Malicious traffic message interception and retention method based on threat intelligence

Abstract

The invention discloses a malicious traffic message interception and retention method based on threat intelligence, and the method comprises the following steps: S1, importing a threat intelligence data set, generating an intelligence label dictionary, and caching the intelligence label dictionary; s2, receiving a network data packet through a traffic mirroring device or an acquisition probe, and aggregating the network data packet into a traffic aggregation object based on a quintuple; s3, modeling and recording a state transition sequence based on a protocol state machine; s4, detecting a state transition sequence by using the information label dictionary, and identifying potential malicious traffic; s5, extracting data messages corresponding to the key nodes to form an extracted message set; s6, grouping according to the information labels and encrypting by using an improved AES symmetric encryption algorithm to generate an encrypted message file; s7, constructing an index data table containing a quintuple, capture time and an information label, and associating the index data table with the encrypted message file; and S8, storing the encrypted message file and the index data table in a separated storage system, and updating the index data table regularly. The method and the device are suitable for a threat-driven encrypted message processing scene.

Description

Technical Field

[0001] The present invention relates to the field of network security technologies, and in particular, to a method for intercepting and retaining malicious traffic packets based on threat intelligence. Background Art

[0002] With the rapid expansion of Internet infrastructure and the continuous evolution of network application forms, network attack behaviors show the trends of high frequency, concealment, and intelligence. Traditional protection methods based on rule matching or feature extraction face challenges in identifying complex, mutated, or zero-day attacks. In recent years, as an emerging information security means, threat intelligence has been gradually widely applied to scenarios such as intrusion detection, log analysis, and behavior modeling. Threat intelligence usually exists in the forms of malicious IP addresses, domain names, hash values, attack fingerprints, attack paths, behavior sequences, etc., and is used to describe the resources, technical means, and behavior characteristics of attackers, providing a verifiable reference basis for security systems.

[0003] In the current security protection system, malicious traffic detection methods mainly include intrusion detection systems based on signature matching (such as Snort, Suricata), anomaly detection algorithms based on machine learning, and deep packet detection technologies based on context analysis. These methods generally extract fields, behavior patterns, or packet features in the traffic, and compare them with existing threat samples to determine whether there are potential risks in network sessions or data streams. However, in the actual application process, common solutions mostly focus on the "detection" link. For the identified malicious traffic packets, the processing means are often limited to direct blocking, warning, or simple recording, lacking a strategy for encrypting and sealing the packet content and structured management, resulting in difficulties in meeting the requirements of threat traceability, attack replay analysis, and data compliance retention.

[0004] In addition, current network security products mostly take connections, sessions, and events as the core abstract units, lacking a traffic behavior modeling mechanism driven by state transition sequences. In the face of multi-stage, multi-hop, and multi-protocol composite attack processes, it is difficult to construct the context logic chain of attack behaviors only relying on static field matching or fixed sequence analysis, and thus it is difficult to accurately identify advanced persistent threat (APT) behaviors such as slow scanning, delayed feedback, and pseudo-protocol nesting. Some existing studies have tried to restore the traffic state through protocol state machine modeling, but most of them are still in the research stage and have not formed a data management mechanism that integrates with the threat intelligence label structure and conducts joint disposal.

[0005] On the other hand, most existing network log and traffic retention methods store data in plain text, or only perform static encryption on the overall data block, without performing refined processing on semantic structures such as associated tags and behavior sequences of traffic packets. Especially in multi-tenant, sensitive business or classified environments, there is a lack of a mechanism for encrypting packets grouped by tags at the granularity of key packets, making it difficult to ensure the decoupling of data access rights and content security, and there is a risk of illegal replay, tampering or leakage. At the same time, the current storage mechanism often uses file names or directory structures as the retrieval basis, lacking a structured management method with multi-dimensional indexes such as five-tuples, timestamps, and tag information, which seriously affects the efficiency of subsequent security analysis and evidence extraction.

[0006] In addition, although some existing log collection systems support batch archiving and periodic rotation operations, they face problems such as real-time data updates, index synchronization, and consistency verification in large-scale network environments. Most existing systems use a timed scheduler or an external database as an auxiliary mechanism, and abnormal situations such as index disconnection, packet loss, and duplicate storage may occur in high-concurrency scenarios, lacking an embedded integrated index construction and status update module. At the same time, most solutions use static configuration parameters during task execution, lacking the ability to monitor and adjust the dynamic changes of task status, and it is difficult to support the closed-loop processing logic of "task completion determination - repeated scheduling - stage archiving".

[0007] Therefore, how to provide a method for intercepting and retaining malicious traffic packets based on threat intelligence is an urgent problem to be solved by those skilled in the art. Summary of the Invention

[0008] An object of the present invention is to propose a method for intercepting and retaining malicious traffic packets based on threat intelligence. The present invention comprehensively utilizes technical means such as threat label modeling, protocol state machine tracking, grouped encryption processing, and structured index construction, and details the whole process of identifying potential malicious traffic, extracting key data packets, performing grouped encryption based on tags, and managing encrypted packet files and index information, with the advantages of clear structure, secure sealing, accurate retrieval, and closed-loop process.

[0009] A method for intercepting and retaining malicious traffic packets based on threat intelligence according to an embodiment of the present invention includes the following steps:

[0010] S1. Import a threat intelligence data set, generate an intelligence label dictionary, and store it in the local cache;

[0011] S2. Real-time receive network data packet input through a traffic mirroring device or a traffic collection probe, and perform preliminary aggregation on the received data packets based on five-tuple information to form a traffic aggregation object;

[0012] S3. Based on the protocol state machine modeling method, perform state tracking on each traffic aggregation object and record the traffic state transition sequence;

[0013] S4. Based on the intelligence label dictionary, detect the traffic state transition sequence and identify potential malicious traffic that meets the matching conditions;

[0014] S5. For the potential malicious traffic, extract the data packets corresponding to the key nodes of the state transition to form an extracted packet set;

[0015] S6. Group the processed packets according to the intelligence labels associated with each extracted packet in the extracted packet set, and encrypt each group of extracted packets corresponding to the intelligence labels respectively based on the improved AES symmetric encryption algorithm to generate an encrypted packet file;

[0016] S7. Based on the five-tuple information, capture time, and intelligence label information of the extracted packet set, construct an index data table and associate it with the corresponding encrypted packet file;

[0017] S8. Store the encrypted packet file and the index data table in a separate storage system, and periodically update the index data table to maintain retrieval effectiveness, thus completing the interception and retention of malicious traffic packets.

