Encrypted traffic analysis method and device, electronic equipment, medium and program

Abstract

The invention relates to an encrypted traffic analysis method and device, electronic equipment, a medium and a program. The method comprises the steps that under the condition that a target process calls a main reading function or a main writing function of a secure transmission basic library, a memory obtaining function preset in the target process is triggered; wherein the target process is a process which is used for running encrypted communication connection and is provided with the memory acquisition function in advance; obtaining a main session key from a target encrypted communication connection through the memory obtaining function; wherein the target encrypted communication connection is the encrypted communication connection operated by the target process. According to the method, the main session key corresponding to the encrypted communication connection of the target process is conveniently acquired through the memory acquisition function set in the target process running at the endpoint, the main session key is used for encrypted data (flow) analysis, computing resources of gateway equipment are greatly saved, and certificate alarm is correspondingly avoided due to the absence of a certificate replacement process.

Description

technical field [0001] The present invention relates to the technical field of information security, in particular to an encrypted traffic analysis method, device, electronic equipment, medium and program. Background technique [0002] With the popularization of HTTPS, a large amount of attack traffic is also sent and received using encrypted traffic, which brings difficulties to the traffic analysis of terminals and gateway devices. [0003] Most of the existing encrypted traffic analysis solutions are to create a middleman in the gateway device of the enterprise network, and use the middleman to forward encrypted traffic for traffic analysis and monitoring. In this way, the encrypted traffic of each encrypted communication connection has a decryption and re-encryption process on the gateway device, which consumes a lot of computing resources, and because there is a certificate replacement in the middleman, the terminal is likely to perceive the existence of the middleman p...

AI Technical Summary

Problems solved by technology

[0005] The present invention provides an encrypted traffic analysis method, device, electronic equipment, medium and program, which are used to solve the technical defects in the prior art that the gateway equipment consumes large computing resources and the terminal is prone to generate certificate alarms

Images