A method and system for network communication security protection based on plaintext data

Abstract

This invention belongs to the field of network communication security technology, specifically relating to a network communication security protection method and system based on plaintext data. The method involves acquiring and marking data, identifying abnormal communication nodes based on abnormal data, extracting alternative data from normal data affected by communication interruptions, classifying it into delayed data and data awaiting confirmation, determining whether it constitutes suspected attack event data, constructing a classification standard based on impact degree scoring to rank the suspected attack event data, extracting its original content as verification information for repeated review, and outputting alarm information or corrected normal data based on the verification results. This invention achieves high accuracy in attack event identification, high efficiency and targeted security protection, and high reliability and system robustness in the final judgment through layered filtering and classification, combined with a dual-priority processing mechanism of initial risk screening and impact degree ranking, and a closed-loop confirmation and correction process.

Description

Technical Field

[0001] This invention belongs to the field of network communication security technology, specifically relating to a network communication security protection method and system based on plaintext data. Background Technology

[0002] With the rapid development of information technology and the deepening of digital transformation, network communication has become the lifeline for the critical business operations of individuals, enterprises, and even society. In this process, massive amounts of data, especially unencrypted plaintext data, are frequently transmitted in the network, and its content is directly related to trade secrets, personal privacy, and industrial production security.

[0003] The technologies suffer from "lag" and "passivity." They often only respond after security incidents such as data breaches, tampering, or unauthorized access have occurred, responding through log analysis and traffic auditing. Their main role is post-incident tracing and evidence collection, but they cannot effectively intercept attacks during the attack itself. By then, the loss of core data assets has already been inflicted and is difficult to recover. Existing technologies lack real-time intelligent awareness of the transmission process. Data packets are transmitted between multiple network nodes from the source to the destination, a process that itself contains rich state and behavioral information, but traditional methods have not effectively utilized this information. This information is typically isolated at endpoints or centralized gateways. Detection methods based on static rules or signatures cannot continuously analyze the dynamic behavior of data streams, thus missing the critical window for early warning and blocking in the early stages of an attack. Existing solutions generally suffer from a contradiction between high false positive rates and performance overhead. Judgment logic based on simple thresholds or feature libraries struggles to accurately distinguish between complex normal business fluctuations and genuine abnormal attack behavior, leading to the misjudgment of normal communication as abnormal and disrupting business continuity. On the other hand, achieving deeper detection introduces huge computational overhead and significantly increases communication latency, which is unacceptable for scenarios with extremely high real-time requirements, such as financial transactions and industrial control. Summary of the Invention

[0004] The industry urgently needs a new, proactive method for network communication security. This method should overcome the passive and lagging shortcomings of traditional technologies, and by analyzing the dynamic characteristics of plaintext data in real time during network transmission, it should achieve early warning and accurate identification of potential security threats without significantly increasing communication latency, thereby providing effective protection before security incidents cause substantial damage.

[0005] The purpose of this invention is to provide a network communication security protection method based on plaintext data to ensure the security of plaintext data transmission.

[0006] To achieve the above-mentioned objectives, the technical solution adopted by the present invention is as follows:

[0007] A network communication security protection method based on plaintext data includes the following steps:

[0008] Acquire transmitted data and aggregate it into plaintext data; perform inspection on the plaintext data communication environment and generate inspection results; mark plaintext data as normal data or abnormal data based on the inspection results.

[0009] Based on a preset matching model, the communication path corresponding to the abnormal data is identified, and the communication path is designated as an abnormal communication node. The communication interruption time of normal data transmitted under the abnormal communication node is obtained. Based on the communication interruption time, data with communication interruption is extracted from the normal data, and the extracted data is marked as alternative data. The alternative data is statistically summarized, and the alternative data is analyzed using preset evaluation indicators to generate analysis results.

[0010] Based on the analysis results, the alternative data is divided into delayed data and data to be confirmed. The delayed data is divided according to the preset time parameters, and the data to be confirmed is sorted and output according to its suspiciousness score. The data to be confirmed is submitted to the verification program for processing to identify the communication differences corresponding to the data to be confirmed. The cause of the anomaly is determined based on the communication differences, and the cause of the anomaly is determined to determine whether the data to be confirmed constitutes suspected attack event data.