[0018] Optionally, the threat intelligence data set includes malicious IP addresses, malicious domain names, and malicious fingerprint features.

[0019] Optionally, the improvement points of the improved AES symmetric encryption algorithm are as follows:

[0020] Group the extracted packets according to the associated intelligence labels, and perform encryption operations on each group of packets corresponding to the intelligence labels respectively. Different groups of intelligence label packets are encrypted independently;

[0021] Use a key derivation function to generate corresponding sub-keys based on the master key and intelligence label information, and perform encryption operations on the extracted packets of each group of intelligence labels respectively using the generated sub-keys;

[0022] In the encryption process, adopt the AES-GCM mode to encrypt the extracted packets, and generate an authentication tag during the encryption process, and output the authentication tag together with the encryption result.

[0023] Optionally, the specific content of S2 includes:

[0024] S21. Real-time receive network data packets through traffic mirroring devices or traffic collection probes deployed on the network link. The network data packets include source IP address, destination IP address, source port number, destination port number, and protocol type;

[0025] S22. Initially aggregate the received network data packets based on the five-tuple information, where the five-tuple information consists of the source IP address, destination IP address, source port number, destination port number, and protocol type;

[0026] S23. During the initial aggregation process, calculate the unique identifier for each traffic aggregation object according to a unified aggregation rule:

[0027] ID = Hash(SIP||DIP||SPORT||DPORT||PROTO);

[0028] where ID is the unique identifier, SIP is the source IP address, DIP is the destination IP address, SPORT is the source port number, DPORT is the destination port number, PROTO is the protocol type, Hash is the hash function, and || represents the string concatenation operation;

[0029] S24. Classify the received network data packets based on the ID, and group the network data packets with the same ID into the same traffic aggregation object to complete the initial aggregation process.

[0030] Optionally, the S3 specifically includes:

[0031] S31. Construct a corresponding protocol state machine model for each protocol type, and the protocol state machine model consists of a state set, an input event set, a state transition condition set, and a state transition rule;

[0032] S32. Input the traffic aggregation object into the protocol state machine model of the corresponding protocol type, and perform state recognition on each data packet in the traffic aggregation object based on the protocol state machine model;

[0033] S33. During the state recognition process, according to the protocol type field, TCP flag bit field, application layer protocol field, effective payload length, and time interval with the previous data packet of the data packet, perform state transition according to the rules:

[0034] When the protocol type field is TCP, the TCP flag bit field is SYN, and the effective payload length is zero, transfer from the initial state to the SYN sending state;

[0035] When the protocol type field is TCP, the TCP flag bit field is SYN-ACK, and the time interval is less than or equal to the handshake time threshold, transfer from the SYN sending state to the handshake completion state;

[0036] When the protocol type field is TCP, the TCP flag bit field is ACK, the effective payload length is greater than the payload threshold, and the time interval is less than or equal to the data transfer time threshold, transfer from the handshake completion state to the data transfer state;

[0037] When the protocol type field is TCP, the application layer protocol field is HTTP, the HTTP request method field is GET, and the payload length is greater than the HTTP request payload threshold, transfer from the data transfer state to the HTTP request state;

[0038] When the data packet does not meet any transfer condition, keep the current state of the traffic aggregation object unchanged;

[0039] S34. During the state recognition process, record the state names of the traffic aggregation object in the order of state changes to generate a state migration path, which consists of the initial state and the states after each transfer in sequence;

[0040] S35. Use the state migration path as the state migration sequence corresponding to the traffic aggregation object, and the state migration sequence is used for matching based on the intelligence label dictionary.

[0041] Optionally, the specific steps of S4 are as follows:

[0042] S41. Set a corresponding reference state migration sequence for each intelligence label item in the intelligence label dictionary. The reference state migration sequence is composed of a predetermined number of state nodes arranged in a fixed order;

[0043] S42. For the state migration sequence generated for each traffic aggregation object, select the intelligence label item in the intelligence label dictionary whose protocol type is the same as the reference state migration sequence, and extract the corresponding reference state migration sequence for comparison;

[0044] S43. Compare the state migration sequence of the traffic aggregation object with the reference state migration sequence in order. When the names of two state nodes are the same and their arrangement order in the sequence is the same, record it as a successfully matched node. When the names of the state nodes are different or the arrangement order is different, record it as a wrongly matched node;

[0045] S44. Count the number of successfully matched nodes and the number of wrongly matched nodes, and calculate the proportion of the number of successfully matched nodes in the total number of state nodes in the reference state migration sequence;

[0046] S45. When the number of successfully matched nodes is greater than or equal to the preset threshold of the number of successful nodes, and the number of wrongly matched nodes is less than or equal to the preset threshold of the number of wrong nodes, determine that the state migration sequence of the traffic aggregation object matches the reference state migration sequence successfully;

[0047] S46. Store the associated intelligence label item that matches successfully with the state migration sequence of the traffic aggregation object.

[0048] Optionally, the specific steps of S5 are as follows:

[0049] S51. For each traffic aggregation object determined to be potentially malicious traffic, identify the data packet corresponding to the moment when the state transition action occurs from the state transition sequence;

[0050] S52. Set the state transition key node set, which includes the initial connection node, the intermediate abnormal node, and the termination response node;

[0051] S53. For each state transition key node, extract the data packet with the closest timestamp and the same protocol type corresponding to the node to form the first type of extracted packet subset;

[0052] S54. Set the abnormal event trigger node set, which includes the handshake abnormal node, the data mutation node, and the abnormal disconnection node;

[0053] S55. For each abnormal event trigger node, extract the data packets captured within the set time window before and after the abnormal node to form the second type of extracted packet subset;

[0054] S56. Merge the first type of extracted packet subset and the second type of extracted packet subset to form the final extracted packet set;

[0055] S57. Set the packet screening conditions, which include the payload length threshold L min , the protocol flag bit condition F set and the time interval condition ΔT max , and screen the data packets that meet the conditions:

[0056] L≥L min ∧F∈F set ∧Δt≤ΔT max ;

[0057] where L is the effective payload length of the data packet, L min is the lower limit of the payload length screening, F is the protocol flag bit of the data packet, and F set is the set of protocol flag bits that meet the requirements, Δt is the time interval between the current data packet and the previous data packet, and ΔT max is the set maximum time interval threshold;

[0058] S58. Use the data packets that pass the screening as the final extracted packet set.

