CN104765884B - A kind of fingerprint identification method of HTTPS webpages - Google Patents

Abstract

The present application relates to a fingerprint extraction method and a fingerprint identification method of an HTTPS webpage. The fingerprint extraction method includes: according to the data flow of the HTTPS webpage to be processed, obtaining the respective ciphertext lengths and encryption methods of a plurality of objects of the HTTPS webpage to be processed; Process the respective ciphertext lengths and encryption methods of multiple objects in the HTTPS webpage, and obtain the respective plaintext length intervals of multiple objects to determine the information of each object, where the information of each object includes the maximum length and minimum length corresponding to the object and the average length; and using the respective information of multiple objects of the HTTPS webpage to be processed to construct a fingerprint of the HTTPS webpage to be processed. The fingerprint identification method includes: extracting the object information of the HTTPS webpage to be identified, and matching with the information in the fingerprint database of the HTTPS webpage to complete the identification. The fingerprint extraction method and the fingerprint recognition method of the present invention have strong feasibility and high recognition accuracy.

Description

A Fingerprint Identification Method for HTTPS Web Pages

technical field

The invention relates to the technical field of computers, in particular to a fingerprint extraction method and a fingerprint identification method of an HTTPS webpage.

Background technique

At present, with the development of technology in the field of traffic identification, the demand for it in network management is also becoming more and more extensive. People are no longer limited to the identification of traffic at the application level, but more focused on the identification methods of encrypted traffic, such as P2P, SSL, SSH and so on. With the development of the SSL protocol and its derivative TLS protocol in recent years, the HTTPS protocol (a combination of the HTTP protocol and the SSL protocol) has gradually emerged.

HTTPS is an encryption protocol that ensures the secure transmission of web page data. In the HTTPS protocol, HTTP is responsible for the transmission of web page data, and the SSL protocol is responsible for data encryption and identity authentication. At present, the HTTPS protocol has been widely used in important services such as online banking, online payment, and e-commerce. Many Web sites also use the HTTPS protocol for data transmission for their own security in the communication process. Even ordinary websites that usually use the HTTP protocol will use the HTTPS protocol for transmission of their user login and registration pages that involve private information of network users, and even provide users with a dedicated HTTPS protocol channel. Therefore, the HTTPS protocol has already occupied a place in the Web communication market, and HTTPS encrypted traffic is becoming more and more widespread, and will continue to increase. However, the current encryption technology for HTTPS has low identification accuracy and poor feasibility.

Contents of the invention

The invention provides a fingerprint extraction method and a fingerprint identification method of an HTTPS webpage, and aims to solve the problem of low recognition accuracy for encrypted webpage traffic based on the HTTPS protocol at present.

In order to realize the foregoing invention object, the technical scheme that the present invention takes is as follows:

A fingerprint extraction method of an HTTPS webpage, the fingerprint extraction method comprising: according to the data stream of the HTTPS webpage to be processed, obtaining the respective ciphertext lengths and encryption methods of a plurality of objects of the HTTPS webpage to be processed; The respective ciphertext lengths and encryption methods of the objects, and obtain the respective plaintext length intervals of multiple objects to determine the information of each object, wherein the information of each object includes the corresponding maximum length, minimum length and average length of the object; and use The information of multiple objects of the HTTPS webpage to be processed is used to construct the fingerprint of the HTTPS webpage to be processed.

Preferably, in the step of obtaining the respective plaintext length intervals of multiple objects: for each of the multiple objects, when the object adopts stream encryption, the plaintext length interval of the object is L(D)=[L (E)-nL(Mac), L(E)-nL(Mac)], when the object adopts the block encryption method, the plaintext length interval of the object is L(D)=[L(E)-nL(Mac )-n-n(bs-1),L(E)-nL(Mac)-n], where L(D) represents the plaintext length interval of the object, and the expression on the left side of the comma in the plaintext length interval represents the object’s The minimum length, and the expression on the right side of the comma indicates the maximum extent of the object; L(E) indicates the length of the ciphertext of the object, L(Mac) indicates the length of the verification information obtained according to the encryption method of the object, and n indicates the length of the object The number of fragments of the object in transmission, bs represents the block size adopted according to the encryption method of the object.

