CN114492376B - Application fingerprint detection method and device and electronic equipment - Google Patents

Abstract

The invention provides a detection method, a detection device and electronic equipment for application fingerprints, wherein the method comprises the following steps: acquiring network traffic data; inputting network traffic data into a decoder to obtain a plurality of network protocol fields; matching based on Boolean logic rules in a first rule file according to field names and field contents of a plurality of network protocol fields to obtain corresponding target application identifiers; and matching corresponding target application fingerprint information in the second rule file according to the target application identifier. And in the first rule file, parallel application fingerprint detection based on a plurality of network protocol fields is realized through matching based on Boolean logic rules, so that efficient application fingerprint detection is realized.

Description

Fingerprint detection method, device and electronic device

Technical Field

The present invention relates to the field of computer technology, and in particular to a fingerprint detection method, device and electronic equipment.

Background technique

Existing fingerprint recognition applications have limitations in fingerprint format design. Some rule formats are extremely complex, resulting in poor compatibility and simple and inefficient detection logic. Some are very rough in field parsing and find it difficult to segment specific fields in traffic field parsing, which affects rule accuracy and reduces efficiency.

Therefore, achieving efficient application fingerprint detection is an urgent problem to be solved.

Summary of the invention

The present invention provides a method, device and electronic device for detecting an application fingerprint, so as to solve the defect of low fingerprint detection efficiency in the prior art and realize efficient application fingerprint detection.

The present invention provides a detection method for application fingerprints, comprising:

Get network traffic data;

Inputting the network traffic data into a decoder to obtain a plurality of network protocol fields connected by Boolean logic, wherein the network protocol fields include field names and field contents;

According to the field names and the field contents of the multiple network protocol fields, matching is performed based on Boolean logic rules in a first rule file to obtain a corresponding target application identifier, wherein the first rule file is a file stored locally, and the first rule file pre-stores Boolean logic rules and application identifiers corresponding to the Boolean logic rules, and the Boolean logic rules have at least one logical node connected by Boolean logic characters, and the logical node includes a first field name and a first field content;

The corresponding target application fingerprint information is matched in the second rule file according to the target application identifier, wherein the second rule file is a file stored locally and the application identifier and the application fingerprint information corresponding to the application identifier are pre-stored in the second rule file.

According to an application fingerprint detection method provided by the present invention, the network protocol field includes a request header network protocol field, a request body network protocol field, a response header network protocol field and a response body network protocol field;

The step of inputting the network traffic data into a decoder to obtain a plurality of network protocol fields connected by Boolean logic comprises:

Input the network traffic data into a decoder, and decode it according to a preset decoding rule to obtain a request header, a request body, a response header, and a response body;

Decode the request header, the request body, the response header, and the response body according to a preset decoding rule to obtain a request header field set corresponding to the request header, a request body field set corresponding to the request body, a response header field set corresponding to the response header, and a response body field set corresponding to the response body;

Among them, the request header field set includes the field name and field content of at least one request header network protocol field, the request body field set includes the field name and field content of at least one request body network protocol field, the response header field set includes the field name and field content of at least one response header network protocol field, and the response body field set includes the field name and field content of at least one response body network protocol field.

According to an application fingerprint detection method provided by the present invention, the step of performing matching based on Boolean logic rules in a first rule file according to the field names and field contents of the multiple network protocol fields to obtain a corresponding target application identifier includes:

According to the different types of field sets and the corresponding preset order, the field name and field content of the network protocol field in each field set are matched in turn in the first rule file to the target application identifier corresponding to the Boolean logic rule.

According to an application fingerprint detection method provided by the present invention, the step of sequentially matching the field name of the network protocol field in each field set and the target application identifier corresponding to the Boolean logic rule that the field content complies with in the first rule file comprises:

For each field set, matching the target application identifier corresponding to the Boolean logic rule in the first rule file according to the field name and the field content of the network protocol field;

The conforming Boolean logic rule is a Boolean logic rule having a logic node consistent with the field name and the field content and satisfying the Boolean logic character corresponding condition.

According to an application fingerprint detection method provided by the present invention, the field set contains the field names and field contents of multiple network protocol fields; the Boolean logic rule contains multiple logic nodes, and the Boolean logic character is an AND logic character;

The step of matching the target application identifier corresponding to the Boolean logic rule in the first rule file according to the field name and the field content of the network protocol field comprises:

According to the field names and the field contents of the multiple network protocol fields, matching the target application identifier corresponding to the Boolean logic rule that meets the first condition in the first rule file;

Among them, the first condition is that the field names of the multiple network protocol fields are simultaneously consistent with the first field names in the multiple logical nodes, and the field contents corresponding to the field names in the multiple network protocol fields are simultaneously consistent with the first field contents in the multiple logical nodes.

According to an application fingerprint detection method provided by the present invention, the field set contains the field names and field contents of multiple network protocol fields; the Boolean logic rule contains multiple logic nodes, and the Boolean logic character is an OR logic character;

The step of matching the target application identifier corresponding to the Boolean logic rule in the first rule file according to the field name and the field content of the network protocol field comprises:

According to the field names and the field contents of the multiple network protocol fields, matching the target application identifier corresponding to the Boolean logic rule that meets the second condition in the first rule file;

The second condition is that the field names of the multiple network protocol fields are consistent with the first field name of any one of the multiple logical nodes, and the field content corresponding to the field name in the multiple network protocol fields is consistent with the first field content of the determined logical node, and the determined logical node is the logical node whose field name is consistent with the first field name.