[0059] Optionally, the specific content of S6 includes:

[0060] S61. Based on the intelligence tags associated with each extracted packet in the extracted packet set, perform grouping processing on the extracted packet set to form an intelligence tag grouping set, and each intelligence tag grouping set corresponds to a single intelligence tag item;

[0061] S62. For the information tag items in the information tag grouping set, perform a key derivation operation based on the master key combined with the information tag item identifier and the independent counter value to generate the corresponding grouping encryption key;

[0062] S63. Generate an initialization vector for the information tag grouping set. The length of the initialization vector is set to 96 bits. The initialization vector is generated by a random number generation module and has a one-to-one correspondence with the information tag item identifier;

[0063] S64. Use the grouping encryption key and the corresponding initialization vector to perform a counter mode encryption operation on each extracted message in the information tag grouping set. During the encryption process, bind the information tag item identifier and the initialization vector as additional authentication data;

[0064] S65. Calculate the authentication tag based on the encrypted ciphertext, information tag item identifier, and initialization vector. The authentication tag is generated by a Galois field multiplication hash function;

[0065] S66. Perform an authentication integrity check. When the authentication integrity check fails, delete the current encrypted ciphertext, initialization vector, and authentication tag, regenerate a new initialization vector, and re-execute the encryption and authentication processes until the authentication integrity check passes;

[0066] S67. Combine the information tag item identifier, initialization vector, encrypted ciphertext, and authentication tag according to the encapsulation format to generate an encrypted message file. The encrypted message file includes an information tag index field, an initialization vector field, an encrypted data field, and an authentication tag field.

[0067] Optionally, the specific steps of S7 are as follows:

[0068] S71. Store the encrypted message file in the encrypted data storage module of the split storage system and establish an index for the encrypted message file according to the information tag item identifier;

[0069] S72. For each encrypted message file, extract the corresponding five-tuple information, capture time information, and information tag item identifier to generate an index data entry;

[0070] S73. Construct an index data table. Each record in the index data table includes a five-tuple information field, a capture time field, an information tag item identification field, and an encrypted message file path field;

[0071] S74. To ensure the retrieval consistency of the index data table, set the uniqueness constraint condition for the index entry:

[0072] U = Hash(FiveTuple||CaptureTime||Tag);

[0073] Wherein, U is the unique identifier of the index entry, Hash is the hash calculation function, FiveTuple is the five-tuple information field, CaptureTime is the capture time field, Tag is the intelligence tag item identification field, and || represents the string concatenation operation;

[0074] S75. Insert the index data entry corresponding to each encrypted message file into the index data table, and perform deduplication management based on the unique identifier to prevent the generation of duplicate entries;

[0075] S76. Set the update period of the index data table, regularly traverse the newly generated encrypted message files in the encrypted data storage module, extract the corresponding index information of the new files and insert them into the index data table;

[0076] S77. During the storage process, record the storage status of the encrypted message file. If it is found that the storage fails or the index generation fails, mark the abnormal status and trigger the supplementary recording process. The supplementary recording process re-executes the storage and index generation operations until they are successfully completed.

[0077] Optionally, the specific steps of S8 include:

[0078] S81. Real-time monitor the addition status of encrypted message files and the index data table in the separated storage system, set the status detection period, and periodically detect the amount of newly added data;

[0079] S82. Dynamically calculate the system state vector according to the number of newly added encrypted message files and the number of index data entries:

[0080] S v =(N c ,N i ,T d );

[0081] Wherein, S v is the system state vector, N c is the number of newly added encrypted message files, N i is the number of newly added index data entries, and T d is the time interval since the last status detection;

[0082] S83. Set the task completion determination condition based on the system state vector:

[0083] Finish=(N c ≤Th c )∧(N i ≤Th i )∧(C s ≥C th );

[0084] Among them, Finish is the task completion identification variable, Th c is the threshold value of the number of encrypted message files, Th i is the threshold value of the number of index data entries, C s is the number of consecutive detections that meet the conditions, C th is the set number of consecutive times of the completion condition;

[0085] S84. When the task completion determination condition is not met, continue to execute the operations of extracting messages, packet encryption, index generation and storage, and cyclically update the encrypted message file and the index data table;

[0086] S85. When the task completion determination condition is met, stop the new message extraction processing flow, and archive the encrypted message file and the index data table in the current separated storage system.

[0087] The beneficial effects of the present invention are:

[0088] Through the threat intelligence label dictionary and protocol state machine modeling mechanism constructed by the present invention, the system can perform state-level behavior characterization on the real-time accessed network data stream, and perform sequence matching recognition in combination with intelligence labels, effectively improving the recognition accuracy of potential malicious traffic and the behavior correlation ability, and solving the problem of insufficient context recognition ability caused by relying on static fields or feature matching in the prior art.

[0089] For the identified potential malicious traffic, the present invention extracts the data messages corresponding to the key nodes in the state transition process, and performs grouping processing based on the intelligence label information carried in the messages. By introducing an improved AES symmetric encryption algorithm grouped by label, independent encryption keys and authentication labels are generated for each group of messages, ensuring the content isolation, access control accuracy and verifiability of the message data during storage, and avoiding the problems of shared keys and unclear access boundaries existing in the traditional overall encryption method.

[0090] In terms of message retrieval and management, the present invention constructs an index data table based on the five-tuple, capture time and intelligence label items, and establishes a binding relationship with the encrypted message file, realizing a multi-dimensional structured index mechanism, so that the message content still has high-efficiency retrievability in the storage state, and improving the operation efficiency and consistency guarantee ability in the later compliance review, attack traceability and reproduction analysis processes.

[0091] In addition, by introducing a system status monitoring and task completion determination mechanism and combining an index update strategy, the present invention realizes the dynamic linkage management of encrypted message files and index data tables. The task processing process has the ability of status perception, can judge the task execution progress according to the data accumulation situation and archive autonomously, constructs a malicious traffic interception and evidence preservation work process with self-loop ability, and avoids problems such as index synchronization lag, archive time sequence imbalance and difficult recovery of processing breakpoints in the existing system. BRIEF DESCRIPTION OF THE DRAWINGS

[0092] The accompanying drawings are used to provide a further understanding of the present invention, and constitute a part of the specification. They are used together with the embodiments of the present invention to explain the present invention, and do not constitute a limitation to the present invention. In the drawings:

[0093] Figure 1 is a flowchart of a method for intercepting and retaining malicious traffic messages based on threat intelligence proposed by the present invention;

[0094] Figure 2 is a schematic diagram of protocol state machine modeling and state transition sequence detection of a method for intercepting and retaining malicious traffic messages based on threat intelligence proposed by the present invention;

[0095] Figure 3 is a schematic diagram of packet encryption and index data table construction structure of a method for intercepting and retaining malicious traffic messages based on threat intelligence proposed by the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0096] Now, the present invention will be further described in detail with reference to the accompanying drawings. These drawings are all simplified schematic diagrams, only showing the basic structure of the present invention in a schematic way, so they only show the components related to the present invention.