Preferably, the fingerprint of the constructed HTTPS webpage to be processed is: fp={obj _i , i=1,2,...,N ₀ }, where N ₀ represents the number of objects included in the HTTPS webpage to be processed, and fp represents The fingerprint of the HTTPS web page to be processed, obj _i = {obj _i _min, obj _i _max, obj _i _s}, obj _i _min represents the minimum length of the i-th object of the HTTPS web page to be processed, and obj _i _max represents the length of the i-th object The maximum length, obj _i _s represents the average length of the i-th object, and

A fingerprint identification method for an HTTPS webpage, the fingerprint identification method comprising: capturing the data streams of a predetermined number of unknown HTTPS webpages to determine the ciphertext lengths and encryption methods of all unknown objects included in the predetermined number of unknown HTTPS webpages; The ciphertext length and encryption method of each unknown object, and obtain the plaintext length interval of each unknown object to determine the information of each unknown object, where the information of each unknown object includes the maximum length, minimum length and average length corresponding to the unknown object length; according to the information of all unknown objects, construct a predetermined number of unknown HTTPS web pages corresponding to the data set to be identified; Determine the fingerprint of the known HTTPS web page corresponding to the data set to be identified as the fingerprint identification result of the data set to be identified.

Preferably, the step of matching the data set to be identified with the fingerprint of each known HTTPS webpage in the predetermined fingerprint database includes: for each unknown object included in a predetermined number of unknown HTTPS webpages, determining the identity of each known HTTPS webpage Whether the plaintext length interval of each known object intersects with the plaintext length interval of the unknown object: if there is an intersection, the information of the known object is stored in the matching set corresponding to the known HTTPS webpage to which the known object belongs, in Determine the matching object of the unknown object among all known objects contained in the matching set corresponding to each known HTTPS webpage, so that the distance between the average length of the matching object and the average length of the unknown object is the smallest, and the matching object and the unknown object The correspondence between the unknown objects is stored in the matching set corresponding to the known HTTPS web pages to which the matching objects belong.

Preferably, the smaller value in the plaintext length interval of the unknown object may be equal to the difference between the minimum length of the unknown object and a preset buffer factor, and the larger value in the plaintext length interval of the unknown object may be equal to the unknown object The sum of the maximum length of and the buffer factor.

Preferably, the step of determining the fingerprint of the known HTTPS web page corresponding to the data set to be identified according to the matching result includes: according to the number and total number of bytes of all unknown objects included in the predetermined number of unknown HTTPS web pages, the predetermined fingerprint library The number and total bytes of all known objects included in each known HTTPS webpage, the number and total bytes of all known objects included in each matching set, and the number and total bytes of each known object included in each matching set The average length of the known objects included in the corresponding relationship and the average length of the unknown objects, calculate the matching coefficient corresponding to each known HTTPS webpage; in the matching coefficients corresponding to all known HTTPS webpages, remove wherein less than the first coefficient threshold The matching coefficients of the current remaining matching coefficients are sorted from small to large to obtain the sorted coefficient set; respectively calculate the ratio of front and back coefficients in every two adjacent matching coefficients in the current coefficient set, and determine all the calculated front and back coefficients The minimum value in the ratio, delete the matching coefficients in the two adjacent matching coefficients corresponding to the minimum value and all matching coefficients after the matching coefficients from the coefficient set to update the current coefficient set; according to the current coefficient The matching coefficient with the largest centralized value determines the second coefficient threshold, removes the matching coefficients that are smaller than the second coefficient threshold in the coefficient set, and determines the fingerprints of all known HTTPS webpages corresponding to the current remaining matching coefficients as the fingerprint identification of the data set to be identified result.

Preferably, the second coefficient threshold is equal to a predetermined multiple of the matching coefficient with the largest value in the current coefficient set, wherein the predetermined multiple takes a value between 0 and 1.