[0011] Construct a classification standard based on the degree of impact score;

[0012] According to the classification criteria, the suspected attack event data are arranged in descending order of impact score. Verification indicators are output based on the arrangement. The original content of the suspected attack event data is extracted and defined as verification information. The verification information is used to repeatedly review the suspected attack event data to generate verification results.

[0013] If the verification result is successful, an alarm message will be output; if the verification result is unsuccessful, the corrected normal data will be output.

[0014] In a preferred embodiment, the step of marking plaintext data as normal or abnormal data based on the inspection results includes:

[0015] A sampling period is set, and the first sampling time within that period is used as the baseline acquisition time. A time deviation threshold is set, and the sampling deviation of the acquisition nodes at different times is statistically analyzed. The sampling deviation is compared with the time deviation threshold to determine whether the data is affected by the current network state. If the data is affected by the current network state, it is marked as abnormal data; otherwise, it is marked as normal data. The time deviation threshold is a dynamically adjusted threshold based on the real-time acquired communication environment parameters, used to define the maximum acceptable data transmission delay under the current network state.

[0016] In a preferred embodiment, the steps for determining whether the data is affected by the current network state include:

[0017] Obtain the condition parameters of the communication environment in which the plaintext data is located, compare the condition parameters with the time deviation threshold, generate the comparison result, the time deviation threshold is used to calibrate the allowable delay range of data transmission, and based on the comparison result, filter out the data that has a delay in the data transmission process, and determine that the data with a delay is affected by the current network status.

[0018] In a preferred embodiment, the step of dividing alternative data into delayed data and data to be confirmed includes:

[0019] Set an effective delay time threshold, record the time difference between the actual delay time of each data point in the substitute data and the effective delay time threshold, use the time difference as a parameter to perform time delay analysis to determine the cause of the delay and generate analysis results. If the value of the analysis result is less than the value of the effective delay time threshold, the corresponding data is classified as delayed data. If the value of the analysis result is greater than or equal to the value of the effective delay time threshold, the corresponding data is classified as data to be confirmed.

[0020] In a preferred embodiment, after determining whether the data to be confirmed constitutes suspected attack event data, and before constructing a classification criterion based on the degree of impact score, the following steps are also included:

[0021] Obtain the risk value of each data point in the suspected attack event data, set a risk threshold, compare the risk value with the risk threshold, and perform result judgment. If the risk value is lower than the risk threshold, terminate the analysis process for that data. If the risk value is higher than or equal to the risk threshold, start the subsequent classification and verification process.

[0022] In a preferred embodiment, the step of obtaining the risk value of each data point in the suspected attack event data includes:

[0023] Assess the frequency of data occurrence in abnormal communication nodes, use the frequency as a parameter to calculate the risk value, and generate a review list based on the risk value and the frequency of occurrence.

[0024] In a preferred embodiment, after the suspected attack event data are arranged in descending order of impact score, the total risk value is calculated and output. Based on the ranking of each data point in the suspected attack event data, a verification coefficient is generated for each data point. Based on the verification information and the verification coefficient, a new data packet is constructed, and the new data packet is used for subsequent interactions and anomaly verification.

[0025] In a preferred embodiment, when the substitute data is confirmed to be without anomalies through the authentication process, the communication node corresponding to the substitute data is determined to be a valid communication node, the first communication interruption time in the delayed data is obtained, a weighted operation is performed on the first communication interruption time to obtain the extension time, and the extension time is applied to the normal data by simulating the communication process to form a new communication processing index.

[0026] This invention also provides a network communication security protection system based on plaintext data, using the above-mentioned network communication security protection method based on plaintext data, comprising:

[0027] The data processing module is used to acquire data transmitted during network communication, aggregate the data into plaintext data, perform inspections on the plaintext data communication environment, and mark the plaintext data as normal or abnormal data based on the inspection results.

[0028] The path identification and extraction module is used to identify the communication path corresponding to the abnormal data according to the preset matching model and designate it as an abnormal communication node, and to extract normal data under the abnormal communication node where communication interruption occurs and mark it as alternative data.

[0029] The classification module is used to analyze alternative data and divide it into delayed data and data to be confirmed.

[0030] The review module is used to process the data to be confirmed to determine whether it constitutes suspected attack event data, and to perform review on suspected attack event data to generate verification results.

