the target user equipment can obtain a preset encryption key based on the time window corresponding to the encrypted traffic data, and then decrypt the extracted encrypted traffic data based on the encryption key to obtain plaintext traffic data, and then send the plaintext traffic data back to the IDC through a secure channel.

[0118] In this embodiment, encrypted traffic data is obtained locally from the target user device based on the target session information in the instruction information. The encrypted traffic data is then decrypted using a preset encryption key to obtain plaintext traffic data. By using the target session identifier carried in the instruction information, encrypted traffic data corresponding to suspicious outbound behavior is directly retrieved from the target user device's local storage, thus preventing the leakage of irrelevant business data. Furthermore, the decryption process relies entirely on the preset encryption key held by the target user device itself; neither the monitoring equipment nor the data center accesses the key, avoiding the risk of key misuse and further improving the accuracy and security of traffic compliance detection.

[0119] In one exemplary embodiment, such as Figure 7 As shown, Figure 7 This is a flowchart illustrating another traffic compliance detection method provided in this application embodiment, applied to... Figure 1 Taking the monitoring equipment in the middle as an example, the method includes the following steps:

[0120] S701 sends a collaborative tracing request for suspicious encrypted traffic data to the Internet Data Center.

[0121] The collaborative tracing request includes the outbound public network address and time window of the suspicious encrypted traffic data; the collaborative tracing request is used to instruct the Internet Data Center to determine the target user device corresponding to the suspicious encrypted traffic data based on the outbound public network address and time window of the suspicious encrypted traffic data, and to send instruction information to the target user device.

[0122] S702 receives plaintext traffic data of the target user device sent by the Internet Data Center.

[0123] The plaintext traffic data is obtained by the target user device decrypting the encrypted traffic data on its local machine using a preset encryption key, under the instruction of the Internet data center.

[0124] S703 performs compliance checks on plaintext traffic data to obtain compliance check results.

[0125] The solution provided by the traffic compliance detection method applied to regulatory equipment is similar to the solution described in the traffic compliance detection method applied to Internet data centers. Therefore, the specific limitations in the embodiments provided above can be found in the limitations of the traffic compliance detection method applied to Internet data centers above, and will not be repeated here.

[0126] Reference Figure 8 , Figure 8This is a flowchart illustrating a method for determining suspicious encrypted traffic according to an embodiment of this application. Based on the above embodiment, the method further includes the following steps:

[0127] S801 acquires initial encrypted traffic data through data collection devices set up at exit checkpoints.

[0128] In this embodiment, a data collection device can be set up at the Internet data exit checkpoint node, and the monitoring device can obtain the initial traffic data flowing through the Internet data exit checkpoint node through the data collection device.

[0129] S802 performs a preliminary compliance check on the initial encrypted traffic data and obtains the preliminary compliance check results.

[0130] Optionally, after obtaining the initial encrypted traffic data, a preliminary compliance check can be performed on it: First, the geographic information of the target IP of the initial encrypted traffic data is compared with a pre-defined list of high-risk countries and regions. Simultaneously, based on a pre-trained abnormal behavior model, the traffic size, duration, and packet frequency of the initial encrypted traffic data are analyzed to identify possible abnormal data leakage behaviors, yielding abnormal behavior analysis results. Furthermore, the target IP, domain name, and other information of the initial encrypted traffic data are compared with threat intelligence to determine whether the initial encrypted traffic data is associated with known malicious servers or data recipients. Finally, combined with the above abnormal behavior analysis results, a preliminary compliance check result is obtained.

[0131] S803 defines initial encrypted traffic that meets preset suspicious conditions in the preliminary compliance test results as suspicious encrypted traffic.

[0132] In this embodiment, a preset suspicious condition can be set. If the preliminary compliance detection result corresponding to the initial encrypted traffic meets the preset suspicious condition, the initial encrypted traffic can be identified as suspicious encrypted traffic.

[0133] For example, if the preset list of high-risk countries and regions contains the target IP geographic information of the initial encrypted traffic data, or if any one of the traffic size, duration, or packet frequency of the initial encrypted traffic data exceeds the corresponding preset security threshold, or if the initial encrypted traffic data is associated with a known malicious server or data recipient, then it can be determined that the preliminary compliance detection result corresponding to the initial encrypted traffic meets the preset suspicious conditions.