Compared with the prior art, the present invention has the following beneficial effects:

The fingerprint extraction method and fingerprint identification method of an HTTPS web page of the present invention have strong feasibility and high recognition accuracy, can better manage network services effectively while ensuring information security, and can prevent criminals Illegal and harmful information is transmitted through HTTPS encrypted web pages.

Description of drawings

Fig. 1 is the flow chart of an example of the fingerprint extraction method of a kind of HTTPS webpage of the embodiment of the present invention; And

FIG. 2 is a flow chart of an example of a fingerprint identification method for an HTTPS webpage according to an embodiment of the present invention.

Detailed ways

In order to make the purpose of the invention, technical solutions and beneficial effects of the present invention clearer, the embodiments of the present invention will be described below in conjunction with the accompanying drawings. The features in can be combined arbitrarily with each other.

Embodiments of the present invention provide a method for extracting fingerprints of HTTPS webpages, the fingerprint extraction method comprising: according to the data flow of the HTTPS webpages to be processed, obtaining the respective ciphertext lengths and encryption methods of a plurality of objects of the HTTPS webpages to be processed; To process the respective ciphertext lengths and encryption methods of multiple objects on the HTTPS web page, obtain the respective plaintext length intervals of multiple objects to determine the information of each object, where the information of each object includes the corresponding maximum length, minimum length and average length; and using the information of multiple objects of the HTTPS webpage to be processed to construct the fingerprint of the HTTPS webpage to be processed.

Fig. 1 shows a flow chart of an example process of a fingerprint extraction method for an HTTPS webpage according to an embodiment of the present invention. As shown in FIG. 1 , after the processing flow starts, step S110 is executed first.

In step S110, according to the data flow of the HTTPS webpage to be processed (for example, any one of the HTTPS webpages to be processed), the ciphertext lengths and encryption modes of the multiple objects of the HTTPS webpage to be processed are obtained. Then, step S120 is executed.

In step S120, according to the respective ciphertext lengths and encryption methods of the multiple objects of the HTTPS webpage to be processed, the respective plaintext length intervals of the multiple objects are obtained to determine the information of each object, wherein the information of each object includes the object The corresponding maximum length, minimum length and average length. Then, step S130 is executed.

Preferably, in step S120, the respective plaintext length intervals of the plurality of objects can be obtained through the following processing: for each object in the plurality of objects, when the object adopts the stream encryption method, the plaintext length interval of the object is L( D)=[L(E)-nL(Mac), L(E)-nL(Mac)], when the object adopts the block encryption method, the plaintext length interval of the object is L(D)=[L(E )-nL(Mac)-n-n(bs-1),L(E)-nL(Mac)-n], where L(D) represents the plaintext length interval of the object, and the expression on the left side of the comma in the plaintext length interval The formula represents the minimum length of the object, and the expression on the right side of the comma represents the maximum degree of the object; L(E) represents the ciphertext length of the object, and L(Mac) represents the verification information obtained according to the encryption method of the object length, n indicates the number of fragments of the object in transmission, and bs indicates the block size adopted according to the encryption method of the object.

In step S130, the fingerprints of the HTTPS webpages to be processed are constructed by using the information of multiple objects of the HTTPS webpages to be processed, so as to complete the fingerprint extraction of the HTTPS webpages to be processed. Then, the processing ends.

Preferably, the fingerprint of the constructed HTTPS webpage to be processed can be: fp={obj _i , i=1,2,...,N ₀ }, wherein, N ₀ represents the number of objects included in the HTTPS webpage to be processed, and fp Represents the fingerprint of the HTTPS webpage to be processed, obj _i = {obj _i _min, obj _i _max, obj _i _s}, obj _i _min represents the minimum length of the i-th object of the HTTPS webpage to be processed, and obj _i _max represents the i-th object The maximum length of , obj _i _s represents the average length of the i-th object, and

As can be seen from the above description, the above-mentioned fingerprint extraction method of an HTTPS webpage according to an embodiment of the present invention obtains the respective plaintext length intervals of multiple objects according to the respective ciphertext lengths and encryption methods of multiple objects of the HTTPS webpage to determine each Object information, and then get the fingerprint of the HTTPS web page. The fingerprint extraction method is highly feasible, and is convenient for the subsequent decryption, that is, the realization of the fingerprint identification process, so that the subsequent identification accuracy is high.

