The application relates to the technical field of encrypted communication security and data leakage prevention, and discloses an encrypted
channel data leakage prevention blocking method and
system based on a deep residual network and protocol
reverse analysis, which comprises the following steps: under the premise of maintaining end-to-end
encryption, collecting the transmission direction,
ciphertext load length and
arrival time interval of an encrypted session, constructing a structured observation sequence by demarcating the interactive round-trip boundary and analyzing the
idle time length fluctuation to carry the protocol interaction
rhythm; analyzing the hidden state output state probability sequence by a Gumbel-Softmax relaxed hidden semi-Markov model, inputting the state probability sequence into a deep residual network after aligning with a
Gram angle field texture image, generating a gating coefficient to modulate the
texture feature to output a leakage probability; combining the
state transition probability to predict the risk and make a decision on blocking, and predicting the injection blocking message based on the TCP sequence number at the hidden state boundary. The application does not destroy the security of the encrypted channel, and uses the protocol
logic structure to improve the detection accuracy and blocking timeliness.