Method and system for multi-stream correlation analysis and identification of private encrypted data

Abstract

A method and system for identifying private encrypted data through multi-stream correlation analysis, including identifying private encrypted data of the first class, obtaining non-private encrypted data of the first class through the identification process of private encrypted data of the first class; Encrypted data identification; report the identified first-class private encrypted data and second-class private encrypted data to the engine; obtain non-class-one private encrypted data, and perform data flow correlation analysis on non-class-one private encrypted data; preset second-class private encrypted data The feature code and port, by identifying the first source IP, first source port, first destination IP and first destination port, the first session identification is performed; match the feature code and port to determine whether the first session belongs to the second type of private encryption Data; if it belongs to the second type of private encrypted data, the identification process of the subsequent session will be carried out. The invention realizes the dynamic analysis of specific private encrypted data; the recognition range and applicable scenarios are wider, and the utilization rate of massive data in the network is improved.

Description

technical field [0001] The invention relates to a method and system for multi-stream correlation analysis and identification of private encrypted data, belonging to the technical field of encrypted data processing. Background technique [0002] Currently, the identification of private encrypted data mainly includes the following schemes: [0003] First, use signatures to identify encrypted data. Mainly by judging whether the byte offset of the TCP load is a specific value, if it is equal to a certain value, the data is considered to be encrypted data, and if not, the data is considered not to be encrypted data. [0004] Second, use ports to identify encrypted data. The client communicates with the server, passing encrypted information. Before establishing a communication connection, the server needs to listen to a certain port and wait for the connection from the client. In this way, encrypted data can be identified using port characteristics. Typically, these ports are...

AI Technical Summary

Problems solved by technology

[0010] To this end, the present invention provides a method and system for multi-stream correlation analysis and identification of private encrypted data, which is suitable for capturing, filtering, and identification of network encrypted data, and identifies network encrypted data based on ports. By combining feature codes and multi-stream correlation analysis technology Identify; on the basis of the original information entropy idea, a binary discrete method is proposed to solve the problem of low accuracy and efficiency of traditional encrypted data based on port identification and feature code identification

Images