In addition, an embodiment of the present invention also provides a fingerprint identification method for an HTTPS webpage, the fingerprint identification method includes: capturing the data streams of a predetermined number of unknown HTTPS webpages to determine all unknown objects included in the predetermined number of unknown HTTPS webpages The ciphertext length and encryption method of each unknown object; according to the ciphertext length and encryption method of each unknown object, the plaintext length interval of each unknown object is obtained to determine the information of each unknown object, wherein the information of each unknown object includes the unknown The maximum length, minimum length and average length corresponding to the object; according to the information of all unknown objects, construct a predetermined number of unknown HTTPS web pages corresponding to the data set to be identified; and combine the data set to be identified with each known HTTPS web page in the predetermined fingerprint library The fingerprints are matched, so as to determine the fingerprint of the known HTTPS webpage corresponding to the data set to be identified according to the matching result, as the fingerprint identification result of the data set to be identified.

Fig. 2 shows a flow chart of an example process of a fingerprint identification method for an HTTPS webpage according to an embodiment of the present invention. As shown in FIG. 2 , after the processing flow starts, step S210 is executed first.

In step S210, the data streams of a predetermined number of unknown HTTPS webpages are captured to determine the ciphertext lengths and encryption methods of all unknown objects included in the predetermined number of unknown HTTPS webpages. Then, step S220 is executed.

In step S220, according to the ciphertext length and encryption method of each unknown object, the plaintext length interval of each unknown object is obtained to determine the information of each unknown object, wherein the information of each unknown object includes the corresponding Maximum length, minimum length, and average length. Then, step S230 is executed.

In step S230, according to the information of all unknown objects, construct a data set to be identified corresponding to a predetermined number of unknown HTTPS webpages. Then, step S240 is executed.

In step S240, the data set to be identified is matched with the fingerprint of each known HTTPS web page in the predetermined fingerprint library, so as to determine the fingerprint of the known HTTPS web page corresponding to the data set to be identified as the fingerprint to be identified according to the matching result. The fingerprinting results of the dataset. Then, the processing ends.

Preferably, in step S240, the data set to be identified can be matched with the fingerprints of each known HTTPS webpage in the predetermined fingerprint database through the following processing: for each unknown object included in a predetermined number of unknown HTTPS webpages, determine Whether the plaintext length interval of each known object of each known HTTPS webpage intersects with the plaintext length interval of the unknown object: if there is an intersection, the information of the known object is stored in the known HTTPS to which the known object belongs In the matching set corresponding to the webpage, determine the matching object of the unknown object among all known objects contained in the matching set corresponding to each known HTTPS webpage, so that the distance between the average length of the matching object and the average length of the unknown object is ( That is, the difference between the average length of the matching object and the average length of the unknown object) is the smallest, and the corresponding relationship between the matching object and the unknown object is stored in the matching set corresponding to the known HTTPS webpage to which the matching object belongs. Wherein, the smaller value in the plaintext length interval of the unknown object may be equal to the difference between the minimum length of the unknown object and the preset buffer factor, and the larger value in the plaintext length interval of the unknown object may be equal to the unknown object's The sum of the maximum length and the buffer factor.