[0097] Refer to Figures 1-3 , a method for intercepting and retaining malicious traffic messages based on threat intelligence, includes the following steps:

[0098] S1. Import a threat intelligence data set, generate an intelligence label dictionary and store it in the local cache;

[0099] S2. Receive network data packet input in real time through a traffic mirroring device or a traffic collection probe, and perform preliminary aggregation on the received data packets based on five-tuple information to form a traffic aggregation object;

[0100] S3. Perform state tracking on each traffic aggregation object based on the protocol state machine modeling method, and record the traffic state transition sequence;

[0101] S4. Detect the traffic state transition sequence based on the intelligence label dictionary, and identify potential malicious traffic that meets the matching conditions;

[0102] S5. For potential malicious traffic, extract the data packets corresponding to the key nodes of state migration to form an extracted packet set;

[0103] S6. Group the processed packets according to the intelligence tags associated with each extracted packet in the extracted packet set, and encrypt each group of extracted packets corresponding to the intelligence tags respectively based on the improved AES symmetric encryption algorithm to generate an encrypted packet file;

[0104] S7. Based on the five-tuple information, capture time, and intelligence tag information of the extracted packet set, construct an index data table and associate it with the corresponding encrypted packet file;

[0105] S8. Store the encrypted packet file and the index data table in a separated storage system, and periodically update the index data table to maintain retrieval effectiveness, thus completing the interception and retention of malicious traffic packets.

[0106] Through the introduction of a threat intelligence tag dictionary and a protocol state modeling mechanism, the present invention realizes the dynamic perception of the evolution process of network traffic status, can identify potential malicious traffic based on behavior sequences rather than single fields, and seals and structurally stores the identified key packet contents, enhancing the breadth of response to network threats and the accuracy of data handling.

[0107] In this embodiment, the threat intelligence data set includes malicious IP addresses, malicious domain names, and malicious fingerprint features.

[0108] By introducing a multi-dimensional threat intelligence data set containing malicious IP addresses, malicious domain names, and malicious fingerprint features, the present invention expands the coverage of the intelligence tag dictionary, enabling the system to perform comprehensive matching by integrating static features and dynamic behaviors, and improving the adaptability to identify complex threat traffic.

[0109] In this embodiment, the improvements of the improved AES symmetric encryption algorithm are as follows:

[0110] Group the extracted packets according to the associated intelligence tags, and perform encryption operations on each group of packets corresponding to the intelligence tags respectively. The encryption processes for different intelligence tag groups are independent of each other;

[0111] Use a key derivation function to generate corresponding sub-keys based on the master key and intelligence tag information, and perform encryption operations on the extracted packets of each intelligence tag group respectively using the generated sub-keys;

[0112] In the encryption process, adopt the AES-GCM mode to encrypt the extracted packets, and generate an authentication tag during the encryption process, and output the authentication tag together with the encryption result.

[0113] The present invention makes a structural improvement to the AES symmetric encryption algorithm, and performs separate encryption processing on the message by means of label grouping, key derivation and authentication binding, which not only realizes the isolated storage of data under different intelligence labels, but also ensures the uniqueness of the key and the integrity of authentication in the encryption process, providing a higher fine-grained guarantee for data security control.

[0114] In this embodiment, S2 specifically includes:

[0115] S21. Real-time receive network data packets through a traffic mirroring device or a traffic collection probe deployed on the network link. The network data packets include a source IP address, a destination IP address, a source port number, a destination port number and a protocol type;

[0116] S22. Initially aggregate the received network data packets based on the five-tuple information, where the five-tuple information is composed of a source IP address, a destination IP address, a source port number, a destination port number and a protocol type;

[0117] S23. During the initial aggregation process, calculate the unique identifier of each traffic aggregation object according to a unified aggregation rule:

[0118] ID = Hash(SIP||DIP||SPORT||DPORT||PROTO);

[0119] Where ID is the unique identifier, SIP is the source IP address, DIP is the destination IP address, SPORT is the source port number, DPORT is the destination port number, PROTO is the protocol type, Hash is the hash function, and || represents the string concatenation operation;

[0120] S24. Classify the received network data packets based on the ID, and classify the network data packets with the same ID into the same traffic aggregation object to complete the initial aggregation process.

[0121] The present invention effectively realizes the structural merging and efficient calibration of complex data streams by performing a unified aggregation strategy on the received network data packets based on the five-tuple information and generating a unique identifier of the aggregation object by using the hash function, providing a clear data boundary for subsequent state tracking and label mapping.

[0122] In this embodiment, S3 specifically includes:

[0123] S31. Construct a corresponding protocol state machine model for each protocol type. The protocol state machine model is composed of a state set, an input event set, a state transition condition set and a state transition rule;

[0124] S32. Input the traffic aggregation object into the protocol state machine model corresponding to the protocol type, and perform state recognition on each data packet in the traffic aggregation object based on the protocol state machine model;

[0125] S33. During the state recognition process, according to the protocol type field, TCP flag field, application layer protocol field, payload length, and time interval with the previous data packet of the data packet, perform state transition according to the rules:

[0126] When the protocol type field is TCP, the TCP flag field is SYN, and the payload length is zero, transfer from the initial state to the SYN sending state;

[0127] When the protocol type field is TCP, the TCP flag field is SYN-ACK, and the time interval is less than or equal to the handshake time threshold, transfer from the SYN sending state to the handshake completed state;

[0128] When the protocol type field is TCP, the TCP flag field is ACK, the payload length is greater than the payload threshold, and the time interval is less than or equal to the data transfer time threshold, transfer from the handshake completed state to the data transfer state;

[0129] When the protocol type field is TCP, the application layer protocol field is HTTP, the HTTP request method field is GET, and the payload length is greater than the HTTP request payload threshold, transfer from the data transfer state to the HTTP request state;

[0130] When the data packet does not meet any transfer condition, keep the current state of the traffic aggregation object unchanged;

[0131] S34. During the state recognition process, record the state names of the traffic aggregation object in the order of state changes to generate a state transition path, and the state transition path consists of the initial state and the order of each transferred state;

[0132] S35. Use the state transition path as the state transition sequence corresponding to the traffic aggregation object, and the state transition sequence is used for matching based on the intelligence label dictionary.