[0134] In this embodiment, initial encrypted traffic data is acquired by a data collection device set up at the exit checkpoint; preliminary compliance checks are performed on the initial encrypted traffic data to obtain preliminary compliance check results; initial encrypted traffic that meets preset suspicious conditions is identified as suspicious encrypted traffic, thereby achieving initial screening of suspicious targets. Based on non-decryption methods such as traffic metadata, threat intelligence, and abnormal behavior models, preliminary compliance checks are completed without touching any encrypted content. This approach can quickly locate suspicious behavior while avoiding encryption of all cross-border data, further improving the efficiency and security of traffic compliance checks.

[0135] The following will use a complete embodiment to illustrate... Figure 9 The overall implementation logic and beneficial effects of the traffic compliance detection method proposed in this application are explained below:

[0136] First, a probe deployed at the data outbound gateway by the monitoring equipment captures initial encrypted traffic data. After preliminary compliance testing determines it to be suspicious, a collaborative tracing request is generated, containing the public IP address 203.0.113.100 and a time window for the suspicious encrypted traffic data. This request is sent to the corresponding data center (IDC) via a secure API. Upon responding to the request, the IDC's tracing collaboration platform first queries the NAT translation logs within that time window. Based on the precise timestamp, it maps the public IP address to the internal IP address 10.1.2.101. Then, through the cloud management platform, it locates a cloud server belonging to user A, thus identifying user A's corresponding user device as the target user device. The IDC sends an instruction to the target user device. Based on the instruction, the target user device extracts the suspicious encrypted traffic data for the corresponding time period from its local full-traffic storage system. Using the stored TLS private key, it decrypts the data in a secure environment, restoring the plaintext traffic data. After hash verification, this data is fed back to the monitoring equipment via a secure channel. The monitoring equipment then performs a deep compliance test on this plaintext traffic data to obtain the final compliance test result.

[0137] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.

[0138] Based on the same inventive concept, this application also provides a traffic compliance detection device for implementing the traffic compliance detection method described above. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more traffic compliance detection device embodiments provided below can be found in the limitations of the traffic compliance detection method described above, and will not be repeated here.

[0139] In one embodiment, such as Figure 10 As shown, Figure 10 This is a structural block diagram of a traffic compliance detection device provided in an embodiment of this application. The device 1000 includes:

[0140] The first determining module 1001 is used to respond to the collaborative tracing request for suspicious encrypted traffic data sent by the monitoring device, and determine the target user device corresponding to the suspicious encrypted traffic data based on the outbound public network address and time window of the suspicious encrypted traffic data carried in the collaborative tracing request.

[0141] The first acquisition module 1002 is used to send an instruction message to the target user equipment and acquire the plaintext traffic data sent by the target user equipment based on the instruction message; the instruction message is used to instruct the target user equipment to decrypt the encrypted traffic data on the target user equipment local according to the preset encryption key to obtain the plaintext traffic data corresponding to the encrypted traffic data.

[0142] The first transmission module 1003 is used to transmit plaintext traffic data to the monitoring equipment; the plaintext traffic data is used by the monitoring equipment for compliance testing.

[0143] In one embodiment, the first determining module 1001 includes:

[0144] The first acquisition unit is used to acquire the network address translation log corresponding to the time window;

[0145] The address translation unit is used to translate outbound public network addresses into internal network server addresses based on the timestamps corresponding to suspicious encrypted traffic data in the time window and the network address translation logs.

[0146] The first determining unit is used to determine the target user device corresponding to the suspicious encrypted traffic data based on the internal network server address.

[0147] In one embodiment, the first determining unit is specifically used to query the service access logs of suspicious encrypted traffic corresponding to the intranet server address; and to determine the target user device corresponding to the suspicious encrypted traffic based on the service access logs.

[0148] In one embodiment, such as Figure 11 As shown, Figure 11 This is a structural block diagram of another traffic compliance detection device provided in this application embodiment. The device 1100 includes:

[0149] The first receiving module 1101 is used to receive indication information sent by the Internet Data Center;

[0150] The decryption module 1102 is used to decrypt the encrypted traffic data of the target user device based on the instruction information and according to the preset encryption key to obtain the plaintext traffic data corresponding to the encrypted traffic data.

