技术领域technical field
本发明属于网络交易安全技术领域。The invention belongs to the technical field of network transaction security.
背景技术Background technique
随着互联网的飞速发展以及计算机科学技术的不断进步，网络交易也如火如荼地迅猛发展起来，这不仅给我国经济的发展提供了持续的动力，同时也给广大人民的生活带来了极大的便利。越来越多的人通过网络交易和支付方式开展业务活动，网络交易的发展前景十分广阔。With the rapid development of the Internet and the continuous advancement of computer science and technology, online transactions have also developed rapidly, which not only provides a continuous impetus to the development of my country's economy, but also brings great convenience to the lives of the people . More and more people carry out business activities through online transactions and payment methods, and the development prospects of online transactions are very broad.
然而，由于网络交易和支付平台兴起不久，网络支付的安全体系还不健全，网络交易流程和行为的可信问题也变得越来越突出，已逐渐成为网络交易发展面临的瓶颈问题。在网络交易中面临的一个问题是，用户身份的可信问题，即参与网络交易的用户身份是否合法。针对这个问题，目前电子商务企业普遍采取的解决方案是数字证书和对软件进行补丁更新或是版本升级。经过调研，以国内某大型网络支付平台公司为例，目前的解决策略在业界的应用存在明显的不足，当用户的账户密码被盗后,无法识别黑客盗用用户的账户进行交易,侵害用户利益的用户身份可信问题。存在这些不足主要原因在于,目前还缺乏一套针对网络交易的可信认证系统，去监控和管理交易中各方的身份和交易行为的可信问题。However, due to the recent rise of online transaction and payment platforms, the security system of online payment is not perfect, and the credibility of online transaction processes and behaviors has become more and more prominent, which has gradually become a bottleneck problem facing the development of online transactions. One of the problems faced in network transactions is the credibility of user identities, that is, whether the user identities participating in network transactions are legal. In response to this problem, the solutions commonly adopted by e-commerce companies are digital certificates and software patch updates or version upgrades. After investigation, taking a large domestic online payment platform company as an example, the current solution strategy has obvious shortcomings in the application of the industry. When the user's account password is stolen, it is impossible to identify the hacker who has stolen the user's account for transactions and violated the user's interests. User identity credible issues. The main reason for these shortcomings is that there is still a lack of a credible authentication system for online transactions to monitor and manage the credibility of the identities and transaction behaviors of all parties in the transaction.
发明内容Contents of the invention
针对这个问题的一种解决方案是，搭建网络交易的第四方认证中心和安全客户端，形成网络交易可信认证系统平台，并制定网络交易可信认证的认证协议。One solution to this problem is to build a fourth-party authentication center and secure client for online transactions, form a trusted authentication system platform for online transactions, and formulate an authentication protocol for trusted authentication of online transactions.
本发明面向的情况是，在可信认证系统中，使用监控器记录客户端用户的上网浏览行为，并以特殊的格式保存成日志文件，以便安全客户端完成其余部分的工作，进而保证可信认证系统的实行。The situation faced by the present invention is that in the trusted authentication system, the monitor is used to record the surfing behavior of the client user, and save it as a log file in a special format, so that the secure client can complete the rest of the work, thereby ensuring the authenticity Implementation of the authentication system.
本发明给出的技术方案为：The technical scheme provided by the present invention is:
一种可信网络交易系统客户端监控器，其特征在于，监控器的功能主要包括两个方面。首先，监控器能够分析提取出用户上网过程中的浏览行为；其次，监控器能把提取出的浏览行为按照特定的格式存储为行为日志。所述浏览行为，即描述一个用户上网过程中特定方式的上网习惯，包括浏览的网页，偏好的上网时间等。监控器捕获用户网络适配器的IP数据包，根据IP报文的格式、TCP数据包的格式以及HTTP数据包格式，层层解析，提取出IP数据包中的浏览网页，上网时间等信息。A client monitor of a trusted network transaction system is characterized in that the functions of the monitor mainly include two aspects. First, the monitor can analyze and extract the browsing behavior of the user during the surfing process; secondly, the monitor can store the extracted browsing behavior as a behavior log in a specific format. The browsing behavior refers to describing a user's surfing habits in a specific way during the surfing process, including webpages browsed, preferred surfing time, and the like. The monitor captures the IP data packets of the user's network adapter, and analyzes them layer by layer according to the format of the IP packets, TCP data packets and HTTP data packets, and extracts information such as browsing webpages and online time in the IP data packets.