According to an application fingerprint detection method provided by the present invention, the step of matching the target application identifier corresponding to the Boolean logic rule in the first rule file according to the field name and the field content of the network protocol field, further includes:

When the target application identifier corresponding to the matching Boolean logic rule is successfully matched in the first rule file according to the field name and the field content of the network protocol field, subsequent matching is stopped.

According to an application fingerprint detection method provided by the present invention, the target application fingerprint information includes application attribute information and application source information, wherein the application attribute information includes application name, application description and application version, and the application source information includes IP address and port information;

The step of matching the target application fingerprint information in the second rule file according to the target application identifier includes:

Match the application description, the application version, the IP address and the port information in the second rule file according to the target application identifier, use the target application name, the application description and the application version as the application attribute information, and use the IP address and the port information as the application source information;

The target application fingerprint information is generated according to the application attribute information and the application source information.

The present invention also provides a detection device using fingerprints, comprising:

An acquisition unit, used for acquiring network traffic data;

A parsing unit, used for inputting the network traffic data into a decoder to obtain a plurality of network protocol fields, wherein the network protocol fields include field names and field contents;

a first matching unit, configured to perform matching based on Boolean logic rules in a first rule file according to the field names and the field contents of the multiple network protocol fields, to obtain a corresponding target application identifier, wherein the first rule file is a file stored locally, and the first rule file pre-stores Boolean logic rules and application identifiers corresponding to the Boolean logic rules, the Boolean logic rules have Boolean logic characters and at least one logic node, and the logic node includes a first field name and a first field content;

The second matching unit is used to match the corresponding target application fingerprint information in the second rule file according to the target application identifier, wherein the second rule file is a file stored locally, and the application identifier and the application fingerprint information corresponding to the application identifier are pre-stored in the second rule file.

The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of any of the above-mentioned application fingerprint detection methods are implemented.

The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above-mentioned application fingerprint detection methods are implemented.

The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the steps of any of the above-mentioned application fingerprint detection methods are implemented.

The detection method, device and electronic device of application fingerprint provided by the present invention obtain network traffic data; input the network traffic data into a decoder to obtain multiple network protocol fields, wherein the network protocol field includes a field name and a field content; perform matching based on Boolean logic rules in a first rule file according to the field names and the field contents of the multiple network protocol fields to obtain a corresponding target application identifier, wherein the first rule file is a file stored locally, the first rule file pre-stores a Boolean logic rule and an application identifier corresponding to the Boolean logic rule, the Boolean logic rule has at least one logical node connected by Boolean logic characters, and the logical node includes a first field name and a first field content; match the corresponding target application fingerprint information in a second rule file according to the target application identifier, wherein the second rule file is a file stored locally, and the second rule file pre-stores an application identifier and an application fingerprint information corresponding to the application identifier. The present invention realizes parallel application fingerprint detection based on multiple network protocol fields through matching based on Boolean logic rules in the first rule file, thereby realizing efficient application fingerprint detection.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

FIG1 is a schematic flow chart of a method for detecting application fingerprints provided by the present invention;

FIG2 is a flow chart of the detection of application fingerprints provided by the present invention;

FIG3 is a schematic diagram of the structure of a detection device for applying fingerprints provided by the present invention;

FIG. 4 is a schematic diagram of the structure of an electronic device provided by the present invention.

Detailed ways

In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

Application fingerprint information refers to the relevant features of the application, including the application name, application-related description, the server operating system where the application is located, the application server, development framework, development language, database, application version information and other attributes.

Existing fingerprint recognition applications have limitations in fingerprint format design. Some rule formats are extremely complex, resulting in poor compatibility and simple and inefficient detection logic. Some are very rough in field parsing and find it difficult to segment specific fields in traffic field parsing, which affects rule accuracy and reduces efficiency.

Therefore, achieving efficient application fingerprint detection is an urgent problem to be solved.

To solve the above problems, the present invention provides a detection method for application fingerprints, as shown in FIG1 , comprising the following steps:

S11. Obtain network traffic data.

Specifically, for ease of understanding, the following explanation is given using an electronic device as the execution subject, which does not serve as a limitation.

The electronic device can obtain network traffic data, which includes data generated by various network applications during operation.

S12. Input the network traffic data into a decoder to obtain a plurality of network protocol fields.

Specifically, the electronic device may input the network traffic data into a decoder to obtain a plurality of network protocol fields within a network application in the network traffic data, wherein the network protocol field includes a field name and field content.

S13. Perform matching based on Boolean logic rules in the first rule file according to the field names and the field contents of the multiple network protocol fields to obtain a corresponding target application identifier.

Specifically, the electronic device can perform a match based on Boolean logic rules in the first rule file according to the field name and field content of the network protocol field to obtain the corresponding target application identifier, wherein the first rule file is a file stored locally, and the first rule file pre-stores Boolean logic rules and application identifiers corresponding to the Boolean logic rules, and the Boolean logic rules have at least one logical node connected by Boolean logic characters, and the logical node includes a first field name and a first field content.