[0151] The second transmission module 1103 is used to send plaintext traffic data to the Internet data center. The plaintext traffic data is used for compliance testing.

[0152] In one embodiment, the decryption module 1102 includes:

[0153] The second acquisition unit is used to acquire encrypted traffic data from the target user equipment locally based on the target session information in the instruction information;

[0154] The decryption unit is used to decrypt the encrypted traffic data on the target user device's local device based on a preset encryption key to obtain plaintext traffic data.

[0155] In one embodiment, such as Figure 12 As shown, Figure 12 This is a structural block diagram of another traffic compliance detection device provided in the embodiments of this application. The device 1200 includes:

[0156] The third transmission module 1201 is used to send a collaborative tracing request for suspicious encrypted traffic data to the Internet Data Center. The collaborative tracing request includes the outbound public network address and time window of the suspicious encrypted traffic data. The collaborative tracing request is used to instruct the Internet Data Center to determine the target user equipment corresponding to the suspicious encrypted traffic data based on the outbound public network address and time window of the suspicious encrypted traffic data, and to send instruction information to the target user equipment.

[0157] The second receiving module 1202 is used to receive plaintext traffic data of the target user device sent by the Internet Data Center; the plaintext traffic data is obtained by the target user device decrypting the encrypted traffic data on its local device according to a preset encryption key under the instruction of the Internet Data Center.

[0158] The compliance detection module 1203 is used to perform compliance detection on plaintext traffic data in order to obtain compliance detection results.

[0159] In one embodiment, the device 1200 further includes:

[0160] The second acquisition module is used to acquire initial encrypted traffic data through the acquisition device set at the exit checkpoint node;

[0161] The preliminary compliance detection module is used to perform preliminary compliance detection on the initial encrypted traffic data and obtain the preliminary compliance detection results.

[0162] The second determination module is used to determine the initial encrypted traffic that meets the preset suspicious conditions in the preliminary compliance test results as suspicious encrypted traffic.

[0163] Each module in the aforementioned traffic compliance detection device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.

[0164] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 13As shown, this computer device includes a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and databases. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media to run. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When the computer program is executed by the processor, it implements a traffic compliance detection method.

[0165] Those skilled in the art will understand that Figure 13 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0166] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0167] In response to a collaborative tracing request for suspicious encrypted traffic data sent by a monitoring device, the target user device corresponding to the suspicious encrypted traffic data is determined based on the outbound public network address and time window of the suspicious encrypted traffic data carried in the collaborative tracing request.

[0168] Send an instruction message to the target user equipment and obtain the plaintext traffic data sent by the target user equipment based on the instruction message; the instruction message is used to instruct the target user equipment to decrypt the encrypted traffic data on the target user equipment's local side according to the preset encryption key to obtain the plaintext traffic data corresponding to the encrypted traffic data;

[0169] Plaintext traffic data is transmitted to the monitoring equipment; the plaintext traffic data is used by the monitoring equipment for compliance testing.

[0170] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0171] Retrieve the network address translation log corresponding to the time window;

[0172] Based on the timestamps and network address translation logs corresponding to the suspicious encrypted traffic data within the time window, the outbound public network addresses are converted to internal network server addresses;

[0173] Based on the internal network server address, identify the target user device corresponding to the suspicious encrypted traffic data.

[0174] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0175] Query the business access logs of suspicious encrypted traffic corresponding to the internal network server address;

[0176] Identify the target user devices corresponding to suspicious encrypted traffic based on business access logs.

[0177] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0178] Receive instruction information sent by the Internet Data Center;

[0179] Based on the instruction information, the encrypted traffic data on the target user device is decrypted according to the preset encryption key to obtain the plaintext traffic data corresponding to the encrypted traffic data;

[0180] Plaintext traffic data is sent to the Internet Data Center for compliance testing.

[0181] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0182] Obtain encrypted traffic data locally from the target user device based on the target session information in the instruction message;

[0183] The encrypted traffic data on the target user's device is decrypted using a preset encryption key to obtain plaintext traffic data.

