Granted Patent B2

US 12,355,790 · App. 17/991,770 · Granted Jul 8, 2025

Inventors: Hang Li (Shenzhen, CN); Liquan Nie (Shenzhen, CN); Fan Zeng (Shenzhen, CN); Keyun Luo (Shenzhen, CN)

Assignee: TENCENT TECHNOLOGY (SHENZHEN) COMPANY LIMITED

H04L63/1425H04L63/0254H04L63/1416H04L63/20

Abstract

Claims (94)

1. A data packet processing method performed by an electronic device, the method comprising:

obtaining a target network data packet submitting by a client;

generating data packet fingerprints of the target network data packet, the data packet fingerprints comprising a target client fingerprint, a target traffic attribute fingerprint and a target traffic payload fingerprint, further comprising:

obtaining a link protocol type of the target network data packet and an operating system type and a user agent (UA) field of the client submitting the target network data packet;

combining the link protocol type and the operating system type and the UA field of the client as the target traffic attribute fingerprint;

searching a traffic payload key string library for a similar payload key string and a continuous attack key string belonging to the target network data packet;

determining a data fingerprint of the similar payload key string and a data fingerprint of the continuous attack key string; and

combining the data fingerprints of the similar payload key string and the continuous attack key string as the target traffic payload fingerprint;

determining a type of the target network data packet according to an occurrence frequency of the target client fingerprint in a device fingerprint database, an occurrence frequency of the target traffic payload fingerprint in a fingerprint database and the target traffic attribute fingerprint, the fingerprint database comprising historical traffic payload fingerprints of a plurality of historical network data packets, further including:

determining a device confidence according to the occurrence frequency of the target client fingerprint in the device fingerprint database;

determining a traffic payload confidence according to the occurrence frequency of the target traffic payload fingerprint in the fingerprint database;

determining a traffic attribute confidence corresponding to the link protocol type and the operating system type and the UA field of the client in the target traffic attribute fingerprint;

summing the device confidence, the traffic payload confidence and the traffic attribute confidence into a target confidence; and

determining that the type of the target network data packet is an abnormal type when the target confidence is greater than a first confidence threshold; and

blocking a network connection of the target network data packet when the type of the target network data packet is the abnormal type by respectively transmitting a blocking message to the client of the target network data packet and a service server corresponding to the target network data packet, wherein the blocking message is used for (i) blocking a network connection between the client and the service server and (ii) causing the service server to release connection resources occupied by the client for responding to requests of other normal types of target network data packets.

2. The method according to claim 1 , wherein the fingerprint database comprises a similar payload fingerprint database, and a continuous attack fingerprint database; and

the method further comprises:

counting a similar payload fingerprint occurrence frequency of the data fingerprint of the similar payload key string in the similar payload fingerprint database;

counting a continuous attack fingerprint occurrence frequency of the data fingerprint of the continuous attack key string in the continuous attack fingerprint database; and

determining the similar payload fingerprint occurrence frequency and the continuous attack fingerprint occurrence frequency as the occurrence frequency of the target traffic payload fingerprint in the fingerprint database.

3. The method according to claim 2 , wherein the determining a traffic payload confidence according to the occurrence frequency of the target traffic payload fingerprint in the fingerprint database comprises:

determining a similar payload confidence according to the similar payload fingerprint occurrence frequency;

determining a device confidence according to the device fingerprint occurrence frequency;

determining a continuous attack confidence according to the continuous attack fingerprint occurrence frequency; and

superimposing the similar payload confidence, the device confidence, and the continuous attack confidence into the traffic payload confidence.

4. The method according to claim 1 , further comprising:

obtaining the plurality of historical network data packets, and extracting a gateway location address from each of the historical network data packets to obtain a plurality of gateway location addresses corresponding to the plurality of historical network data packets;

determining a plurality of first frequent sequence patterns from the plurality of gateway location addresses, and screening a similar payload high-frequency key string set from the plurality of first frequent sequence patterns;

determining a gateway location address template of each of the historical network data packets according to the similar payload high-frequency key string set;

calling a fingerprint identification function to determine a client fingerprint of each of the historical network data packets, to obtain a plurality of client fingerprints corresponding to the plurality of historical network data packets; and

storing data fingerprints of a plurality of gateway location address templates and the plurality of client fingerprints in the fingerprint database, wherein the data fingerprints of the plurality of gateway location address templates stored in the fingerprint database are used for determining a similar payload fingerprint occurrence frequency, and the plurality of client fingerprints stored in the fingerprint database are used for determining a device fingerprint occurrence frequency.

5. The method according to claim 4 , wherein the fingerprint database comprises a similar payload fingerprint database; and

the storing data fingerprints of a plurality of gateway location address templates and the plurality of client fingerprints in the fingerprint database comprises:

storing the data fingerprints of the plurality of gateway location address templates in the similar payload fingerprint database; and

storing the plurality of client fingerprints in the device fingerprint database.

6. The method according to claim 5 , wherein the fingerprint database further comprises a continuous attack fingerprint database, and the plurality of historical network data packets are network data packets at a plurality of continuous attack stages; and

the method further comprises:

dividing the plurality of historical network data packets into a plurality of data packet sets, wherein each of the data packet sets belongs to an attack stage;

determining a plurality of second frequent sequence patterns of each of the data packet sets, and screening a continuous attack high-frequency key string set of each of the data packet sets from the plurality of second frequent sequence patterns;

determining a continuous attack template of each historical network data packet in each of the data packet sets according to the continuous attack high-frequency key string set; and

storing a data fingerprint of the continuous attack template of each of the historical network data packets in the continuous attack fingerprint database, wherein the data fingerprint of the continuous attack template of each of the historical network data packets stored in the fingerprint database is used for determining a continuous attack fingerprint occurrence frequency.

7. The method according to claim 4 , wherein the storing data fingerprints of the plurality of gateway location address templates and the plurality of client fingerprints in the fingerprint database comprises:

obtaining a historical traffic attribute fingerprint and a historical traffic payload fingerprint of each of the historical network data packets;

determining a first confidence of each of the historical traffic attribute fingerprints;

determining a second confidence of each of the historical traffic payload fingerprints according to an occurrence frequency of each of the historical traffic payload fingerprints in all the historical traffic payload fingerprints;

obtaining a sum of a plurality of first confidences and a plurality of second confidences to obtain a total confidence; and

storing the data fingerprints of the plurality of gateway location address templates and the plurality of client fingerprints in the fingerprint database when the total confidence is greater than a second confidence threshold.

8. The method according to claim 1 , wherein

the determining a traffic attribute confidence corresponding to the link protocol type and the operating system type and the UA field of the client in the target traffic attribute fingerprint comprises:

determining a protocol confidence according to the link protocol type;

determining a client content confidence according to the operating system type and the UA field of the client ; and

superimposing the protocol confidence, the client content confidence into the traffic attribute confidence.

9. An electronic device for data packet processing, comprising a memory and a processor, the memory storing a computer program, the computer program, when executed by the processor, causing the electronic device to perform a data packet processing method including:

obtaining a target network data packet submitting by a client;

generating data packet fingerprints of the target network data packet, the data packet fingerprints comprising a target client fingerprint, a target traffic attribute fingerprint and a target traffic payload fingerprint, further comprising:

obtaining a link protocol type of the target network data packet and an operating system type and a user agent (UA) field of the client submitting the target network data packet;

combining the link protocol type and the operating system type and the UA field of the client as the target traffic attribute fingerprint;

searching a traffic payload key string library for a similar payload key string and a continuous attack key string belonging to the target network data packet;

determining a data fingerprint of the similar payload key string and a data fingerprint of the continuous attack key string; and

combining the data fingerprints of the similar payload key string and the continuous attack key string as the target traffic payload fingerprint;

determining a type of the target network data packet according to an occurrence frequency of the target client fingerprint in a device fingerprint database, an occurrence frequency of the target traffic payload fingerprint in a fingerprint database and the target traffic attribute fingerprint, the fingerprint database comprising historical traffic payload fingerprints of a plurality of historical network data packets, further including:

determining a device confidence according to the occurrence frequency of the target client fingerprint in the device fingerprint database;

determining a traffic payload confidence according to the occurrence frequency of the target traffic payload fingerprint in the fingerprint database;

determining a traffic attribute confidence corresponding to the link protocol type and the operating system type and the UA field of the client in the target traffic attribute fingerprint;

summing the device confidence, the traffic payload confidence and the traffic attribute confidence into a target confidence; and

determining that the type of the target network data packet is an abnormal type when the target confidence is greater than a first confidence threshold; and

blocking a network connection of the target network data packet when the type of the target network data packet is the abnormal type by respectively transmitting a blocking message to the client of the target network data packet and a service server corresponding to the target network data packet, wherein the blocking message is used for (i) blocking a network connection between the client and the service server and (ii) causing the service server to release connection resources occupied by the client for responding to requests of other normal types of target network data packets.

10. The electronic device according to claim 9 , wherein the method further comprises:

obtaining the plurality of historical network data packets, and extracting a gateway location address from each of the historical network data packets to obtain a plurality of gateway location addresses corresponding to the plurality of historical network data packets;

determining a plurality of first frequent sequence patterns from the plurality of gateway location addresses, and screening a similar payload high-frequency key string set from the plurality of first frequent sequence patterns;

determining a gateway location address template of each of the historical network data packets according to the similar payload high-frequency key string set;

calling a fingerprint identification function to determine a client fingerprint of each of the historical network data packets, to obtain a plurality of client fingerprints corresponding to the plurality of historical network data packets; and

storing data fingerprints of the plurality of gateway location address templates and the plurality of client fingerprints in the fingerprint database, wherein the data fingerprints of the plurality of gateway location address templates stored in the fingerprint database are used for determining a similar payload fingerprint occurrence frequency, and the plurality of client fingerprints stored in the fingerprint database are used for determining a device fingerprint occurrence frequency.

11. A non-transitory computer-readable storage medium, storing a computer program, the computer program, when executed by a processor of an electronic device, causing the electronic device to perform a data packet processing method including:

obtaining a target network data packet submitting by a client;

generating data packet fingerprints of the target network data packet, the data packet fingerprints comprising a target client fingerprint, a target traffic attribute fingerprint and a target traffic payload fingerprint, further comprising:

obtaining a link protocol type of the target network data packet and an operating system type and a user agent (UA) field of the client submitting the target network data packet;

combining the link protocol type and the operating system type and the UA field of the client as the target traffic attribute fingerprint;

searching a traffic payload key string library for a similar payload key string and a continuous attack key string belonging to the target network data packet;

determining a data fingerprint of the similar payload key string and a data fingerprint of the continuous attack key string; and

combining the data fingerprints of the similar payload key string and the continuous attack key string as the target traffic payload fingerprint;

determining a type of the target network data packet according to an occurrence frequency of the target client fingerprint in a device fingerprint database, an occurrence frequency of the target traffic payload fingerprint in a fingerprint database and the target traffic attribute fingerprint, the fingerprint database comprising historical traffic payload fingerprints of a plurality of historical network data packets, further including:

determining a device confidence according to the occurrence frequency of the target client fingerprint in the device fingerprint database;

determining a traffic payload confidence according to the occurrence frequency of the target traffic payload fingerprint in the fingerprint database;

determining a traffic attribute confidence corresponding to the link protocol type and the operating system type and the UA field of the client in the target traffic attribute fingerprint;

summing the device confidence, the traffic payload confidence and the traffic attribute confidence into a target confidence; and

determining that the type of the target network data packet is an abnormal type when the target confidence is greater than a first confidence threshold; and

blocking a network connection of the target network data packet when the type of the target network data packet is the abnormal type by respectively transmitting a blocking message to the client of the target network data packet and a service server corresponding to the target network data packet, wherein the blocking message is used for (i) blocking a network connection between the client and the service server and (ii) causing the service server to release connection resources occupied by the client for responding to requests of other normal types of target network data packets.

12. The non-transitory computer-readable storage medium according to claim 11 , wherein the method further comprises:

obtaining the plurality of historical network data packets, and extracting a gateway location address from each of the historical network data packets to obtain a plurality of gateway location addresses corresponding to the plurality of historical network data packets;

determining a plurality of first frequent sequence patterns from the plurality of gateway location addresses, and screening a similar payload high-frequency key string set from the plurality of first frequent sequence patterns;

determining a gateway location address template of each of the historical network data packets according to the similar payload high-frequency key string set;

calling a fingerprint identification function to determine a client fingerprint of each of the historical network data packets, to obtain a plurality of client fingerprints corresponding to the plurality of historical network data packets; and

storing data fingerprints of the plurality of gateway location address templates and the plurality of client fingerprints in the fingerprint database, wherein the data fingerprints of the plurality of gateway location address templates stored in the fingerprint database are used for determining a similar payload fingerprint occurrence frequency, and the plurality of client fingerprints stored in the fingerprint database are used for determining a device fingerprint occurrence frequency.

Assignments (1)

Priority Claims (1)

Continuity (2)

References Cited (29)