[0133] The present invention performs state recognition on the traffic aggregation object based on the protocol state machine modeling method, combines multi-dimensional conditions to perform state transition, and finally generates a structured state transition sequence, which can depict the complete behavior path in the context scenarios of different protocol types and improves the ability to restore multi-stage attack chains.

[0134] In this embodiment, the specific content of S4 includes:

[0135] S41. Set a corresponding reference state transition sequence for each intelligence label item in the intelligence label dictionary. The reference state transition sequence is composed of a predetermined number of state nodes arranged in a fixed order.

[0136] S42. For the state transition sequence generated for each traffic aggregation object, select the intelligence label item in the intelligence label dictionary whose protocol type is consistent with the reference state transition sequence, and extract the corresponding reference state transition sequence for comparison.

[0137] S43. Sequentially compare the state transition sequence of the traffic aggregation object with the reference state transition sequence. When the names of two state nodes are the same and their arrangement order in the sequence is the same, record it as a successfully matched node; when the names of the state nodes are different or the arrangement order is different, record it as an incorrectly matched node.

[0138] S44. Count the number of successfully matched nodes and the number of incorrectly matched nodes, and calculate the proportion of the number of successfully matched nodes to the total number of state nodes in the reference state transition sequence.

[0139] S45. When the number of successfully matched nodes is greater than or equal to the preset threshold of the number of successful nodes, and the number of incorrectly matched nodes is less than or equal to the preset threshold of the number of incorrect nodes, determine that the state transition sequence of the traffic aggregation object matches the reference state transition sequence successfully.

[0140] S46. Associatively store the successfully matched intelligence label item and the state transition sequence of the traffic aggregation object.

[0141] By precisely comparing the traffic state transition sequence with the reference state sequence set in the intelligence label dictionary and setting the proportion of matched nodes and the fault tolerance threshold, the present invention constructs a stable and reliable behavior label mapping mechanism, which helps to accurately calibrate and associatively identify potential threat objects in a complex traffic environment.

[0142] In this embodiment, the specific steps of S5 include:

[0143] S51. For each traffic aggregation object determined to be potentially malicious traffic, identify the data packet corresponding to the moment when the state transition action occurs from the state transition sequence.

[0144] S52. Set a set of state transition key nodes, which includes an initial connection node, an intermediate abnormal node, and a termination response node.

[0145] S53. For each state transition key node, extract the data packet with the closest timestamp and the same protocol type corresponding to the node to form a first type of extracted packet subset.

[0146] S54. Set the abnormal event trigger node set, which includes handshake abnormal nodes, data mutation nodes, and abnormal disconnection nodes;

[0147] S55. For each abnormal event trigger node, extract the data packets captured within the set time window before and after the abnormal node to form a second type of extracted packet subset;

[0148] S56. Merge the first type of extracted packet subset and the second type of extracted packet subset to form the final extracted packet set;

[0149] S57. Set the packet screening conditions, which include the payload length threshold L min , protocol flag bit condition F set and time interval condition ΔT max , and screen the data packets that meet the conditions: <{

[0150] L≥L min ∧F∈F set ∧Δt≤ΔT max ;

[0151] Among them, L is the effective payload length of the data packet, L min is the lower limit of the payload length screening, F is the protocol flag bit of the data packet, F set is the set of protocol flag bits that meet the requirements, Δt is the time interval between the current data packet and the previous data packet, and ΔT max is the set maximum time interval threshold;

[0152] S58. Use the data packets that pass the screening as the final extracted packet set.

[0153] The present invention combines the dual structures of the state transition trajectory and abnormal event nodes, extracts normal state transition packets and abnormal trigger packets respectively, and performs secondary refinement by setting screening conditions to generate a structured extracted packet set, providing a high-quality data basis for subsequent encryption processing and archival storage.

[0154] In this embodiment, the specific steps of S6 are as follows:

[0155] S61. Based on the intelligence tags associated with each extracted packet in the extracted packet set, group the extracted packet set to form an intelligence tag grouping set, and each intelligence tag grouping set corresponds to a single intelligence tag item;

[0156] S62. For the intelligence tag items in the intelligence tag grouping set, perform a key derivation operation based on the master key, the intelligence tag item identifier, and the independent counter value to generate the corresponding group encryption key;

[0157] S63. Generate an initialization vector for the set of grouped intelligence tags. The length of the initialization vector is set to 96 bits. The initialization vector is generated by a random number generation module and has a one-to-one correspondence with the intelligence tag item identifier;

[0158] S64. Use the grouped encryption key and the corresponding initialization vector to perform a counter mode encryption operation on each extracted message in the set of grouped intelligence tags. During the encryption process, bind the intelligence tag item identifier and the initialization vector as additional authentication data;

[0159] S65. Calculate an authentication tag based on the encrypted ciphertext, the intelligence tag item identifier, and the initialization vector. The authentication tag is generated by a Galois field multiplication hash function;

[0160] S66. Perform an authentication integrity check. When the authentication integrity check fails, delete the current encrypted ciphertext, the initialization vector, and the authentication tag, regenerate a new initialization vector, and re-execute the encryption and authentication processes until the authentication integrity check passes;

[0161] S67. Combine the intelligence tag item identifier, the initialization vector, the encrypted ciphertext, and the authentication tag according to the encapsulation format to generate an encrypted message file. The encrypted message file includes an intelligence tag index field, an initialization vector field, an encrypted data field, and an authentication tag field.

[0162] Through steps such as grouping by intelligence tags and performing key derivation, initialization vector generation, and authentication tag binding, the present invention ensures the identity independence and integrity verification ability of each message group during the encryption process, and improves the protection level of the storage system against the risks of content tampering and identity forgery.

[0163] In this embodiment, the specific steps of S7 are as follows:

[0164] S71. Store the encrypted message file in the encrypted data storage module of the separated storage system, and establish an index for the encrypted message file according to the intelligence tag item identifier;

[0165] S72. For each encrypted message file, extract the corresponding five-tuple information, capture time information, and intelligence tag item identifier to generate an index data entry;

[0166] S73. Construct an index data table. Each record in the index data table includes a five-tuple information field,a capture time field, an intelligence tag item identification field, and an encrypted message file path field;

[0167] S74. To ensure the retrieval consistency of the index data table, set the uniqueness constraint condition for the index entry:

[0168] U = Hash(FiveTuple || CaptureTime || Tag);

[0169] Where U is the unique identifier of the index entry, Hash is the hash calculation function, FiveTuple is the five-tuple information field, CaptureTime is the capture time field, Tag is the intelligence tag item identification field, and || represents the string concatenation operation;

[0170] S75. Insert the index data entries corresponding to each encrypted message file into the index data table, and perform deduplication management based on the unique identifier to prevent the generation of duplicate entries;

[0171] S76. Set the update period of the index data table, regularly traverse the newly generated encrypted message files in the encrypted data storage module, extract the corresponding index information of the new files and insert them into the index data table;

[0172] S77. During the storage process, record the storage status of the encrypted message file. If it is found that the storage fails or the index generation fails, mark the abnormal status and trigger the re-recording process. The re-recording process re-executes the storage and index generation operations until they are successfully completed.