[0184] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0185] The collaborative tracing request for suspicious encrypted traffic data is sent to the Internet Data Center. The collaborative tracing request includes the outbound public network address and time window of the suspicious encrypted traffic data. The collaborative tracing request is used to instruct the Internet Data Center to determine the target user device corresponding to the suspicious encrypted traffic data based on the outbound public network address and time window of the suspicious encrypted traffic data, and to send instruction information to the target user device.

[0186] Receive plaintext traffic data from the target user device sent by the Internet Data Center; the plaintext traffic data is obtained by the target user device decrypting the encrypted traffic data on its local machine according to a preset encryption key under the instruction of the Internet Data Center.

[0187] Perform compliance checks on plaintext traffic data to obtain compliance check results.

[0188] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0189] Initial encrypted traffic data is obtained by collecting data from devices installed at exit checkpoints;

[0190] Perform a preliminary compliance check on the initial encrypted traffic data to obtain preliminary compliance check results;

[0191] Initial encrypted traffic whose preliminary compliance test results meet the preset suspicious conditions is identified as suspicious encrypted traffic.

[0192] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0193] In response to a collaborative tracing request for suspicious encrypted traffic data sent by a monitoring device, the target user device corresponding to the suspicious encrypted traffic data is determined based on the outbound public network address and time window of the suspicious encrypted traffic data carried in the collaborative tracing request.

[0194] Send an instruction message to the target user equipment and obtain the plaintext traffic data sent by the target user equipment based on the instruction message; the instruction message is used to instruct the target user equipment to decrypt the encrypted traffic data on the target user equipment's local side according to the preset encryption key to obtain the plaintext traffic data corresponding to the encrypted traffic data;

[0195] Plaintext traffic data is transmitted to the monitoring equipment; the plaintext traffic data is used by the monitoring equipment for compliance testing.

[0196] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0197] Retrieve the network address translation log corresponding to the time window;

[0198] Based on the timestamps and network address translation logs corresponding to the suspicious encrypted traffic data within the time window, the outbound public network addresses are converted to internal network server addresses;

[0199] Based on the internal network server address, identify the target user device corresponding to the suspicious encrypted traffic data.

[0200] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0201] Query the business access logs of suspicious encrypted traffic corresponding to the internal network server address;

[0202] Identify the target user devices corresponding to suspicious encrypted traffic based on business access logs.

[0203] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0204] Receive instruction information sent by the Internet Data Center;

[0205] Based on the instruction information, the encrypted traffic data on the target user device is decrypted according to the preset encryption key to obtain the plaintext traffic data corresponding to the encrypted traffic data;

[0206] Plaintext traffic data is sent to the Internet Data Center for compliance testing.

[0207] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0208] Obtain encrypted traffic data locally from the target user device based on the target session information in the instruction message;

[0209] The encrypted traffic data on the target user's device is decrypted using a preset encryption key to obtain plaintext traffic data.

[0210] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0211] The collaborative tracing request for suspicious encrypted traffic data is sent to the Internet Data Center. The collaborative tracing request includes the outbound public network address and time window of the suspicious encrypted traffic data. The collaborative tracing request is used to instruct the Internet Data Center to determine the target user device corresponding to the suspicious encrypted traffic data based on the outbound public network address and time window of the suspicious encrypted traffic data, and to send instruction information to the target user device.

[0212] Receive plaintext traffic data from the target user device sent by the Internet Data Center; the plaintext traffic data is obtained by the target user device decrypting the encrypted traffic data on its local machine according to a preset encryption key under the instruction of the Internet Data Center.

[0213] Perform compliance checks on plaintext traffic data to obtain compliance check results.

[0214] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0215] Initial encrypted traffic data is obtained by collecting data from devices installed at exit checkpoints;

[0216] Perform a preliminary compliance check on the initial encrypted traffic data to obtain preliminary compliance check results;

[0217] Initial encrypted traffic whose preliminary compliance test results meet the preset suspicious conditions is identified as suspicious encrypted traffic.

[0218] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, performs the following steps:

[0219] In response to a collaborative tracing request for suspicious encrypted traffic data sent by a monitoring device, the target user device corresponding to the suspicious encrypted traffic data is determined based on the outbound public network address and time window of the suspicious encrypted traffic data carried in the collaborative tracing request.