Preferably, in step S240, the fingerprint of the known HTTPS web page corresponding to the data set to be identified can be determined through the following processing: according to the number of all unknown objects and the total number of bytes included in the predetermined number of unknown HTTPS web pages, the predetermined The number of all known objects and the total number of bytes included in each known HTTPS web page in the fingerprint database, the number and total number of bytes of all known objects included in each matching set, the number of all known objects included in each matching set, The average length of known objects and the average length of unknown objects included in each corresponding relationship are included, and the matching coefficient corresponding to each known HTTPS webpage is calculated; among the matching coefficients corresponding to all known HTTPS webpages, remove those less than the first The matching coefficient of a coefficient threshold, sort all the remaining matching coefficients from small to large to obtain the sorted coefficient set; respectively calculate the ratio of front and rear coefficients in every two adjacent matching coefficients in the current coefficient set, and determine the calculated For the minimum value among all front-to-back coefficient ratios, the subsequent matching coefficients among the two adjacent matching coefficients corresponding to the minimum value and all matching coefficients after the following matching coefficients are deleted from the coefficient set to update the current coefficient set; Determine the second coefficient threshold according to the matching coefficient with the largest value in the current coefficient set, remove the matching coefficients in the coefficient set that are smaller than the second coefficient threshold, and determine the fingerprints of all known HTTPS webpages corresponding to the current remaining matching coefficients as the data set to be identified fingerprint recognition results.

Wherein, the second coefficient threshold may be equal to, for example, a predetermined multiple of the matching coefficient with the largest value in the current coefficient set, wherein the predetermined multiple takes a value between 0 and 1.

An application example of a fingerprint identification method for an HTTPS webpage according to an embodiment of the present invention will be described below.

First of all, after completing the capture of an entire HTTPS data stream, analyze its internal data, obtain the encryption algorithm and information digest algorithm of the data stream, calculate the plaintext interval of all response objects in the stream, and store them in unknown objects set. Whenever a predetermined number (for example, 10) of HTTPS data streams are captured, there are Nu objects in the unknown object collection at this time, and then fingerprint identification is performed on these Nu objects.

Let UKOBJ represent the above-mentioned data set to be identified, then:

UKOBJ={ukobj _k , k=1, 2, . . . , N _u }.

Wherein, Nu represents the total number of unknown objects included in the above-mentioned predetermined number of unknown HTTPS webpages, ukobj _k represents the information of the kth unknown object in all unknown objects included in the above-mentioned predetermined number of unknown HTTPS webpages, and ukobj _k ={ ukobj _{k_min} , ukobj _{k_max} , ukobj _{k_s} }.

ukobj _{k_min} represents the minimum length of the above kth unknown object, ukobj _{k_max} represents the maximum length of the above kth unknown object, ukobj _{k_s} represents the average length of the above kth unknown object, and

It is assumed that the predetermined fingerprint database includes the fingerprints of M known HTTPS webpages, expressed as Wherein, fp _m is the fingerprint of the mth known HTTPS webpage included in the above-mentioned predetermined fingerprint library, is the information of the jth known object included in the mth known HTTPS webpage.

in, Indicates the minimum length of the jth known object included in the above mth known HTTPS web page, Indicates the maximum length of the jth known object included in the above mth known HTTPS web page, Indicates the average length of the jth known object included in the above mth known HTTPS webpage, and

For each unknown object included in the aforementioned predetermined number of unknown HTTPS webpages, the following determination is made for each known object of each known HTTPS webpage: the plaintext length interval of the known object Whether there is an intersection with the plaintext length interval [ukobj _k _min, ukobj _k _max] of the unknown object: If there is an intersection, store the information of the known object into the matching set R _m corresponding to the known HTTPS web page, and then continue The following judgment; otherwise, directly judge the next known object.

In one example, it can be determined, for example and [ukobj _k _min-α,ukobj _k _max+α]: if there is an intersection, then Stored in the corresponding matching set R _m . Among them, α is a buffer factor. By adding the buffer factor, it can offset the influence of different browsers or system kernels on the HTTP data header to a certain extent. Wherein, α may take a value between 10 and 30, for example.

Then, for each unknown object included in the aforementioned predetermined number of unknown HTTPS webpages, among all known objects included in the matching set R _m corresponding to each known HTTPS webpage, determine the matching object of the unknown object, so that the Average length of matching objects for unknown objects The distance between the average length ukobj _k' _s of the unknown object is the smallest, and the information of the matching object of the unknown object Correspondence with the information ukobj _k ' of the unknown object Stored in the matching set R _m corresponding to the known HTTPS web page, where