[0173] The present invention establishes a binding relationship between each encrypted message file and its corresponding five-tuple, capture time, and intelligence tag item, and constructs an index data table with a uniqueness constraint mechanism, realizing multi-dimensional indexing and efficient retrieval of encrypted data, and improving the organization and management ability of the storage system for a large amount of heterogeneous data.

[0174] In this embodiment, the specific steps of S8 include:

[0175] S81. Real-time monitor the new status of the encrypted message file and the index data table in the separated storage system, set the status detection period, and periodically detect the amount of newly added data;

[0176] S82. Dynamically calculate the system state vector according to the number of newly added encrypted message files and the number of index data entries:

[0177] S v =(N c , N i , T d );

[0178] Where S v is the system state vector, N c is the number of newly added encrypted message files, N i is the number of newly added index data entries, and T d is the time interval since the last status detection;

[0179] S83. Set the task completion determination condition based on the system state vector:

[0180] Finish = (N c ≤ Th c ) ∧ (N i ≤ Th i ) ∧ (C s ≥ C th );

[0181] Where, Finish is the task completion flag variable, Th c is the threshold of the number of encrypted message files, Th i is the threshold of the number of index data entries, C s is the number of consecutive detections that meet the conditions, C th is the set number of consecutive times of the completion condition;

[0182] S84. When the task completion determination condition is not met, continue to execute the operations of extracting messages, packet encryption, index generation and storage, and cyclically update the encrypted message files and the index data table;

[0183] S85. When the task completion determination condition is met, stop the new message extraction processing flow, and archive the encrypted message files and the index data table in the current separated storage system.

[0184] Based on the task state vector and the update cycle control mechanism, the present invention monitors and closed-loop controls the new addition situation of the encrypted message files and the index data table in real time, supports the dynamic termination and archive determination of the task processing process, and effectively solves the problems of difficult breakpoint recovery and difficult task cycle control in the traditional process.

[0185] Embodiment 1:

[0186] To verify the feasibility of the present invention in implementation, the present invention is applied to the core network traffic security management system deployed by a certain telecommunications operator in Guangdong Province at the data hub in Guangzhou. This system is located at the intersection node of the north-south exits of the provincial backbone network, with a daily data throughput of more than 160 Gbps, and converges the Internet access requests of more than 12 million users. Due to the large number of access devices and the complex types of communication protocols, there are obvious bottlenecks in the detection accuracy and threat closed-loop disposal of conventional IDS / IPS systems. Especially when facing DNS tunnels, slow C2 backconnections, variant WebShells and hidden proxy traffic, traditional methods often have problems such as high false alarm rates, difficult content extraction, and weak data retention.

[0187] After deploying the method of the present invention in the system, first, the threat intelligence management module imports an intelligence data set collected during the period from October to December 2024, totaling 21,253 items, including data sources from Huoyan, Tencent Cloud, 360 Enterprise Security Platform, and the National APT Sample Library. An intelligence label dictionary is established through the local label construction engine, generating a total of 1,670 label entries, covering four dimensions of malicious IP addresses, malicious domain names, communication patterns, and behavior sequences, and stored in the high-speed local cache to ensure matching efficiency.

[0188] Subsequently, a 10 Gigabit mirroring device is deployed bypassing the core aggregation switch node of the north area backbone link to receive network packets in real-time. The system aggregates each received packet through five-tuple information (source IP, destination IP, source port, destination port, protocol type), and uses the hash algorithm to generate a unique identifier for the traffic aggregation object. During the one-hour test window from 18:00 to 19:00 on December 12, 2024, a total of 18.96 million original packets were accessed, aggregated into 785,031 traffic objects, with an average of 24.1 packets per object.

[0189] Perform protocol state modeling and identification on the above aggregation objects. The system constructs a state machine model based on the TCP and HTTP protocols, defining 13 state nodes and 26 types of state transition rules. During the state identification process, the sequence combination of "handshake exception - delayed response - burst upload" in TCP traffic is determined to be suspicious communication, and the behavior trajectory of "SYN-ACK-ACK-GET-ACK - large data upload" in HTTP traffic is determined to be a C2 type backhaul. Within one hour, 2,234 objects matching the abnormal state migration path are identified, generating state migration sequences and comparing them with the reference sequences in the intelligence label dictionary, with a successful matching ratio reaching 93.1%.

[0190] The system then extracts the key node packets corresponding to these potentially malicious objects. Taking the objects corresponding to the "APT-BLACK-PHANTOM" label as an example, a total of 1,248 packets corresponding to the handshake initial node, mid-section abnormal upload node, and end abnormal release node are extracted, with an average packet size of 624 bytes. The packet sets extracted for different intelligence label items are grouped separately, and a group key is generated based on the master key, label ID, and counter, and encrypted using the AES-GCM mode. During the same period, a total of 4,853 packet sets are completed for encryption processing, generating 164 authentication labels, and the total capacity of the encrypted packet files reaches 11.3MB.

[0191] In the data indexing phase, the system extracts the associated five-tuple information, capture time, and intelligence label item identifier for each encrypted message file, generates corresponding index entries, and uniformly maintains them in the index data table structure. As of January 15, 2025, the total number of index records reached 112,984, supporting multi-dimensional combination retrieval methods such as "time + label", "IP + port", "label + behavior path", etc. The average retrieval response time is kept within 190 milliseconds, and the daily fluctuation range of newly added index entries is between 41,000 and 57,000, supporting real-time retrieval and historical archiving.

[0192] The system monitors the synchronization status of the index table and encrypted message files through the status update mechanism, sets the update period to 15 minutes, and triggers the phase archiving mechanism when the data increment is less than 200 in three consecutive cycles. During the verification cycle of this time, the system ran continuously for 5 days, a total of 120 hours, without any loss of encrypted message files, index loss, or inconsistency. The success rate of index consistency verification remained at 100%, and the system ran stably without interruption records.