[0220] Send an instruction message to the target user equipment and obtain the plaintext traffic data sent by the target user equipment based on the instruction message; the instruction message is used to instruct the target user equipment to decrypt the encrypted traffic data on the target user equipment's local side according to the preset encryption key to obtain the plaintext traffic data corresponding to the encrypted traffic data;

[0221] Plaintext traffic data is transmitted to the monitoring equipment; the plaintext traffic data is used by the monitoring equipment for compliance testing.

[0222] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0223] Retrieve the network address translation log corresponding to the time window;

[0224] Based on the timestamps and network address translation logs corresponding to the suspicious encrypted traffic data within the time window, the outbound public network addresses are converted to internal network server addresses;

[0225] Based on the internal network server address, identify the target user device corresponding to the suspicious encrypted traffic data.

[0226] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0227] Query the business access logs of suspicious encrypted traffic corresponding to the internal network server address;

[0228] Identify the target user devices corresponding to suspicious encrypted traffic based on business access logs.

[0229] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0230] Receive instruction information sent by the Internet Data Center;

[0231] Based on the instruction information, the encrypted traffic data on the target user device is decrypted according to the preset encryption key to obtain the plaintext traffic data corresponding to the encrypted traffic data;

[0232] Plaintext traffic data is sent to the Internet Data Center for compliance testing.

[0233] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0234] Obtain encrypted traffic data locally from the target user device based on the target session information in the instruction message;

[0235] The encrypted traffic data on the target user's device is decrypted using a preset encryption key to obtain plaintext traffic data.

[0236] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0237] The collaborative tracing request for suspicious encrypted traffic data is sent to the Internet Data Center. The collaborative tracing request includes the outbound public network address and time window of the suspicious encrypted traffic data. The collaborative tracing request is used to instruct the Internet Data Center to determine the target user device corresponding to the suspicious encrypted traffic data based on the outbound public network address and time window of the suspicious encrypted traffic data, and to send instruction information to the target user device.

[0238] Receive plaintext traffic data from the target user device sent by the Internet Data Center; the plaintext traffic data is obtained by the target user device decrypting the encrypted traffic data on its local machine according to a preset encryption key under the instruction of the Internet Data Center.

[0239] Perform compliance checks on plaintext traffic data to obtain compliance check results.

[0240] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0241] Initial encrypted traffic data is obtained by collecting data from devices installed at exit checkpoints;

[0242] Perform a preliminary compliance check on the initial encrypted traffic data to obtain preliminary compliance check results;

[0243] Initial encrypted traffic whose preliminary compliance test results meet the preset suspicious conditions is identified as suspicious encrypted traffic.

[0244] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0245] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0246] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A traffic compliance detection method, characterized in that, Applied to Internet data centers, the method includes: In response to a collaborative tracing request for suspicious encrypted traffic data sent by a monitoring device, the target user device corresponding to the suspicious encrypted traffic data is determined based on the outbound public network address and time window of the suspicious encrypted traffic data carried in the collaborative tracing request. Send an instruction message to the target user equipment and obtain plaintext traffic data sent by the target user equipment based on the instruction message; the instruction message is used to instruct the target user equipment to decrypt the encrypted traffic data on its local side according to a preset encryption key to obtain the plaintext traffic data corresponding to the encrypted traffic data; The plaintext traffic data is transmitted to the monitoring device; the plaintext traffic data is used by the monitoring device for compliance testing.

2. The method according to claim 1, characterized in that, The step of determining the target user device corresponding to the suspicious encrypted traffic data based on the outbound public network address and time window of the suspicious encrypted traffic data carried in the collaborative tracing request includes: Obtain the network address translation log corresponding to the time window; Based on the timestamps corresponding to the suspicious encrypted traffic data in the time window and the network address translation log, the outbound public network address is converted into an internal network server address; Based on the intranet server address, the target user device corresponding to the suspicious encrypted traffic data is determined.

3. The method according to claim 2, characterized in that, The step of determining the target user device corresponding to the suspicious encrypted traffic data based on the intranet server address includes: Query the service access logs of the suspicious encrypted traffic corresponding to the internal network server address; The target user device corresponding to the suspicious encrypted traffic is determined based on the business access logs.