[0031] The feedback module is used to output alarm information or corrected normal data based on the verification results. Beneficial effects

[0032] This invention performs a preliminary inspection of the communication environment in which plaintext data resides, initially marking abnormal data. It then identifies the abnormal communication nodes determined by the abnormal data and extracts substitute data from the normal data affected by communication interruptions under these nodes. Based on preset time parameters and a suspicion score, the substitute data is further divided into delayed data and data awaiting confirmation. This hierarchical filtering and classification technique effectively distinguishes between transmission delays caused by network state fluctuations and actual communication anomalies caused by suspicious behavior, avoiding misjudging normal network jitter as a security threat. This significantly improves the accuracy of attack event identification and reduces the false alarm rate.

[0033] After identifying suspected attack event data, this invention rapidly filters out low-risk data based on a set risk threshold, terminating unnecessary analysis processes. For high-risk data that passes the initial screening, a classification standard based on impact score is constructed, and the data is arranged in descending order of score. This invention employs a dual-priority processing mechanism combining initial risk screening and impact ranking, achieving effective classification and focus on potential security threats. This mechanism ensures that analytical resources are prioritized for the most destructive events, significantly improving the response efficiency and targeted nature of security protection, overcoming the shortcomings of existing technologies that average out all anomalies, leading to delays in responding to critical threats.

[0034] This invention, after sorting suspected attack event data, extracts its original content as verification information and uses this verification information to repeatedly perform a review process on the data. Based on the verification results generated by the review, a high-confidence alarm message is output, or corrected normal data is output when no attack is determined. Through this scheme of using the data's own content for cyclical verification, this invention constructs a closed-loop confirmation and correction process. This process not only ensures that alarms are issued based on solid and verified evidence, enhancing the reliability of the final judgment, but also provides data recovery capabilities, improving the overall robustness of network communication. Attached Figure Description

[0035] Figure 1 This is a flowchart of the method of the present invention. Detailed Implementation Example 1

[0036] This embodiment provides a network communication security protection method based on plaintext data. This method aims to achieve accurate identification and efficient protection against potential security threats by performing multi-layered, progressive analysis and processing of plaintext data transmitted in the network. The method includes the following steps:

[0037] The system acquires transmitted data in real time and aggregates it into plaintext. Simultaneously, it collects conditional parameters of the communication environment in which the data resides, such as device load, node status, signal quality, and network congestion index along the data transmission path.

[0038] The plaintext data communication environment is inspected to generate inspection results, and the plaintext data is initially classified and labeled based on these results. A dynamic sampling time period is set, for example, 100 milliseconds, and the timestamp of the first data packet received within this time period is obtained as the baseline acquisition time. The baseline acquisition time refers to the timestamp of the first data packet received within the preset dynamic sampling time period, which serves as the reference starting point for calculating the time deviation of subsequent data packets within this time period. For data packets arriving later within this time period, the time difference between their arrival time and the baseline acquisition time is calculated, i.e., the sampling deviation. A time deviation threshold is set, which is dynamically adjusted according to the condition parameters of the communication environment collected in real time, to define the allowable delay range of data transmission under the current network conditions.

[0039] A comparison result is generated by comparing the sampling deviation of each data packet with a dynamically adjusted time deviation threshold. If the sampling deviation exceeds the threshold, it indicates that the data is significantly affected by the current network state and has abnormal latency; based on this inspection result, the data is marked as abnormal data. Conversely, if it does not exceed the threshold, it is marked as normal data. This method can effectively filter out normal network jitter and identify truly problematic transmissions. The inspection result refers to the judgment result generated by comparing the sampling deviation of the data packet with the dynamically adjusted time deviation threshold, used to initially distinguish between normal and abnormal data transmission.

[0040] After initial labeling, abnormal data is analyzed according to a pre-defined matching model to identify its corresponding communication path. This matching model stores network topology information and can associate the source address, destination address, and routing information of data packets with physical or logical network nodes, accurately identifying the abnormal communication node along the communication path. This process helps pinpoint the specific location in the network where a fault or attack may occur. Specifically, the matching model is a computational model used to map the transmission characteristics of data packets to specific communication nodes in the network topology.

[0041] Its input data packet transmission characteristics, including source IP address Destination IP address and the set of routing nodes through which the data packets pass. Network topology node set The output is the most likely anomalous communication node identified. .

[0042] The mathematical formula is as follows: In the formula, (Matching weight), which corresponds to the importance of source address, destination address and path matching in the overall score, and is a preset constant;

[0043] (Indicator function), the function value is 1 when the internal condition is true, otherwise it is 0, used to determine whether the IP address belongs to the address range managed by a certain node;

[0044] (Node address range), and node The associated set of IP addresses;

[0045] (Node Adjacency Path), in the network topology, is related to nodes. A set of directly associated or known route nodes.

[0046] Monitor and acquire the communication interruption time of all normal data transmitted under the abnormal communication node. Based on historical data and real-time monitoring results, extract the data that exhibits communication interruption due to passing through the abnormal communication node from the normal data, re-mark it as alternative data, and use it as the object of subsequent in-depth analysis.

[0047] After extracting a large amount of substitute data, statistical summaries are performed, and analysis is conducted using preset evaluation metrics. The results are then categorized. A specific effective latency threshold is set, for example, 500 milliseconds, which represents the upper limit of latency attributable to regular network congestion. The actual latency of each substitute data point is recorded, and the time difference between the actual latency and the effective latency threshold is calculated.

[0048] Using this time difference as the core parameter, the time delay is analyzed to determine the cause of the delay. If the analysis result is less than the effective delay time threshold, meaning the actual delay is within an acceptable range, the delay is determined to be caused by occasional communication congestion or brief interruptions, and the corresponding data is classified as delayed data. If the analysis result is greater than or equal to the effective delay time threshold, it indicates that the delay is severe and persistent, exceeding the scope of normal network fluctuations. The corresponding data is classified as data to be confirmed, and its analysis priority is increased, preparing for security-level review.

[0049] For the data classified as pending verification, a verification procedure is initiated to process it. This verification procedure integrates various diagnostic tools, including network traffic reproduction, protocol consistency checks, and node response latency simulation, to identify communication differences between the pending verification data and the normal data in terms of transmission behavior.

[0050] Further analysis of communication discrepancies is conducted to determine the cause of the anomaly. If the discrepancy manifests as non-standard protocol communication on a specific port or minor but regular alterations to data packet content, it may be related to malicious interference. Based on the determined cause of the anomaly, it is determined whether the data to be confirmed constitutes suspected attack data. If the cause of the anomaly is determined to be a non-human intervention factor such as equipment failure or configuration error, the data will be re-marked as normal data, and the analysis will end.

[0051] Before classifying the suspected attack event data, a risk preprocessing step is added to effectively allocate computing resources and focus on high-risk events, obtaining a risk value for each data point in the suspected attack event data. This risk value is calculated based on an assessment of data behavior patterns, specifically the frequency with which the data appears in previously identified anomalous communication nodes. A high frequency of occurrence indicates that the anomalous behavior is persistent and repetitive, thus increasing its corresponding risk value. This frequency is used as the core parameter for calculating the risk value.

[0052] The risk value is compared with a preset risk threshold, and a result judgment is performed. This risk threshold represents the tolerable level of risk. If the risk value of a piece of data is lower than the risk threshold, it is considered to pose a relatively small actual threat, and the subsequent analysis process for that data is terminated. If the risk value is higher than or equal to the risk threshold, it indicates that the data has a high degree of threat suspicion, and the subsequent classification and verification process is initiated. This step also generates a review list based on the risk value and frequency of occurrence, prioritizing high-risk data.

[0053] Data that has undergone risk preprocessing, i.e., genuine suspected attack event data, will enter the grading and in-depth verification phase. A classification standard based on impact severity scoring will be constructed, which comprehensively considers factors such as the importance of the data, the affected business systems, and the potential scope of damage. According to this classification standard, all suspected attack event data will be ranked in descending order of impact severity scoring, and verification indicators will be output based on this ranking.

[0054] After sorting, the total risk value of all events is calculated and output, providing network security administrators with a current threat posture assessment. Verification coefficients are generated based on the specific ranking of each data point in the ranking; events with higher rankings have higher verification coefficients, making subsequent verification processes more targeted. The original content of the suspected attack event data is extracted and defined as verification information. This verification information, together with the corresponding verification coefficients, will work to construct new data packet content. This new data packet is used for subsequent interaction and anomaly verification, such as sending it to suspicious nodes through proactive probing to observe their response behavior, thereby repeatedly reviewing the suspected attack event data and generating the final verification result.

[0055] After the review process is completed, feedback is performed based on the final verification results. If the verification result is successful, the authenticity of the attack is confirmed, an alarm message is immediately output to the security management platform, and a detailed attack log is recorded.

[0056] If the verification result fails, it indicates that the previously suspected attack data was not actually malicious. Corrected normal data is then output, restoring the system to normal communication flow. This misjudgment event is used for self-learning and optimization. When the replacement data is finally confirmed to be anomaly-free through the authentication process, its corresponding communication node will be determined as a valid communication node. The first communication interruption time is obtained from the delay data, and a weighted operation is performed on this time to obtain the extension time. By simulating the communication process, the newly calculated extension time is applied to the monitoring model for normal data, forming a new communication processing metric. This dynamically optimized metric enhances the tolerance to normal network fluctuations, improves the accuracy of future judgments, and ensures the smooth operation of the normal data.

[0057] In summary, this method ensures the real-time performance and accuracy of network communication security through a complete set of data collection, classification, verification, alarm, and self-optimization logic. It also avoids communication efficiency being affected by misjudgments through reasonable data classification and risk assessment mechanisms. Its core lies in the continuity, automation, and adaptive learning capabilities of the data classification and risk assessment process. Example 2

[0058] This embodiment provides a network communication security protection system based on plaintext data. Using the above-mentioned network communication security protection method based on plaintext data, the system structure is as follows:

[0059] The data processing module is the core front-end interface. It is mainly responsible for collecting plaintext data from various sensor nodes and communication terminals. It automatically checks for anomalies such as missing data and format errors in the received raw data packets, and performs basic data correction processing. The processed data is stored in a temporary cache and awaits subsequent module calls.

[0060] The path identification and extraction module is used to identify the communication path corresponding to the abnormal data according to the preset matching model, and designate the communication path as the abnormal communication node. The module is also responsible for extracting the normal data under the abnormal communication node where communication interruption occurs, and marking it as the alternative data.

[0061] The classification module performs delay analysis and credibility judgment on the alternative data output by the path identification and extraction module, dividing the data into two main categories: delayed data and data to be confirmed, which facilitates subsequent calls by the security analysis module.

[0062] The review module is specifically designed to determine whether the data to be verified constitutes a network attack. This module integrates a communication protocol analysis engine, a signal reconstruction toolkit, a security rule base, and a blacklist comparison logic group. Through coordinated calculations, it identifies whether the data to be verified exhibits any abnormal indicators in dimensions such as traffic, port, command content, and communication time, to assist in determining whether it constitutes a malicious attack.

[0063] The feedback module is responsible for interacting with the terminal after the review module completes risk identification. When an attack event is determined, the system will send alarm signals to the monitoring center, management platform, and alarm module interface in real time through this module to remind the administrator or trigger automatic protection policies. If the data is ultimately verified as normal, the system will also re-mark it through the feedback module and return it to the data processing module for rewriting or caching.

[0064] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A network communication security protection method based on plaintext data, characterized in that, Includes the following steps: Acquire transmitted data and aggregate it into plaintext data; perform inspection on the plaintext data communication environment and generate inspection results; mark plaintext data as normal data or abnormal data based on the inspection results. Based on a preset matching model, the communication path corresponding to the abnormal data is identified, and the communication path is designated as an abnormal communication node. The communication interruption time of normal data transmitted under the abnormal communication node is obtained. Based on the communication interruption time, data with communication interruption is extracted from the normal data, and the extracted data is marked as alternative data. The alternative data is statistically summarized, and the alternative data is analyzed using preset evaluation indicators to generate analysis results. Based on the analysis results, the alternative data is divided into delayed data and data to be confirmed. The delayed data is divided according to the preset time parameters, and the data to be confirmed is sorted and output according to its suspiciousness score. The data to be confirmed is submitted to the verification program for processing to identify the communication differences corresponding to the data to be confirmed. The cause of the anomaly is determined based on the communication differences, and the cause of the anomaly is determined to determine whether the data to be confirmed constitutes suspected attack event data. Construct a classification standard based on the impact score; according to the classification standard, arrange the suspected attack event data in descending order of impact score, output verification indicators according to the arrangement, extract the original content of the suspected attack event data, define the original content as verification information, use the verification information to repeatedly review the suspected attack event data, and generate verification results. If the verification result is successful, an alarm message will be output. If the verification result is unsuccessful, the corrected normal data will be output. The steps for marking plaintext data as normal or abnormal data based on the inspection results include: setting a sampling time period, obtaining the first sampling time within the sampling time period as the baseline collection time, setting a time deviation threshold, statistically analyzing the sampling deviation of the collection nodes at different times, comparing the sampling deviation with the time deviation threshold to determine whether the data is affected by the current network status. If the data is affected by the current network status, the data is marked as abnormal data; if the data is not affected by the current network status, the data is marked as normal data. The steps for dividing substitute data into delayed data and data to be confirmed include: setting an effective delay time threshold, recording the time difference between the actual delay time of each data in the substitute data and the effective delay time threshold, performing time delay analysis with the time difference as a parameter to determine the cause of the delay, and generating analysis results. If the value of the analysis result is less than the value of the effective delay time threshold, the corresponding data is divided into delayed data. If the value of the analysis result is greater than or equal to the value of the effective delay time threshold, the corresponding data is divided into data to be confirmed.

2. The network communication security protection method based on plaintext data according to claim 1, characterized in that, The steps to determine whether data is affected by the current network status include: Obtain the condition parameters of the communication environment in which the plaintext data is located, compare the condition parameters with the time deviation threshold, generate the comparison result, the time deviation threshold is used to calibrate the allowable delay range of data transmission, and based on the comparison result, filter out the data that has a delay in the data transmission process, and determine that the data with a delay is affected by the current network status.

3. The network communication security protection method based on plaintext data according to claim 2, characterized in that, After determining whether the data to be confirmed constitutes suspected attack data, and before constructing a classification standard based on impact score, the following steps are also included: Obtain the risk value of each data point in the suspected attack event data, set a risk threshold, compare the risk value with the risk threshold, and perform result judgment. If the risk value is lower than the risk threshold, terminate the analysis process for that data. If the risk value is higher than or equal to the risk threshold, start the subsequent classification and verification process.

4. The network communication security protection method based on plaintext data according to claim 3, characterized in that, The steps for obtaining the risk value of each data point in the suspected attack event data include: Assess the frequency of data occurrence in abnormal communication nodes, use the frequency as a parameter to calculate the risk value, and generate a review list based on the risk value and the frequency of occurrence.

5. A network communication security protection method based on plaintext data according to claim 4, characterized in that, After arranging the suspected attack event data in descending order of impact score, the total risk value is calculated and output. Based on the ranking of each data point in the suspected attack event data, a verification coefficient is generated for each data point. Based on the verification information and the verification coefficient, a new data packet is constructed, and the new data packet is used for subsequent interactions and anomaly verification.

6. A network communication security protection method based on plaintext data according to claim 5, characterized in that, When the replacement data is confirmed to be without anomalies through the authentication process, the communication node corresponding to the replacement data is determined to be a valid communication node. The first communication interruption time in the delayed data is obtained, and a weighted operation is performed on the first communication interruption time to obtain the extension time. By simulating the communication process, the extension time is applied to the normal data to form a new communication processing indicator.

7. A network communication security protection system based on plaintext data, characterized in that, A network communication security protection method based on plaintext data according to any one of claims 1 to 6 includes: The data processing module is used to acquire data transmitted during network communication, aggregate the data into plaintext data, perform inspections on the plaintext data communication environment, and mark the plaintext data as normal or abnormal data based on the inspection results. The path identification and extraction module is used to identify the communication path corresponding to the abnormal data according to the preset matching model and designate it as an abnormal communication node, and to extract normal data under the abnormal communication node where communication interruption occurs and mark it as alternative data. The classification module is used to analyze alternative data and divide it into delayed data and data to be confirmed. The review module is used to process the data to be confirmed to determine whether it constitutes suspected attack event data, and to perform review on suspected attack event data to generate verification results. The feedback module is used to output alarm information or corrected normal data based on the verification results.

Images