[0193] Comparing the effects before and after deployment, the threat recognition accuracy rate of the original system through IP blacklist and static rule matching was only 81.2%, and it was unable to generate retained data with structural indexes; after the deployment of the present invention, the recognition accuracy rate was increased to 94.6% in the same sample environment, realizing structured message extraction, labeled encrypted storage, and efficient multi-dimensional retrieval, providing a solid foundation for traceability analysis, compliance record keeping, and post-event reproduction.

[0194] In summary, this embodiment fully demonstrates that the present invention has good engineering deployability and operation stability, and can effectively solve the problems in the prior art such as insufficient accuracy in identifying malicious traffic messages, coarse data processing granularity, lack of isolation in encrypted packets, and difficulty in managing indexes, and has significant application value in actual network operation scenarios.

[0195] The above is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art within the technical scope disclosed by the present invention, according to the technical solution and inventive concept of the present invention, makes equivalent substitutions or changes, and all should be covered by the protection scope of the present invention.

Claims

1. A method for intercepting and retaining malicious traffic packets based on threat intelligence, characterized in that, It includes the following steps: S1. Import the threat intelligence data set, generate an intelligence label dictionary and store it in the local cache; S2. Receive network packet inputs in real time through a traffic mirroring device or a traffic collection probe, and perform preliminary aggregation on the received packets based on the five-tuple information to form a traffic aggregation object; S3. Perform state tracking on each traffic aggregation object based on the protocol state machine modeling method, and record the traffic state migration sequence; S4. Detect the traffic state migration sequence based on the intelligence label dictionary, and identify potential malicious traffic that meets the matching conditions; S5. For the potential malicious traffic, extract the data packets corresponding to the key nodes of the state migration to form an extracted packet set; S6. Group the processed packets according to the intelligence labels associated with each extracted packet in the extracted packet set, and encrypt each group of extracted packets corresponding to the intelligence labels respectively based on the improved AES symmetric encryption algorithm to generate an encrypted packet file; S7. Based on the five-tuple information, capture time and intelligence label information of the extracted packet set, construct an index data table and associate it with the corresponding encrypted packet file; S8. Store the encrypted packet file and the index data table in a separate storage system, and periodically update the index data table to maintain retrieval effectiveness, completing the interception and retention of malicious traffic packets.

2. The malicious traffic packet interception and retention method based on threat intelligence according to claim 1, characterized in that The threat intelligence data set contains malicious IP addresses, malicious domain names, and malicious fingerprint features.

3. A method for intercepting and retaining malicious traffic packets based on threat intelligence according to claim 1, characterized in that Improvements of the improved AES symmetric encryption algorithm: Group the extracted packets according to the associated intelligence labels, and perform encryption operations on each group of packets corresponding to the intelligence labels respectively. Different groups of intelligence labels are encrypted independently; Use a key derivation function to generate corresponding sub-keys based on the master key and intelligence label information. For the extracted packets in each group of intelligence labels, use the generated sub-keys to perform encryption operations respectively; In the encryption process, use the AES-GCM mode to encrypt the extracted packets, and generate an authentication tag during the encryption process, and output the authentication tag together with the encryption result.

4. A method for intercepting and retaining malicious traffic packets based on threat intelligence according to claim 1, characterized in that, The specific content of S2 includes: S21. Receive network packets in real time through a traffic mirroring device or a traffic collection probe deployed on the network link. The network packets include the source IP address, destination IP address, source port number, destination port number, and protocol type; S22. Perform preliminary aggregation on the received network packets based on the five-tuple information. The five-tuple information consists of the source IP address, destination IP address, source port number, destination port number, and protocol type; S23. During the preliminary aggregation process, calculate the unique identifier of each traffic aggregation object according to a unified aggregation rule: ID = Hash(SIP||DIP||SPORT||DPORT||PROTO); where ID is the unique identifier, SIP is the source IP address, DIP is the destination IP address, SPORT is the source port number, DPORT is the destination port number, PROTO is the protocol type, Hash is the hash function, and || represents the string concatenation operation; S24. Classify the received network data packets based on the ID, and group the network data packets with the same ID into the same traffic aggregation object to complete the preliminary aggregation process.

5. A method for intercepting and retaining malicious traffic packets based on threat intelligence according to claim 1, characterized in that, The specific steps of S3 are as follows: S31. Build a corresponding protocol state machine model for each protocol type. The protocol state machine model consists of a state set, an input event set, a state transition condition set, and a state transition rule. S32. Input the traffic aggregation object into the protocol state machine model of the corresponding protocol type, and perform state recognition on each data packet in the traffic aggregation object based on the protocol state machine model. S33. During the state recognition process, according to the protocol type field, TCP flag field, application layer protocol field, payload length of the data packet, and the time interval from the previous data packet, perform state transitions according to the rules: When the protocol type field is TCP, the TCP flag field is SYN, and the payload length is zero, transfer from the initial state to the SYN sending state. When the protocol type field is TCP, the TCP flag field is SYN-ACK, and the time interval is less than or equal to the handshake time threshold, transfer from the SYN sending state to the handshake completed state. When the protocol type field is TCP, the TCP flag field is ACK, the payload length is greater than the payload threshold, and the time interval is less than or equal to the data transfer time threshold, transfer from the handshake completed state to the data transfer state. When the protocol type field is TCP, the application layer protocol field is HTTP, the HTTP request method field is GET, and the payload length is greater than the HTTP request payload threshold, transfer from the data transfer state to the HTTP request state. When the data packet does not meet any transfer condition, keep the current state of the traffic aggregation object unchanged. S34. During the state recognition process, record the state names of the traffic aggregation object in the order of state changes to generate a state migration path. The state migration path consists of the initial state and the order of each transferred state. S35. Use the state migration path as the state migration sequence corresponding to the traffic aggregation object. The state migration sequence is used for matching based on the intelligence label dictionary.