所述行为日志，即刻画用户浏览行为的文本文件。用户浏览行为中的关键信息，如浏览的网页，偏好的上网时间等都需要按照特定的格式存储在行为日志当中。监控器捕捉的用户的网络数据，并经过解析提取出浏览行为信息之后，将浏览行为存储在行为日志当中。每当捕获到新的浏览行为时，及时更新行为日志，以保证行为日志能够充分完备地记录用户的浏览行为，为之后的可信安全客户端的工作提供充足的资料。The behavior log is a text file describing the user's browsing behavior. The key information in the user's browsing behavior, such as the web pages browsed and the preferred online time, etc., need to be stored in the behavior log according to a specific format. The monitor captures the user's network data, and after parsing and extracting the browsing behavior information, the browsing behavior is stored in the behavior log. Whenever a new browsing behavior is captured, the behavior log is updated in time to ensure that the behavior log can fully record the user's browsing behavior and provide sufficient information for the subsequent work of the trusted security client.
除此之外，为了保证用户的浏览行为能够全面地记录，监控器应该在开机后自动运行，捕获用户的上网浏览行为。In addition, in order to ensure that the user's browsing behavior can be fully recorded, the monitor should automatically run after booting to capture the user's Internet browsing behavior.
监控器捕获浏览行为模式的方法，其特征在于，包括如下步骤：The method for a monitor to capture a browsing behavior pattern is characterized in that it comprises the following steps:
1、监控器启动之后，请求访问当前主机上的网络适配器接口。成功获得网络适配器的访问接口之后，开始捕获该网络适配器接口的IP层数据包。1. After the monitor starts, it requests access to the network adapter interface on the current host. After successfully obtaining the access interface of the network adapter, start to capture the IP layer data packets of the network adapter interface.
2、根据IP协议的报文格式，提取出IP数据包中的数据部分，进行下一步解析。由于IP协议作为网络层协议，为多种类型的传输层协议提供服务，所以对提取出的IP数据包需要进行判断，如果其为TCP数据包，则保留该数据包进行下一步解析；如果不是TCP数据包，则不保留该数据包。2. According to the message format of the IP protocol, the data part in the IP data packet is extracted, and the next step is analyzed. Since the IP protocol, as a network layer protocol, provides services for various types of transport layer protocols, it is necessary to judge the extracted IP data packet, if it is a TCP data packet, then keep the data packet for further analysis; if not TCP packet, the packet is not preserved.
3、当获得TCP数据包后，根据TCP协议格式，对TCP数据包进行解析，如果该TCP数据包封装了HTTP数据包，则提取出该HTTP数据包，否则丢弃TCP数据包。3. After obtaining the TCP data packet, analyze the TCP data packet according to the TCP protocol format, if the TCP data packet encapsulates the HTTP data packet, extract the HTTP data packet, otherwise discard the TCP data packet.
4、对于HTTP数据包，即用户浏览网页所产生的数据包，根据其协议格式，可以从数据包中提取出访问网页的地址、访问网页的时间、该网页的引用页以及网页的标题等信息。4. For the HTTP data packet, that is, the data packet generated by the user browsing the webpage, according to its protocol format, information such as the address of the visited webpage, the time of visiting the webpage, the reference page of the webpage, and the title of the webpage can be extracted from the data packet. .
5、提取出浏览行为后，按照如下格式存储到XML文件中。5. After extracting the browsing behavior, store it in the XML file according to the following format.
其中root作为根元素有且只有一个，所有的信息均是root结点的子结点。Among them, there is one and only one root as the root element, and all the information is the child node of the root node.