To facilitate cross-platform use of rules, the first rule file may be a file in XML format.

S14. Match corresponding target application fingerprint information in the second rule file according to the target application identifier.

Specifically, the electronic device can match the corresponding target application fingerprint information in the second rule file according to the target application identifier matched in the first rule file, wherein the second rule file is a file stored locally, and the second rule file pre-stores the application identifier and the application fingerprint information corresponding to the application identifier.

To facilitate cross-platform use of rules, the first rule file may be a file in XML format.

In one example, as shown in FIG2 , FIG2 is a flow chart of application fingerprint detection. First, network traffic data is obtained, and then the network traffic data is input into a decoder, the network traffic data is decoded to obtain multiple network protocol fields, and the target application identifiers corresponding to the multiple network protocol fields are matched in the first rule file, and then the application fingerprint information corresponding to the target application identifier is matched in the second rule file.

In an embodiment of the present invention, by acquiring network traffic data, the network traffic data is input into a decoder to obtain multiple network protocol fields, wherein the network protocol field includes a field name and a field content, and a Boolean logic rule-based match is performed in a first rule file according to the field name and field content of the multiple network protocol fields to obtain a corresponding target application identifier, wherein the first rule file is a file stored locally, and the first rule file pre-stores a Boolean logic rule and an application identifier corresponding to the Boolean logic rule, and the Boolean logic rule has at least one logical node connected by a Boolean logic character, and the logical node includes a first field name and a first field content, and the corresponding target application fingerprint information is matched in a second rule file according to the target application identifier, wherein the second rule file is a file stored locally, and the second rule file pre-stores an application identifier and an application fingerprint information corresponding to the application identifier. The present invention realizes parallel application fingerprint detection based on multiple network protocol fields through matching based on Boolean logic rules in the first rule file, thereby realizing efficient application fingerprint detection.

According to a method for detecting application fingerprints provided by the present invention, the network protocol field includes a request header network protocol field, a request body network protocol field, a response header network protocol field, and a response body network protocol field; step S12 includes the following steps:

S121. Input the network traffic data into a decoder, and decode it according to a preset decoding rule to obtain a request header, a request body, a response header, and a response body.

Specifically, the electronic device can input the network traffic data into a decoder, which has preset decoding rules pre-stored therein, so that the decoder decodes the network traffic data according to the preset decoding rules to obtain a request header, a request body, a response header and a response body.

S122. Decode the request header, the request body, the response header and the response body according to a preset decoding rule to obtain a request header field set corresponding to the request header, a request body field set corresponding to the request body, a response header field set corresponding to the response header and a response body field set corresponding to the response body.

Specifically, the request header, request body, response header and response body can be further decoded according to preset decoding rules to obtain a request header field set corresponding to the request header, a request body field set corresponding to the request body, a response header field set corresponding to the response header, and a response body field set corresponding to the response body.

Among them, the request header field set includes the field name and field content of at least one request header network protocol field, the request body field set includes the field name and field content of at least one request body network protocol field, the response header field set includes the field name and field content of at least one response header network protocol field, and the response body field set includes the field name and field content of at least one response body network protocol field.

In an embodiment of the present invention, the network protocol field includes a request header network protocol field, a request body network protocol field, a response header network protocol field, and a response body network protocol field, and describes in detail the steps of inputting network traffic data into a decoder to obtain multiple network protocol fields. Through the above steps, multiple network protocol fields can be obtained simply and quickly, which facilitates the subsequent matching of the field name and field content of the network protocol field in the first rule file based on Boolean logic rules to obtain the corresponding target application identifier, and then match the corresponding target application fingerprint information in the second rule file according to the target application identifier, thereby realizing parallel application fingerprint detection based on multiple network protocol fields, and then realizing efficient application fingerprint detection.

According to an application fingerprint detection method provided by an embodiment of the present invention, step S13 is specifically as follows:

According to the different types of field sets and the corresponding preset order, the field name and field content of the network protocol field in each field set are matched in turn in the first rule file to the target application identifier corresponding to the Boolean logic rule.

Specifically, the request header field set, the request body field set, the response header field set, and the response body field set are sorted in a preset order.

The electronic device can match the target application identifier corresponding to the Boolean logic rule that the field name and field content of the network protocol field in each field set conform to from different types of field sets in the first rule file in accordance with the preset order of different types of field sets.

In one example, the preset order is a request header field set, a request body field set, a response header field set, and a response body field set. The electronic device first matches the target application identifier corresponding to the Boolean logic rule that the field name and field content of the request header network protocol field in the request header field set conform to in the first rule file, and after matching the request header network protocol field in the request header field set, continues to match the target application identifier corresponding to the Boolean logic rule that the field name and field content of the request body network protocol field in the request body field set conform to in the first rule file, and then continues to match the Boolean logic rule that the field name and field content of the network protocol field in the response header field set and the response body field set conform to in the first rule file in the same steps.