6. A method for intercepting and retaining malicious traffic packets based on threat intelligence according to claim 1, characterized in that The specific steps of S4 are as follows: S41. Set a corresponding reference state migration sequence for each intelligence label item in the intelligence label dictionary. The reference state migration sequence is composed of a predetermined number of state nodes arranged in a fixed order. S42. For the state migration sequence generated for each traffic aggregation object, select the intelligence label item in the intelligence label dictionary whose protocol type is the same as the reference state migration sequence, and extract the corresponding reference state migration sequence for comparison. S43. Compare the state migration sequence of the traffic aggregation object with the reference state migration sequence in order. When the names of two state nodes are the same and their arrangement order in the sequence is the same, record it as a successfully matched node. When the names of the state nodes are different or the arrangement order is different, record it as a wrongly matched node. S44. Count the number of successfully matched nodes and the number of wrongly matched nodes, and calculate the proportion of the number of successfully matched nodes to the total number of state nodes in the reference state migration sequence. S45. When the number of successfully matched nodes is greater than or equal to the preset threshold of the number of successful nodes, and the number of erroneously matched nodes is less than or equal to the preset threshold of the number of error nodes, it is determined that the status migration sequence of the traffic aggregation object matches the reference status migration sequence successfully; S46. Store the successfully matched intelligence label items in association with the status migration sequence of the traffic aggregation object.

7. A method for intercepting and retaining malicious traffic packets based on threat intelligence according to claim 1, characterized in that The specific steps of S5 are as follows: S51. For each traffic aggregation object determined to be potentially malicious traffic, identify the data packet corresponding to the moment when the status transition action occurs from the status migration sequence; S52. Set a set of status transition key nodes, which includes an initial connection node, an intermediate abnormal node, and a termination response node; S53. For each status transition key node, extract the data packet with the closest timestamp and the same protocol type corresponding to the node to form a first type of extracted packet subset; S54. Set a set of abnormal event trigger nodes, which includes a handshake abnormal node, a data mutation node, and an abnormal disconnection node; S55. For each abnormal event trigger node, extract the data packets captured within a preset time window before and after the abnormal node to form a second type of extracted packet subset; S56. Merge the first type of extracted packet subset and the second type of extracted packet subset to form a final extracted packet set; S57. Set the message screening conditions, where the message screening conditions include the payload length threshold L min , the protocol flag bit condition F set and the time interval condition ΔT max , and screen the data messages that meet the conditions: L≥L min ∧F∈F set ∧Δt≤ΔT max ; Among them, L is the effective payload length L of the data packet min is the lower limit of the payload length screening, F is the protocol flag bit of the data packet, F set is the set of protocol flag bits that meet the requirements, Δt is the time interval between the current data packet and the previous data packet, ΔT max is the set maximum time interval threshold; S58. Use the data packets that pass the screening as the final extracted packet set.

8. A method for intercepting and retaining malicious traffic packets based on threat intelligence according to claim 1, characterized in that, The specific steps of S6 are as follows: S61. Based on the intelligence labels associated with each extracted packet in the extracted packet set, perform grouping processing on the extracted packet set to form a set of intelligence label groups, and each set of intelligence label groups corresponds to a single intelligence label item; S62. For the intelligence label items in the set of intelligence label groups, perform a key derivation operation based on the master key combined with the intelligence label item identifier and the independent counter value to generate the corresponding group encryption key; S63. Generate an initialization vector for the set of intelligence label groups. The length of the initialization vector is set to 96 bits. The initialization vector is generated by a random number generation module and has a one-to-one correspondence with the intelligence label item identifier; S64. Use the group encryption key and the corresponding initialization vector to perform a counter mode encryption operation on each extracted packet in the set of intelligence label groups. During the encryption process, bind the intelligence label item identifier and the initialization vector as additional authentication data; S65. Calculate the authentication tag based on the encrypted ciphertext, the intelligence label item identifier, and the initialization vector. The authentication tag is generated by a Galois field multiplication hash function; S66. Perform an authentication integrity check. When the authentication integrity check fails, delete the current encrypted ciphertext, the initialization vector, and the authentication tag, regenerate a new initialization vector, and re-execute the encryption and authentication processes until the authentication integrity check passes; S67. Combine the intelligence label item identifier, the initialization vector, the encrypted ciphertext, and the authentication tag according to the encapsulation format to generate an encrypted packet file, which includes an intelligence label index field, an initialization vector field, an encrypted data field, and an authentication tag field.

9. A method for intercepting and retaining malicious traffic packets based on threat intelligence according to claim 1, characterized in that The specific steps of S7 are as follows: S71. Store the encrypted message file in the encrypted data storage module of the separated storage system, and establish an index for the encrypted message file according to the intelligence tag item identifier; S72. For each encrypted message file, extract the corresponding five-tuple information, capture time information and intelligence tag item identifier to generate an index data entry; S73. Construct an index data table, where each record in the index data table includes a five-tuple information field, a capture time field, an intelligence tag item identification field and an encrypted message file path field; S74. To ensure the retrieval consistency of the index data table, set the uniqueness constraint condition for the index entry: U = Hash(FiveTuple||CaptureTime||Tag); where U is the unique identifier of the index entry, Hash is the hash calculation function, FiveTuple is the five-tuple information field, CaptureTime is the capture time field, Tag is the intelligence tag item identification field, and || represents the string concatenation operation; S75. Insert the index data entry corresponding to each encrypted message file into the index data table, and perform deduplication management based on the unique identifier to prevent the generation of duplicate entries; S76. Set the update period of the index data table, regularly traverse the newly generated encrypted message files in the encrypted data storage module, extract the index information corresponding to the new files and insert them into the index data table; S77. During the storage process, record the storage status of the encrypted message file. If it is found that the storage fails or the index generation fails, mark the abnormal status and trigger the re-recording process. The re-recording process will re-execute the storage and index generation operations until they are successfully completed.

10. A method for intercepting and retaining malicious traffic packets based on threat intelligence according to claim 1, characterized in that, The specific steps of S8 are as follows: S81. In the separated storage system, monitor the addition status of the encrypted message file and the index data table in real time, set the status detection period, and periodically detect the amount of newly added data; S82. Dynamically calculate the system status vector according to the number of newly added encrypted message files and the number of index data entries; S v = (N c , N i , T d ); Among them, S v is the system state vector, N c is the number of newly added encrypted message files, N i is the number of newly added index data entries, T d is the time interval since the last status detection; S83. Set the task completion determination condition based on the system status vector; Finish = (N c ≤ Th c ) ∧ (N i ≤ Th i ) ∧ (C s ≥ C th ); Among them, Finish is the task completion flag variable, Th c is the threshold of the number of encrypted message files, Th i is the threshold of the number of index data entries, C s is the number of consecutive detections that meet the conditions, C th is the set number of consecutive times of meeting the completion conditions; S84. When the task completion determination condition is not met, continue to execute the operations of extracting messages, block encryption, index generation and storage, and loop to update the encrypted message file and the index data table; S85. When the task completion determination condition is met, stop the new message extraction process, and archive the encrypted message file and the index data table in the current separated storage system.

Images