4. A traffic compliance detection method, characterized in that, Applied to a target user equipment, the method includes: Receive instruction information sent by the Internet Data Center; Based on the instruction information, the encrypted traffic data of the target user device is decrypted according to the preset encryption key to obtain the plaintext traffic data corresponding to the encrypted traffic data; The plaintext traffic data is sent to an Internet data center for compliance testing.

5. The method according to claim 4, characterized in that, The step of decrypting the encrypted traffic data locally on the target user device based on the indication information and according to a preset encryption key to obtain the plaintext traffic data corresponding to the encrypted traffic data includes: Encrypted traffic data is obtained locally from the target user device based on the target session information in the instruction information; The encrypted traffic data on the target user device is decrypted based on the preset encryption key to obtain the plaintext traffic data.

6. A traffic compliance detection method, characterized in that, Applied to monitoring equipment, the method includes: A collaborative tracing request for suspicious encrypted traffic data is sent to the Internet Data Center; the collaborative tracing request includes the outbound public network address and time window of the suspicious encrypted traffic data; the collaborative tracing request is used to instruct the Internet Data Center to determine the target user device corresponding to the suspicious encrypted traffic data based on the outbound public network address and time window of the suspicious encrypted traffic data, and to send instruction information to the target user device; The system receives plaintext traffic data from the target user device sent by the Internet data center. The plaintext traffic data is obtained by the target user device decrypting its local encrypted traffic data according to a preset encryption key under the instruction of the Internet data center. The plaintext traffic data is subjected to compliance testing to obtain compliance test results.

7. The method according to claim 6, characterized in that, Before sending the collaborative tracing request for suspicious encrypted traffic data to the Internet data center, the method further includes: Initial encrypted traffic data is obtained by collecting data from devices installed at exit checkpoints; A preliminary compliance check is performed on the initial encrypted traffic data to obtain preliminary compliance check results; Initial encrypted traffic whose preliminary compliance test results meet preset suspicious conditions is identified as suspicious encrypted traffic.

8. A flow compliance detection device, characterized in that, The device includes: The first determining module is used to respond to a collaborative tracing request for suspicious encrypted traffic data sent by the monitoring device, and determine the target user device corresponding to the suspicious encrypted traffic data based on the outbound public network address and time window of the suspicious encrypted traffic data carried in the collaborative tracing request. The first acquisition module is used to send indication information to the target user equipment and acquire plaintext traffic data sent by the target user equipment based on the indication information; the indication information is used to instruct the target user equipment to decrypt the encrypted traffic data on the target user equipment local according to a preset encryption key to obtain the plaintext traffic data corresponding to the encrypted traffic data. The first transmission module is used to transmit the plaintext traffic data to the monitoring device; the plaintext traffic data is used by the monitoring device for compliance testing.

9. A flow compliance detection device, characterized in that, The device includes: The first receiving module is used to receive instruction information sent by the Internet Data Center; The decryption module is used to decrypt the encrypted traffic data of the target user device based on the indication information and according to the preset encryption key, so as to obtain the plaintext traffic data corresponding to the encrypted traffic data. The second transmission module is used to send the plaintext traffic data to the Internet data center, and the plaintext traffic data is used for compliance detection.

10. A flow compliance detection device, characterized in that, The device includes: The third transmission module is used to send a collaborative tracing request for suspicious encrypted traffic data to the Internet Data Center; the collaborative tracing request includes the outbound public network address and time window of the suspicious encrypted traffic data; the collaborative tracing request is used to instruct the Internet Data Center to determine the target user device corresponding to the suspicious encrypted traffic data based on the outbound public network address and time window of the suspicious encrypted traffic data, and to send instruction information to the target user device; The second receiving module is used to receive plaintext traffic data of the target user device sent by the Internet data center; the plaintext traffic data is obtained by the target user device decrypting the encrypted traffic data locally on the target user device according to a preset encryption key under the instruction of the Internet data center. The compliance detection module is used to perform compliance detection on the plaintext traffic data to obtain the compliance detection results.

11. A traffic compliance detection system, characterized in that, The system includes: an internet data center, target user equipment, and monitoring equipment; The Internet data center is used to perform the steps of the method according to any one of claims 1 to 3; The target user equipment is used to perform the steps of the method according to any one of claims 4 to 5; The monitoring device is used to perform the steps of the method according to any one of claims 6 to 7.

12. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 7.

13. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

14. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

Images