In an embodiment of the present invention, the request header field set, the request body field set, the response header field set, and the response body field set are arranged in a preset order, and according to different types of field sets and corresponding preset orders, the field names and field contents of the network protocol fields in each field set are matched in turn in the first rule file to the target application identifier corresponding to the Boolean logic rule. This achieves matching in a preset order while maintaining data attributes, reduces the randomness of matching, and improves matching efficiency, making it convenient to subsequently match the target application fingerprint information in the second rule file according to the target application identifier, thereby achieving efficient application fingerprint detection.

According to an application fingerprint detection method provided by an embodiment of the present invention, the step of sequentially matching the field name of the network protocol field in each field set and the target application identifier corresponding to the Boolean logic rule that the field content complies with in the first rule file is specifically:

For each field set, a target application identifier corresponding to a Boolean logic rule that meets the requirements is matched in the first rule file according to the field name and the field content of the network protocol field.

Specifically, for each field set, the electronic device may match the target application identifier corresponding to the Boolean logic rule that meets the requirements in the first rule file according to the field name and the field content of the network protocol field.

The conforming Boolean logic rule is a Boolean logic rule that has a logic node consistent with the field name and the field content and satisfies the Boolean logic character correspondence condition.

In the embodiment of the present invention, for each field set, the target application identifier corresponding to the Boolean logic rule that meets the match is matched in the first rule file according to the field name and field content of the network protocol field. Simultaneous matching of multiple network protocol fields in the field set improves the matching efficiency, facilitates and quickly obtains the target application identifier, and thus realizes efficient application fingerprint detection.

According to an application fingerprint detection method provided by an embodiment of the present invention, the field set contains the field names and field contents of multiple network protocol fields; the Boolean logic rule contains multiple logic nodes, and the Boolean logic character is an AND logic character;

The step of matching the target application identifier corresponding to the Boolean logic rule in the first rule file according to the field name and the field content of the network protocol field is specifically:

According to the field names and the field contents of the multiple network protocol fields, the target application identifier corresponding to the Boolean logic rule that meets the first condition is matched in the first rule file.

Specifically, the field set contains field names and field contents of multiple network protocol fields, the Boolean logic rule contains multiple logic nodes, and the Boolean logic characters are AND logic characters.

The electronic device may match the target application identifier corresponding to the Boolean logic rule that meets the first condition in the first rule file according to the field names and field contents of the plurality of network protocol fields.

Among them, the first condition is that the field names of multiple network protocol fields are simultaneously consistent with the first field names in multiple logical nodes, and the field contents corresponding to the field names in the multiple network protocol fields are simultaneously consistent with the first field contents in the multiple logical nodes.

In one example, the request header field set includes the field name x1 and field content x2 of the request header network protocol field X and the field name y1 and field content y2 of the request header network protocol field Y. The first rule file includes a Boolean logic rule A and an application identifier M corresponding to the Boolean logic rule A. The Boolean logic rule A includes two logic nodes A1 and A2, and a Boolean logic character of AND logic. The logic node A1 is before the logic node A2. The logic node A1 includes the first field name x1 and field content x2. The logic node A2 includes the first field name y1 and field content y2. The electronic device performs matching based on the Boolean logic rule in the first rule file according to the field name x1 and field content x2 of the request header network protocol field X and the field name y1 and field content y2 of the request header network protocol field Y. The field name x1 and field content x2 of the request header network protocol field X are consistent with the field name x1 and field content x2 of the logical node A1 in the Boolean logic rule A. At this time, because the Boolean logic character is an AND logic character, the matching of the two logical nodes needs to be satisfied at the same time. The electronic device continues the subsequent operation. The field name y1 and field content y2 of the request header network protocol field Y are consistent with the field name y1 and field content y2 of the logical node A2 in the Boolean logic rule A. At this time, the matching based on the Boolean logic rule is successful, and the electronic device matches the target application identifier M corresponding to the Boolean logic rule A in the first rule file.

In another example, different from the above example, the electronic device may start matching from a random logic node in the Boolean logic rule A, without matching in the order of first matching the logic node A1 and then matching the logic node A2.

In an embodiment of the present invention, the field set contains field names and field contents of multiple network protocol fields, the Boolean logic rule contains multiple logical nodes, and the Boolean logic character is an AND logic character. A detailed description is given of matching the target application identifier corresponding to the Boolean logic rule that meets the first condition in the first rule file according to the field names and field contents of multiple network protocol fields, wherein the first condition is that the field names of multiple network protocol fields are simultaneously consistent with the first field names in multiple logical nodes, and the field contents corresponding to the field names in multiple network protocol fields are simultaneously consistent with the first field contents in multiple logical nodes. Thus, parallel application fingerprint detection based on multiple network protocol fields is achieved through matching based on Boolean logic rules in the first rule file, thereby achieving efficient application fingerprint detection.

According to an application fingerprint detection method provided by an embodiment of the present invention, the field set contains the field names and field contents of multiple network protocol fields; the Boolean logic rule contains multiple logic nodes, and the Boolean logic character is an OR logic character;

The step of matching the target application identifier corresponding to the Boolean logic rule in the first rule file according to the field name and the field content of the network protocol field is specifically:

According to the field names and the field contents of the multiple network protocol fields, the target application identifier corresponding to the Boolean logic rule that meets the second condition is matched in the first rule file.

Specifically, the field set contains field names and field contents of multiple network protocol fields, the Boolean logic rule contains multiple logic nodes, and the Boolean logic characters are AND logic characters.

The electronic device may match the target application identifier corresponding to the Boolean logic rule that meets the second condition in the first rule file according to the field names and field contents of the plurality of network protocol fields.

Among them, the second condition is that the field names of multiple network protocol fields are consistent with the first field name of any one of the multiple logical nodes, and the field contents corresponding to the field names in the multiple network protocol fields are consistent with the first field content of the determined logical node, and the determined logical node is a logical node whose field name is consistent with the first field name.

In one example, the request header field set includes the field name x1 and field content x2 of the request header network protocol field X and the field name y1 and field content y2 of the request header network protocol field Y. The first rule file includes a Boolean logic rule B and an application identifier N corresponding to the Boolean logic rule B. The Boolean logic rule B includes two logic nodes B1 and B2, and a Boolean logic character of an OR logic. The logic node B1 includes a first field name z1 and field content z2, and the logic node B2 includes a first field name y1 and field content y2. The electronic device performs a match based on the Boolean logic rule in the first rule file according to the field name x1 and field content x2 of the request header network protocol field X and the field name y1 and field content y2 of the request header network protocol field Y. The field name x1 and field content x2 of the request header network protocol field X and the field name y1 and field content y2 of the request header network protocol field Y are inconsistent with the field name z1 and field content z2 of the logical node B1 in the Boolean logic rule B. At this time, because the Boolean logic character is an OR logic character, only one of the two logical nodes needs to be satisfied. The electronic device continues the subsequent operation. The field name y1 and field content y2 of the request header network protocol field Y are consistent with the field name y1 and field content y2 of the logical node B2 in the Boolean logic rule B. At this time, the match based on the Boolean logic rule is successful, and the electronic device matches the target application identifier N corresponding to the Boolean logic rule B in the first rule file.

In an embodiment of the present invention, the field set contains field names and field contents of multiple network protocol fields, the Boolean logic rule contains multiple logical nodes, and the Boolean logic character is an OR logical character. A detailed description is given of matching the target application identifier corresponding to the Boolean logic rule that meets the second condition in the first rule file according to the field names and field contents of multiple network protocol fields, wherein the second condition is that the field names of the multiple network protocol fields are consistent with the first field name of any one of the multiple logical nodes, and the field contents corresponding to the field names in the multiple network protocol fields are consistent with the first field content of the determined logical node, and the determined logical node is a logical node whose field name is consistent with the first field name. Thus, parallel application fingerprint detection based on multiple network protocol fields is achieved through matching based on Boolean logic rules in the first rule file, thereby achieving efficient application fingerprint detection.

According to an application fingerprint detection method provided by an embodiment of the present invention, the step of matching the target application identifier corresponding to the Boolean logic rule in the first rule file according to the field name and the field content of the network protocol field, further includes:

When the target application identifier corresponding to the network protocol field is successfully matched in the first rule file, subsequent matching is stopped.

Specifically, when the target application identifier corresponding to the matching Boolean logic rule is successfully matched in the first rule file according to the field name and the field content of the network protocol field, the electronic device may stop subsequent matching.

In one example, the first rule file contains Boolean logic rules A and B. When Boolean logic rules A and B are matched simultaneously according to the field name and field content of the network protocol field, when the target application identifier corresponding to Boolean logic rule A is successfully matched, the matching of Boolean logic rule B is stopped.

In the embodiment of the present invention, when the target application identifier corresponding to the Boolean logic rule that matches the field name and field content of the network protocol field is successfully matched in the first rule file, the subsequent matching is stopped. When the match is successful, the subsequent matching is stopped to save resources, and then the saved resources are used to achieve efficient application fingerprint detection.

According to an application fingerprint detection method provided by an embodiment of the present invention, the target application fingerprint information includes application attribute information and application source information, wherein the application attribute information includes application name, application description and application version, and the application source information includes IP address and port information; step S14 specifically includes the following steps:

S131. Match the application description, the application version, the IP address and the port information in the second rule file according to the target application identifier, use the target application name, the application description and the application version as the application attribute information, and use the IP address and the port information as the application source information.

Specifically, the electronic device can match the application description, application version, IP address and port information in the second rule file according to the target application identifier, using the application name, application description and application version as application attribute information and the IP address and port information as application source information.

S132: Generate the target application fingerprint information according to the application attribute information and the application source information.

Specifically, the electronic device may generate the target application fingerprint information according to the application attribute information and the application source information.

In the embodiment of the present invention, the application description, the application version, the IP address and the port information are matched in the second rule file according to the target application identifier, the target application name, the application description and the application version are used as the application attribute information, the IP address and the port information are used as the application source information, and the target application fingerprint information is generated according to the application attribute information and the application source information. Parallel application fingerprint detection based on multiple network protocol fields is achieved, thereby achieving efficient application fingerprint detection.

The following is a description of an application fingerprint detection device provided by the present invention. The application fingerprint detection device described below and the application fingerprint detection method described above can be referred to each other.