Capture表示监控器所捕获到的一条浏览行为，在capture中包含6个元素，分别表示6种对应信息。Capture represents a browsing behavior captured by the monitor, and the capture contains 6 elements, which respectively represent 6 corresponding information.
id表示某个浏览行为的编号，编号从1开始，每捕获一条浏览行为，编号自动增加。id indicates the number of a certain browsing behavior, the number starts from 1, and every time a browsing behavior is captured, the number increases automatically.
url是浏览行为中最重要的信息，表示用户所访问的网页的网址。通过分析解析该网址，可以发现用户访问的网站内容，以此刻画用户的浏览行为。The url is the most important information in the browsing behavior, and represents the URL of the web page visited by the user. By analyzing and analyzing the URL, the content of the website visited by the user can be discovered, so as to describe the browsing behavior of the user.
referer表示某个网页的引用页面，如当用户通过百度搜索查找关键词sina并进入新浪主页之后，在新浪主页的浏览记录中即存在着引用页百度。引用页面刻画了浏览行为中的先后序列关系。Referer means the referring page of a certain webpage. For example, when a user searches for the keyword sina through Baidu search and enters the homepage of Sina, the referring page Baidu exists in the browsing history of the homepage of Sina. Citing pages describe the sequential relationship in browsing behavior.
timestamp，即访问某个网页的时刻。timestamp, that is, the moment when a web page is accessed.
title表示浏览网页的题目。Title是url的补充和完善，在分析浏览行为时可以起到辅助的作用。title represents the title of browsing the web page. Title is the supplement and improvement of url, which can play an auxiliary role in analyzing browsing behavior.
keywords表示网页的关键字，通过keywords可以确定网页所属的类别。The keywords represent the keywords of the webpage, and the category to which the webpage belongs can be determined through the keywords.
6、将上述各xml文件存储生成访问日志，为第三方认证中心完成基于行为模式的认证提供了直接和充足的数据。6. Store the above xml files to generate access logs, providing direct and sufficient data for the third-party authentication center to complete authentication based on behavior patterns.
本发明的创新点及有益效果Innovation point and beneficial effect of the present invention
1)利用监控器捕捉浏览行为，通过解析捕捉到的数据包提取用户的行为信息。1) Use the monitor to capture browsing behavior, and extract user behavior information by analyzing the captured data packets.
2)采用xml文件存储行为日志，便于文件的传输和解析。2) Use xml files to store behavior logs, which is convenient for file transmission and analysis.
3)作为可信交易安全客户端的基础组件，为后续的工作如基于行为模式的证书等提供了直接和充足的数据。在可信认证系统中，使用本发明监控器记录客户端用户的上网浏览行为，并以特殊的格式保存成日志文件，以便安全客户端完成其余部分的工作，进而保证可信认证系统的实行。3) As a basic component of the trusted transaction security client, it provides direct and sufficient data for subsequent work such as certificates based on behavior patterns. In the credible authentication system, the monitor of the present invention is used to record the surfing behavior of the client user, and save it as a log file in a special format, so that the security client can complete the rest of the work, thereby ensuring the implementation of the credible authentication system.
附图说明Description of drawings
图1监控器工作流程。Figure 1 Monitor workflow.
具体实施方式Detailed ways
监控器捕获浏览行为模式，即监控器的工作流程如图1所示。The monitor captures browsing behavior patterns, that is, the workflow of the monitor is shown in Figure 1.
1、监控器启动之后，请求访问当前主机上的网络适配器接口。成功获得网络适配器的访问接口之后，开始捕获该网络适配器接口的IP层数据包。1. After the monitor starts, it requests access to the network adapter interface on the current host. After successfully obtaining the access interface of the network adapter, start to capture the IP layer data packets of the network adapter interface.
2、根据IP协议的报文格式，提取出IP数据包中的数据部分，进行下一步解析。由于IP协议作为网络层协议，为多种类型的传输层协议提供服务，所以对提取出的IP数据包需要进行判断，如果其为TCP数据包，则保留该数据包进行下一步解析；如果不是TCP数据包，则不保留该数据包。2. According to the message format of the IP protocol, the data part in the IP data packet is extracted, and the next step is analyzed. Since the IP protocol, as a network layer protocol, provides services for various types of transport layer protocols, it is necessary to judge the extracted IP data packet, if it is a TCP data packet, then keep the data packet for further analysis; if not TCP packet, the packet is not preserved.
3、当获得TCP数据包后，根据TCP协议格式，对TCP数据包进行解析，如果该TCP数据包封装了HTTP数据包，则提取出该HTTP数据包，否则丢弃TCP数据包。3. After obtaining the TCP data packet, analyze the TCP data packet according to the TCP protocol format, if the TCP data packet encapsulates the HTTP data packet, extract the HTTP data packet, otherwise discard the TCP data packet.