Then, for the matching set R _m corresponding to each known HTTPS webpage, the following information is extracted: (1) the number uk_num of all unknown objects included in the above-mentioned predetermined number of unknown HTTPS webpages; (2) the above-mentioned predetermined number of unknown HTTPS The total number of bytes uk_bytes that the webpage includes; (3) the number _{fpm_num} of all known objects that this known HTTPS webpage includes; (4) the total number of all known objects that this known HTTPS webpage includes The number of sections fp _m _bytes; (5) the number of all known objects included in the matching set R _m (that is, the number of all known objects that match unknown objects in the current HTTPS web page) R _m _num; ( 6) the total number of bytes R _m _bytes of all known objects included in the matching set R _m ; (7) each corresponding relationship included in the matching set R _m The average length of known objects included in and (8) each correspondence included in the matching set R _m The average length of unknown objects included in ukobj _k' _s.

According to the above eight kinds of information, calculate the matching coefficient corresponding to each known HTTPS web page:

in, N _k is the number of unknown objects contained in the matching set R _m .

Among the matching coefficients corresponding to all known HTTPS webpages, the matching coefficients smaller than the first coefficient threshold β are removed, and all the remaining matching coefficients are sorted from small to large to obtain the sorted coefficient set Indicates the serial number of the known HTTPS web page corresponding to the matching coefficient, and Nρ1 is the number of matching coefficients contained in the current coefficient set (that is, the coefficient set after performing the process of "removing the matching coefficients smaller than the first coefficient threshold β") . If the coefficient set ρ is empty at this time, it means that the predetermined number of HTTPS flows does not include the flows generated by known HTTPS webpages in the predetermined fingerprint library, and the fingerprint identification is completed; otherwise, continue the following processing. Wherein, the value of the first coefficient threshold β can be set according to empirical values, or can be determined through experiments, which will not be described in detail here.

Calculate the ratio of front and back coefficients in each two adjacent matching coefficients in the current coefficient set separately (p=1, 2,..., Nρ1-1 at this time), and determine the minimum value among all calculated front and rear coefficient ratios, and the subsequent matching coefficient and rank of the two adjacent matching coefficients corresponding to the minimum value All matching coefficients after the above-mentioned subsequent matching coefficients are deleted from the above-mentioned coefficient set to update the current coefficient set, as Nρ2 is the current coefficient set (that is, after the processing of "deleting the subsequent matching coefficients among the two adjacent matching coefficients corresponding to the minimum value and all matching coefficients ranked after the above-mentioned subsequent matching coefficients from the above-mentioned coefficient set" The number of matching coefficients contained in the coefficient set of .

Then, according to the matching coefficient with the largest value in the current coefficient set A second coefficient threshold β' is determined. Wherein, the second coefficient threshold β' may be equal to a predetermined multiple of the matching coefficient with the largest value in the current coefficient set, wherein the predetermined multiple takes a value between 0 and 1. E.g, is the preset proportional coefficient (that is, the predetermined multiple), remove the matching coefficients in the coefficient set that are smaller than the second coefficient threshold β', and obtain the coefficient set composed of the remaining matching coefficients Nρ3 is the result of fingerprint identification, and Nρ3 is the number of matching coefficients included in the current coefficient set (that is, the coefficient set after performing the process of "removing matching coefficients in the coefficient set smaller than the second coefficient threshold β'"). That is, the fingerprints of all known HTTPS webpages corresponding to the current remaining matching coefficients are the fingerprint identification results of the above-mentioned data set to be identified. Wherein, the value of the predetermined multiple can be set according to empirical values, or can be determined through experiments, which will not be described in detail here.

As can be seen from the above description, the above-mentioned fingerprint identification method of an HTTPS webpage according to the embodiment of the present invention uses the fingerprint extraction method described above to obtain the fingerprint of an unknown HTTPS webpage, and compares it with the fingerprint in the predetermined fingerprint library, Therefore, the fingerprint identification result is determined according to the comparison result. The fingerprint recognition method has strong feasibility and high recognition accuracy.

The above-mentioned fingerprint extraction problem and fingerprint identification method of HTTPS webpage according to the embodiment of the present invention can better manage network services effectively while ensuring information security, and can prevent criminals from transmitting illegal information through HTTPS encrypted webpages. harmful information.