The present invention also provides a detection device using fingerprints, as shown in FIG3, comprising:

The acquisition unit 31 is used to acquire network traffic data.

The parsing unit 32 is used to input the network traffic data into a decoder to obtain a plurality of network protocol fields, wherein the network protocol fields include field names and field contents.

The first matching unit 33 is used to perform matching based on Boolean logic rules in the first rule file according to the field names and the field contents of the multiple network protocol fields to obtain a corresponding target application identifier, wherein the first rule file is a file stored locally, and the first rule file pre-stores Boolean logic rules and application identifiers corresponding to the Boolean logic rules, and the Boolean logic rules have Boolean logic characters and at least one logical node, and the logical node includes a first field name and a first field content.

The second matching unit 34 is used to match the corresponding target application fingerprint information in the second rule file according to the target application identifier, wherein the second rule file is a file stored locally, and the second rule file pre-stores the application identifier and the application fingerprint information corresponding to the application identifier.

In an embodiment of the present invention, by acquiring network traffic data, the network traffic data is input into a decoder to obtain multiple network protocol fields, wherein the network protocol field includes a field name and a field content, and a Boolean logic rule-based match is performed in a first rule file according to the field name and field content of the multiple network protocol fields to obtain a corresponding target application identifier, wherein the first rule file is a file stored locally, and the first rule file pre-stores a Boolean logic rule and an application identifier corresponding to the Boolean logic rule, and the Boolean logic rule has at least one logical node connected by a Boolean logic character, and the logical node includes a first field name and a first field content, and the corresponding target application fingerprint information is matched in a second rule file according to the target application identifier, wherein the second rule file is a file stored locally, and the second rule file pre-stores an application identifier and an application fingerprint information corresponding to the application identifier. The present invention realizes parallel application fingerprint detection based on multiple network protocol fields through matching based on Boolean logic rules in the first rule file, thereby realizing efficient application fingerprint detection.

According to an application fingerprint detection device provided by the present invention, the network protocol field includes a request header network protocol field, a request body network protocol field, a response header network protocol field and a response body network protocol field;

The parsing unit 32 is specifically used to input the network traffic data into a decoder, and decode according to a preset decoding rule to obtain a request header, a request body, a response header and a response body;

Decode the request header, the request body, the response header, and the response body according to a preset decoding rule to obtain a request header field set corresponding to the request header, a request body field set corresponding to the request body, a response header field set corresponding to the response header, and a response body field set corresponding to the response body;

Among them, the request header field set includes the field name and field content of at least one request header network protocol field, the request body field set includes the field name and field content of at least one request body network protocol field, the response header field set includes the field name and field content of at least one response header network protocol field, and the response body field set includes the field name and field content of at least one response body network protocol field.

According to an application fingerprint detection device provided by the present invention, the first matching unit 33 is specifically used to match the target application identifier corresponding to the Boolean logic rule that the field name and field content of the network protocol field in each field set conform to in the first rule file in turn according to the different types of field sets and the corresponding preset order.

According to an application fingerprint detection device provided by the present invention, the first matching unit 33 is specifically used to match the target application identifier corresponding to the Boolean logic rule that meets the requirements in the first rule file for each field set according to the field name and the field content of the network protocol field;

The conforming Boolean logic rule is a Boolean logic rule having a logic node consistent with the field name and the field content and satisfying the Boolean logic character corresponding condition.

According to a detection device for application fingerprint provided by the present invention, the field set contains the field names and field contents of multiple network protocol fields; the Boolean logic rule contains multiple logic nodes, and the Boolean logic character is an AND logic character;

The first matching unit 33 is specifically configured to match the target application identifier corresponding to the Boolean logic rule that meets the first condition in the first rule file according to the field names and the field contents of the multiple network protocol fields;

Among them, the first condition is that the field names of the multiple network protocol fields are simultaneously consistent with the first field names in the multiple logical nodes, and the field contents corresponding to the field names in the multiple network protocol fields are simultaneously consistent with the first field contents in the multiple logical nodes.

According to a detection device for application fingerprint provided by the present invention, the field set contains the field names and field contents of multiple network protocol fields; the Boolean logic rule contains multiple logic nodes, and the Boolean logic character is an OR logic character;

The step of matching the target application identifier corresponding to the Boolean logic rule in the first rule file according to the field name and the field content of the network protocol field comprises:

According to the field names and the field contents of the multiple network protocol fields, matching the target application identifier corresponding to the Boolean logic rule that meets the second condition in the first rule file;

The second condition is that the field names of the multiple network protocol fields are consistent with the first field name of any one of the multiple logical nodes, and the field content corresponding to the field name in the multiple network protocol fields is consistent with the first field content of the determined logical node, and the determined logical node is the logical node whose field name is consistent with the first field name.

According to an application fingerprint detection device provided by the present invention, the first matching unit 33 is specifically used to stop subsequent matching when the target application identifier corresponding to the Boolean logic rule that meets the requirements is successfully matched in the first rule file according to the field name and the field content of the network protocol field.

According to an application fingerprint detection device provided by the present invention, the target application fingerprint information includes application attribute information and application source information, wherein the application attribute information includes application name, application description and application version, and the application source information includes IP address and port information;

The second matching unit 34 is specifically configured to match the application description, the application version, the IP address and the port information in the second rule file according to the target application identifier, use the target application name, the application description and the application version as the application attribute information, and use the IP address and the port information as the application source information;

The target application fingerprint information is generated according to the application attribute information and the application source information.

FIG4 illustrates a schematic diagram of the physical structure of an electronic device. As shown in FIG4, the electronic device may include: a processor 410, a communication interface 420, a memory 430 and a communication bus 440, wherein the processor 410, the communication interface 420 and the memory 430 communicate with each other through the communication bus 440. The processor 410 may call the logic instructions in the memory 430 to execute the detection method of the application fingerprint, which method includes: obtaining network traffic data; inputting the network traffic data into a decoder to obtain a plurality of network protocol fields connected by Boolean logic; matching the corresponding target application identifier in the first rule file according to the plurality of network protocol fields, wherein the first rule file is a file stored locally, and the first rule file pre-stores the field and the application identifier corresponding to the field; matching the corresponding target application fingerprint information in the second rule file according to the target application identifier, wherein the second rule file is a file stored locally, and the second rule file pre-stores the application identifier and the application fingerprint information corresponding to the application identifier.

In addition, the logic instructions in the above-mentioned memory 430 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

On the other hand, the present invention also provides a computer program product, which includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the application fingerprint detection method provided by the above methods, the method including: obtaining network traffic data; inputting the network traffic data into a decoder to obtain multiple network protocol fields, wherein the network protocol field includes a field name and a field content; performing matching based on Boolean logic rules in a first rule file according to the field names and the field contents of the multiple network protocol fields to obtain a corresponding target application identifier, wherein the first rule file is a file stored locally, and the first rule file pre-stores a Boolean logic rule and an application identifier corresponding to the Boolean logic rule, and the Boolean logic rule has at least one logical node connected by Boolean logic characters, and the logical node includes a first field name and a first field content; matching the corresponding target application fingerprint information in a second rule file according to the target application identifier, wherein the second rule file is a file stored locally, and the second rule file pre-stores an application identifier and an application fingerprint information corresponding to the application identifier.

On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the application fingerprint detection method provided by the above-mentioned methods, the method comprising: obtaining network traffic data; inputting the network traffic data into a decoder to obtain multiple network protocol fields, wherein the network protocol field includes a field name and a field content; performing matching based on Boolean logic rules in a first rule file according to the field names and the field contents of the multiple network protocol fields to obtain a corresponding target application identifier, wherein the first rule file is a file stored locally, and the first rule file pre-stores Boolean logic rules and application identifiers corresponding to the Boolean logic rules, and the Boolean logic rules have at least one logical node connected by Boolean logic characters, and the logical node includes a first field name and a first field content; matching the corresponding target application fingerprint information in a second rule file according to the target application identifier, wherein the second rule file is a file stored locally, and the second rule file pre-stores an application identifier and application fingerprint information corresponding to the application identifier.

The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Those of ordinary skill in the art may understand and implement it without creative effort.

Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM/RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims (11)

1. A method for detecting an application fingerprint, comprising:

acquiring network traffic data;

Inputting the network traffic data into a decoder to obtain a plurality of network protocol fields, wherein the network protocol fields comprise field names and field contents;

Matching the field names and the field contents of the network protocol fields based on a Boolean logic rule in a first rule file to obtain a corresponding target application identifier, wherein the first rule file is a file stored locally, the first rule file is pre-stored with the Boolean logic rule and the application identifier corresponding to the Boolean logic rule, the Boolean logic rule is provided with at least one logic node connected through Boolean logic characters, and the logic node comprises a first field name and first field contents; the matching based on boolean logic rules is performed in a first rule file according to the field names and the field contents of the network protocol fields to obtain corresponding target application identifications, including: according to different types of field sets and corresponding preset sequences, sequentially matching the field names of the network protocol fields in each field set with target application identifiers corresponding to Boolean logic rules according to field contents in each field set; the field set is a request header field set corresponding to a request header, a request body field set corresponding to a request body, a response header field set corresponding to a response header and a response body field set corresponding to a response body, which are obtained by inputting the network traffic data into a decoder; the preset sequence is a request header field set, a request body field set, a response header field set and a response body field set;

And matching corresponding target application fingerprint information in a second rule file according to the target application identifier, wherein the second rule file is a file stored locally, and the second rule file is pre-stored with the application identifier and the application fingerprint information corresponding to the application identifier.

2. The method for detecting an application fingerprint according to claim 1, wherein the network protocol fields include a request header network protocol field, a request body network protocol field, a response header network protocol field, and a response body network protocol field;

The step of inputting the network traffic data into a decoder to obtain field names and field contents of a plurality of network protocol fields includes:

Inputting the network flow data into a decoder, and decoding according to a preset decoding rule to obtain a request head, a request body, a response head and a response body;

Decoding the request header, the request body, the response header and the response body according to a preset decoding rule to obtain a request header field set corresponding to the request header, a request body field set corresponding to the request body, a response header field set corresponding to the response header and a response body field set corresponding to the response body;

the request header field set comprises field names and field contents of at least one request header network protocol field, the request body field set comprises field names and field contents of at least one request body network protocol field, the response header field set comprises field names and field contents of at least one response header network protocol field, and the response body field set comprises field names and field contents of at least one response body network protocol field.

3. The method for detecting an application fingerprint according to claim 2, wherein the step of sequentially matching, in a first rule file, a target application identifier corresponding to a boolean logic rule to which the field name and the field content of the network protocol field in each field set conform, includes:

for each field set, matching a target application identifier corresponding to a boolean logic rule according to the field name and the field content of the network protocol field in a first rule file;

The Boolean logic rule is a Boolean logic rule which has logic nodes consistent with the field names and the field contents and meets the conditions corresponding to the Boolean logic characters.

4. The method for detecting an application fingerprint according to claim 3, wherein the field set contains the field names and the field contents of a plurality of network protocol fields; the Boolean logic rule comprises a plurality of logic nodes, and the Boolean logic characters are AND logic characters;

The step of matching the target application identifier corresponding to the met boolean logic rule in the first rule file according to the field name and the field content of the network protocol field includes:

According to the field names and the field contents of the network protocol fields, matching the target application identifier corresponding to the Boolean logic rule conforming to the first condition in a first rule file;

the first condition is that the field names of the plurality of network protocol fields simultaneously meet and coincide with the first field names of the plurality of logical nodes, and the field contents corresponding to the field names in the plurality of network protocol fields simultaneously meet and coincide with the first field contents of the plurality of logical nodes.

5. The method for detecting an application fingerprint according to claim 3, wherein the field set contains the field names and the field contents of a plurality of network protocol fields; the Boolean logic rule comprises a plurality of logic nodes, and the Boolean logic characters are OR logic characters;

The step of matching the target application identifier corresponding to the met boolean logic rule in the first rule file according to the field name and the field content of the network protocol field includes:

According to the field names and the field contents of the network protocol fields, matching the target application identifier corresponding to the Boolean logic rule conforming to the second condition in a first rule file;

The second condition is that the field names of the network protocol fields are consistent with the first field name of any one of the logic nodes, the field content corresponding to the field names in the network protocol fields is consistent with the first field content of a determined logic node, and the determined logic node is a logic node with the field name consistent with the first field name.

6. The method for detecting an application fingerprint according to claim 3, wherein the step of matching, in a first rule file, a target application identifier corresponding to a boolean logic rule according to the field name and the field content of the network protocol field further comprises:

And stopping subsequent matching when the target application identifier corresponding to the met Boolean logic rule is successfully matched in the first rule file according to the field name and the field content of the network protocol field.

7. The method for detecting an application fingerprint according to claim 1, wherein the target application fingerprint information includes application attribute information and application source information, wherein the application attribute information includes an application name, an application description, and an application version, and the application source information includes an IP address and port information;

the step of matching the target application fingerprint information in the second rule file according to the target application identifier comprises the following steps:

According to the target application identifier, matching the application description, the application version, the IP address and the port information in the second rule file, taking the target application name, the application description and the application version as the application attribute information, and taking the IP address and the port information as the application source information;

And generating the target application fingerprint information according to the application attribute information and the application source information.

8. A detection apparatus for applying a fingerprint, comprising:

the acquisition unit is used for acquiring network traffic data;

The analysis unit is used for inputting the network traffic data into the decoder to obtain a plurality of network protocol fields, wherein the network protocol fields comprise field names and field contents;

The first matching unit is used for matching a Boolean logic rule in a first rule file according to the field names and the field contents of the plurality of network protocol fields to obtain corresponding target application identifiers, wherein the first rule file is a file stored locally, the Boolean logic rule and the application identifier corresponding to the Boolean logic rule are prestored in the first rule file, the Boolean logic rule is provided with Boolean logic characters and at least one logic node, and the logic node comprises a first field name and first field contents; the matching based on boolean logic rules is performed in a first rule file according to the field names and the field contents of the network protocol fields to obtain corresponding target application identifications, including: according to different types of field sets and corresponding preset sequences, sequentially matching the field names of the network protocol fields in each field set with target application identifiers corresponding to Boolean logic rules according to field contents in each field set; the field set is a request header field set corresponding to a request header, a request body field set corresponding to a request body, a response header field set corresponding to a response header and a response body field set corresponding to a response body, which are obtained by inputting the network traffic data into a decoder; the preset sequence is a request header field set, a request body field set, a response header field set and a response body field set;

and the second matching unit is used for matching corresponding target application fingerprint information in a second rule file according to the target application identifier, wherein the second rule file is a file stored locally, and the second rule file is pre-stored with the application identifier and the application fingerprint information corresponding to the application identifier.

9. An electronic device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, characterized in that the processor implements the steps of the method for detecting an application fingerprint according to any one of claims 1 to 7 when the program is executed.

10. A non-transitory computer readable storage medium, on which a computer program is stored, characterized in that the computer program, when being executed by a processor, implements the steps of the detection method of application fingerprints according to any one of claims 1 to 7.

11. A computer program product comprising a computer program which, when executed by a processor, implements the steps of the method for detecting an application fingerprint according to any one of claims 1 to 7.