4、对于HTTP数据包，即用户浏览网页所产生的数据包，根据其协议格式，可以从数据包中提取出访问网页的地址、访问网页的时间、该网页的引用页以及网页的标题等信息。4. For the HTTP data packet, that is, the data packet generated by the user browsing the webpage, according to its protocol format, information such as the address of the visited webpage, the time of visiting the webpage, the reference page of the webpage, and the title of the webpage can be extracted from the data packet. .
5、提取出浏览行为后，按照如下格式存储到XML文件中。5. After extracting the browsing behavior, store it in the XML file according to the following format.
其中root作为根元素有且只有一个，所有的信息均是root结点的子结点。Among them, there is one and only one root as the root element, and all the information is the child node of the root node.
Capture表示监控器所捕获到的一条浏览行为，在capture中包含6个元素，分别表示6种对应信息。Capture represents a browsing behavior captured by the monitor, and the capture contains 6 elements, which respectively represent 6 corresponding information.
id表示某个浏览行为的编号，编号从1开始，每捕获一条浏览行为，编号自动增加。id indicates the number of a certain browsing behavior, the number starts from 1, and every time a browsing behavior is captured, the number increases automatically.
url是浏览行为中最重要的信息，表示用户所访问的网页的网址。通过分析解析该网址，可以发现用户访问的网站内容，以此刻画用户的浏览行为。The url is the most important information in the browsing behavior, and represents the URL of the web page visited by the user. By analyzing and analyzing the URL, it is possible to discover the content of the website visited by the user, so as to describe the browsing behavior of the user.
referer表示某个网页的引用页面，如当用户通过百度搜索查找关键词sina并进入新浪主页之后，在新浪主页的浏览记录中即存在着引用页百度。引用页面刻画了浏览行为中的先后序列关系。Referer means the referring page of a certain webpage. For example, when a user searches for the keyword sina through Baidu search and enters the homepage of Sina, the referring page Baidu exists in the browsing history of the homepage of Sina. Citing pages describe the sequential relationship in browsing behavior.
timestamp，即访问某个网页的时刻。timestamp, that is, the moment when a web page is accessed.
title表示浏览网页的题目，如访问百度的主页时，对应title为“百度一下，你就知道”。Title是url的补充和完善，在分析浏览行为时可以起到辅助的作用。Title indicates the title of browsing the webpage. For example, when visiting Baidu's homepage, the corresponding title is "Baidu, you will know". Title is the supplement and improvement of url, which can play an auxiliary role in analyzing browsing behavior.
keywords表示网页的关键字，通过keywords可以确定网页所属的类别。The keywords represent the keywords of the webpage, and the category to which the webpage belongs can be determined through the keywords.
6、将上述各xml文件存储生成访问日志，为第三方认证中心完成基于行为模式的认证提供了直接和充足的数据。6. Store the above xml files to generate access logs, providing direct and sufficient data for the third-party authentication center to complete authentication based on behavior patterns.
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201410499290.9ACN104270358B (en) | 2014-09-25 | 2014-09-25 | Trustable network transaction system client monitor and its implementation |
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201410499290.9ACN104270358B (en) | 2014-09-25 | 2014-09-25 | Trustable network transaction system client monitor and its implementation |
| Publication Number | Publication Date |
|---|---|
| CN104270358A CN104270358A (en) | 2015-01-07 |
| CN104270358Btrue CN104270358B (en) | 2018-10-26 |
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201410499290.9AActiveCN104270358B (en) | 2014-09-25 | 2014-09-25 | Trustable network transaction system client monitor and its implementation |
| Country | Link |
|---|---|
| CN (1) | CN104270358B (en) |
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105337987B (en)* | 2015-11-20 | 2018-07-03 | 同济大学 | A kind of method for authentication of identification of network user and system |
| CN105323261A (en)* | 2015-12-15 | 2016-02-10 | 北京奇虎科技有限公司 | Data detection method and device |
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101582817A (en)* | 2009-06-29 | 2009-11-18 | 华中科技大学 | Method for extracting network interactive behavioral pattern and analyzing similarity |
| CN101909079A (en)* | 2010-07-15 | 2010-12-08 | 北京迈朗世讯科技有限公司 | User online behavior data acquisition method in backbone link and system |
| CN102004770A (en)* | 2010-11-16 | 2011-04-06 | 杭州迪普科技有限公司 | Webpage auditing method and device |
| CN102780682A (en)* | 2011-05-12 | 2012-11-14 | 同济大学 | Website behavior model modeling method based on HTML (Hyper Text Markup Language) |