Although the embodiments disclosed in the present invention are as above, the content thereof is only for the convenience of understanding the technical solutions of the present invention, and is not intended to limit the present invention. Anyone skilled in the technical field to which the present invention belongs can make any modifications and changes in the form and details of implementation without departing from the core technical solution disclosed in the present invention, but the scope of protection defined by the present invention remains The scope defined by the appended claims shall prevail.

Claims (4)

1. a kind of fingerprint identification method of HTTPS webpage, it is characterized in that, described fingerprint identification method comprises: Capture the data streams of a predetermined number of unknown HTTPS webpages to determine the ciphertext length and encryption method of all unknown objects included in the predetermined number of unknown HTTPS webpages; According to the ciphertext length and encryption method of each unknown object, the plaintext length interval of each unknown object is obtained to determine the information of each unknown object, where the information of each unknown object includes the maximum length and minimum length corresponding to the unknown object and average length; Constructing a data set to be identified corresponding to the predetermined number of unknown HTTPS webpages according to the information of all the unknown objects; and Matching the fingerprint of each known HTTPS web page in the predetermined fingerprint library with the data set to be identified, so as to determine the fingerprint of the known HTTPS web page corresponding to the data set to be identified as the data to be identified according to the matching result set of fingerprinting results; The step of matching the fingerprint of each known HTTPS webpage in the predetermined fingerprint library with the data set to be identified comprises: For each unknown object included in the predetermined number of unknown HTTPS webpages, Determine whether the plaintext length interval of each known object of each known HTTPS webpage intersects with the plaintext length interval of the unknown object: if there is an intersection, store the information of the known object into the known object to which the known object belongs. The matching set corresponding to the HTTPS web page, Determine the matching object of the unknown object among all known objects contained in the matching set corresponding to each known HTTPS web page, so that the distance between the average length of the matching object and the average length of the unknown object is the smallest, and the The corresponding relationship between the matching object and the unknown object is stored in the matching set corresponding to the known HTTPS webpage to which the matching object belongs. 2. The fingerprint identification method according to claim 1, wherein the smaller value in the plaintext length interval of the unknown object is equal to the difference between the minimum length of the unknown object and a preset buffer factor, and the The greater value in the interval of the plaintext length of the unknown object is equal to the sum of the maximum length of the unknown object and the buffer factor. 3. The fingerprint identification method according to claim 1 or 2, wherein the step of determining the fingerprint of the known HTTPS web page corresponding to the data set to be identified according to the matching result comprises: According to the number and total bytes of all unknown objects included in the predetermined number of unknown HTTPS webpages, the number and total bytes of all known objects included in each known HTTPS webpage in the predetermined fingerprint library number, the number of all known objects included in each matching set and the total number of bytes, the average length of known objects and the average length of unknown objects included in each corresponding relationship included in each matching set, calculate The matching coefficient corresponding to each known HTTPS web page; Among the matching coefficients corresponding to all known HTTPS web pages, the matching coefficients smaller than the first coefficient threshold are removed, and all the remaining matching coefficients are sorted from small to large to obtain a sorted coefficient set; Calculate the front and rear coefficient ratios of every two adjacent matching coefficients in the current coefficient set, and determine the minimum value of all the calculated front and rear coefficient ratios, and the subsequent matching coefficient of the two adjacent matching coefficients corresponding to the minimum value and all matching coefficients ranked after the subsequent matching coefficients are deleted from the coefficient set to update the current coefficient set; Determine the second coefficient threshold according to the matching coefficient with the largest value in the current coefficient set, remove the matching coefficients in the coefficient set that are smaller than the second coefficient threshold, and determine the fingerprints of all known HTTPS webpages corresponding to the current remaining matching coefficients as the described Fingerprint identification results of the dataset to be identified. 4. The fingerprint identification method according to claim 3, wherein the second coefficient threshold is equal to a predetermined multiple of the matching coefficient with the largest value in the current coefficient set, wherein the predetermined multiple is between 0 and 1 value.