| CN102970289A (en)* | 2012-11-09 | 2013-03-13 | 同济大学 | Identity authentication method based on Web user behavior model |
| CN102999572A (en)* | 2012-11-09 | 2013-03-27 | 同济大学 | User behavior mode digging system and user behavior mode digging method |
| CN103118007A (en)* | 2013-01-06 | 2013-05-22 | 瑞斯康达科技发展股份有限公司 | Method and system of acquiring user access behavior |
| CN103699823A (en)* | 2014-01-08 | 2014-04-02 | 同济大学 | Identity authentication system based on user behavior pattern and method thereof |
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| KR101341596B1 (en)* | 2012-09-25 | 2013-12-13 | (주)소만사 | Apparatus and method for monitoring of wep application telecommunication data by user |
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101582817A (en)* | 2009-06-29 | 2009-11-18 | 华中科技大学 | Method for extracting network interactive behavioral pattern and analyzing similarity |
| CN101909079A (en)* | 2010-07-15 | 2010-12-08 | 北京迈朗世讯科技有限公司 | User online behavior data acquisition method in backbone link and system |
| CN102004770A (en)* | 2010-11-16 | 2011-04-06 | 杭州迪普科技有限公司 | Webpage auditing method and device |
| CN102780682A (en)* | 2011-05-12 | 2012-11-14 | 同济大学 | Website behavior model modeling method based on HTML (Hyper Text Markup Language) |
| CN102970289A (en)* | 2012-11-09 | 2013-03-13 | 同济大学 | Identity authentication method based on Web user behavior model |
| CN102999572A (en)* | 2012-11-09 | 2013-03-27 | 同济大学 | User behavior mode digging system and user behavior mode digging method |
| CN103118007A (en)* | 2013-01-06 | 2013-05-22 | 瑞斯康达科技发展股份有限公司 | Method and system of acquiring user access behavior |
| CN103699823A (en)* | 2014-01-08 | 2014-04-02 | 同济大学 | Identity authentication system based on user behavior pattern and method thereof |
| Publication number | Publication date |
|---|---|
| CN104270358A (en) | 2015-01-07 |
| Publication | Publication Date | Title |
|---|---|---|
| CN107590169B (en) | A kind of preprocessing method and system of operator gateway data | |
| CN102693271B (en) | A kind of network information recommending method and system | |
| CN102594934B (en) | Method and device for identifying hijacked website | |
| CN106095979B (en) | URL merging processing method and device | |
| CN102761627B (en) | Based on cloud network address recommend method and system and the relevant device of terminal access statistics | |
| CN101369276B (en) | A Forensics Method of Web Browser Cache Data | |
| CN103617267B (en) | Socialized extension search method, device and system | |
| CN106202482B (en) | Website optimization method and system based on user behavior analysis | |
| CN102436564A (en) | Method and device for identifying tampered webpage | |
| CN102663052B (en) | Method and device for providing search results of search engine | |
| CN102200980A (en) | Method and system for providing network resources | |
| CN102663060B (en) | A method and device for identifying tampered web pages | |
| CN102999572A (en) | User behavior mode digging system and user behavior mode digging method | |
| WO2015109928A1 (en) | Method, device and system for loading recommendation information and detecting url | |
| CN105262812A (en) | Log data processing method based on cloud computing platform, log data processing device and log data processing system | |
| CN107818132A (en) | A kind of webpage agent discovery method based on machine learning | |
| CN106528688B (en) | Analysis evidence obtaining method aiming at Twitter | |
| CN105653717B (en) | Information sharing method and device | |
| CN104270358B (en) | Trustable network transaction system client monitor and its implementation | |
| KR100989320B1 (en) | Non-tree index fast search method and non-tree-based indexing log processor for large web log mining and attack detection | |
| CN103841121A (en) | Comment and interaction system and method based on local files | |
| TWI750252B (en) | Method and device for recording website access log | |
| KR101005871B1 (en) | B-Tree Index Vector Based Web-Log Restoration Method For Huge Web Log Mining And Web Attack Detection | |
| CN103383697A (en) | Method and device for determining object representation information of object title | |
| CN107094147A (en) | NAT recognition methods based on cookieID in a kind of extensive flow |
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |