Security audit and high-risk event mining method and system based on TDS protocol log and flow control

Abstract

The application discloses a security audit and high-risk event mining method and system based on TDS protocol log and flow control, and relates to the technical field of information security.The application comprises the following steps: performing protocol analysis, service shunting, executing data preprocessing, statistical analysis, constructing a feature baseline, and extracting behavior features to construct a behavior feature operation chain to establish an operation chain library; online matching the real-time received TDS protocol ticket service data with the operation chain library to determine the legality of the flow; based on the online matching result and the feature baseline, auditing the compliance of the ticket service, mining high-risk events, and outputting the audit result.The application effectively reduces false positives and false negatives by combining behavior sequence matching and statistical feature analysis of different dimensions of detection technology, and realizes the security protection of ticket services including but not limited to gate control, ticket sales, and automatic sales through the whole-process closed loop of "flow control shunting-offline training-online matching-security audit".

Description

Technical Field

[0001] This invention belongs to the field of information security technology, and in particular relates to a method and system for security auditing and high-risk event mining based on TDS protocol logs and flow control. Background Technology

[0002] Driven by the digital wave, passenger ticketing systems have evolved into complex and critical information infrastructure involving various services such as turnstiles, ticket sales, and automated ticket vending machines. Their security directly impacts the normal operation of the transportation system and the travel experience of users. These services typically transmit data based on proprietary protocols such as TDS (Table Data Stream), facing security challenges in complex network environments, including risks such as malicious attacks, business fraud, and data tampering.

[0003] However, the current security protection system for passenger ticketing services has significant shortcomings. Traditional network security devices, such as intrusion detection systems (IDS) and security auditing platforms, often experience a sharp performance drop under high-concurrency scenarios, causing deep packet inspection (DPI) capabilities to fail and making it impossible to accurately identify malicious operations in the TDS protocol. Current passenger ticketing security protection mainly relies on two technical approaches:

[0004] One approach is a separate solution based on traffic control and behavior auditing, such as an integrated "traffic control + auditing" solution. This solution uses intelligent traffic management (ITM) devices to allocate bandwidth and then uses internet behavior management (ICG) devices to audit content.

[0005] Secondly, based on the preprocessing scheme of the convergence splitter, more than 90% of useless traffic is filtered out through deep packet inspection (DPI) technology, thereby improving the detection efficiency of security equipment.

[0006] However, existing TDS protocol flow control mostly employs simple traffic splitting mechanisms based on static rules such as target ports, which are ill-equipped to handle evasion techniques such as protocol polymorphism and port reuse. For example, when domain name splitting is enabled and a domain name group in group management is referenced, all policy routing rules become completely ineffective. This inherent flaw in the flow control mechanism makes precise traffic splitting difficult to achieve, allowing attackers to easily exploit rule vulnerabilities to bypass basic security protections. These general-purpose solutions lack deep adaptation to the characteristics of ticketing business and cannot effectively analyze the business logic and abnormal behavior of the TDS protocol layer, resulting in blind spots in precise flow control and high-risk event detection. Traditional security auditing solutions often face a dilemma between "full auditing" and "sampling auditing" when dealing with large volumes of ticketing business data. When a comprehensive auditing solution cannot be found, sampling auditing is often the only viable option, leading to serious omissions and lingering legal risks. For carefully planned slow attacks and low-frequency anomalies in ticketing business, this sampling auditing is almost ineffective in identifying them.

[0007] Similarly, the traffic control deficiencies of API gateways in microservice architectures persist in the ticketing business environment. The excessively long synchronization interval of "pull mode" rules when integrating Spring Cloud Gateway with Sentinel leads to delayed updates of rate limiting rules, making it impossible to respond promptly to sudden traffic changes during peak business periods. More seriously, omissions in custom interceptor circuit breaker implementations can cause the entire circuit breaker mechanism to fail, triggering service cascading timeouts. This is severely inconsistent with the high availability requirements of the ticketing business. Furthermore, due to the diversity of model behavioral characteristics and limitations of offline settings, traditional feature extraction methods are ineffective in the ticketing business scenario, failing to extract distinctive behavioral features from business sessions, resulting in a lack of reliable data for subsequent anomaly detection and high-risk event mining.

[0008] Furthermore, security devices in the ticketing business environment face severe performance bottlenecks and architectural limitations. Research on convergence and splitter systems shows that in traditional network security architectures, security devices need to handle a large amount of useless traffic; these "data bubbles" can account for up to 90% of the total traffic, crowding out limited computing resources and causing delays or even missed detections of critical threats. The ticketing business environment presents a contradiction between strict real-time operational requirements and resource constraints. During peak business periods, ticketing systems face sudden traffic surges, and existing flow control strategies are prone to failure due to configuration synchronization issues, further amplifying system risks.

[0009] Faced with the severe challenges of ticket business security protection and the multiple shortcomings of existing technologies, there is an urgent need for a new generation of protection technology that deeply integrates business characteristics and can achieve a closed loop from traffic control to security audit. Summary of the Invention

[0010] The purpose of this invention is to provide a method and system for security auditing and high-risk event mining based on TDS protocol logs and flow control, which reduces false positives and false negatives.

[0011] To solve the above-mentioned technical problems, the present invention is achieved through the following technical solution:

[0012] As a first aspect provided by the present invention, the present invention is a security auditing and high-risk event mining system based on TDS protocol logs and flow control, comprising:

[0013] The TDS protocol flow control management module is configured to receive TDS protocol ticket business data packets, perform protocol parsing, and perform business diversion according to predefined rules.

[0014] The offline training module is configured to perform data preprocessing and statistical analysis on the split data to build feature baselines, and extract behavioral features to build behavioral feature operation chains to establish an operation chain library.

[0015] The online matching module is configured to receive TDS protocol ticket business data in real time, and after being diverted by the TDS protocol flow control management module, match it with the operation chain library to determine the legality of the traffic;

[0016] The security audit and high-risk event mining module is configured to audit the compliance of ticket business and mine high-risk events based on online matching results and feature baselines, and output audit results.

[0017] Furthermore, the ticket business data carried by the TDS protocol is accurately parsed, and scientifically and rationally classified into modules according to business needs. This process includes two closely linked sub-steps: TDS protocol parsing and ticket business module traffic distribution. Specifically, the TDS protocol flow control management module includes:

[0018] The TDS protocol parsing submodule is configured to receive TDS protocol ticket business data packets, perform protocol parsing operations, and extract a five-tuple containing source IP (for business terminals, such as ticket vending terminals, automatic ticket vending machines, turnstiles, etc.), destination IP (for the core processing server of ticket business), source port (different application processes on the terminal), destination port (specific business processing modules on the server), and transport layer protocol (such as TCP, UDP) and payload data from the data packets to form structured data;

[0019] The business routing submodule is configured to distribute structured data to the corresponding ticketing business module based on predefined routing rules;

[0020] The predefined traffic splitting rules include traffic splitting rules based on the target port and / or the target IP.

[0021] Furthermore, the ticketing service modules identified by the predefined diversion rules include at least one of the following: ticket availability inquiry, ticket window, emergency ticketing, automatic ticket checking management (AFC), automatic ticketing service port, automatic ticketing management (SCM), manual real-name ticket verification, facial recognition, and POS payment.

[0022] Furthermore, the offline training module includes:

[0023] The data preprocessing submodule is configured to perform data cleaning on the data after it is diverted by the TDS protocol flow control management module, remove empty packets with a payload data length of 0, and extract the business operation units in the payload data.

[0024] The statistical analysis submodule is configured to perform statistical analysis on the preprocessed business data according to predefined characteristics to obtain statistical characteristics and generate normal characteristic baselines for each ticket business module;

[0025] The operation chain training submodule is configured to extract behavioral features from business operation units and build an operation chain library based on the CNN-LSTM-Attention deep learning model.

[0026] Furthermore, the predefined features include:

[0027] Feature 1: Statistical features of local fields in the payload, including the distribution of 8b / 16b / 32b fields in the payload, payload length, and the ratio of payload length to packet length;

[0028] Feature 2: Minimum and maximum package length;

[0029] Feature 3: payload information entropy.

[0030] Furthermore, the operation chain training submodule includes:

[0031] The segmentation unit is configured to segment the payload data of each ticket business module into the smallest independent business operation unit according to the business operation logic using a regular expression matching method.

[0032] The model training unit is configured to extract behavioral features and construct operational feature sequences using a CNN-LSTM-Attention deep learning model, and then train it. The CNN-LSTM-Attention deep learning model includes:

[0033] The CNN layer is configured to transform business operation units into low-dimensional feature vectors, capturing the local field patterns of each business operation unit.

[0034] The LSTM layer is configured to capture the logical dependencies between business operations based on the feature vector sequence of business operation units, and construct a logical temporal feature sequence.

[0035] The Attention layer is configured to assign weights to the temporal feature sequence and output a weighted operation feature sequence to enhance the features of key operation units.

[0036] The operation chain library construction unit is configured to generate operation chains corresponding to each ticket business module based on the operation feature sequence, thus forming the operation chain library.

[0037] Furthermore, the training conditions for the model training unit include:

[0038] Use historical normal operation data from each ticketing business module as the dataset;

[0039] The dataset is divided into training, validation, and test sets in a 7:2:1 ratio.

[0040] The cross-entropy loss function is used to calculate and optimize the difference between the operational feature sequence predicted by the CNN-LSTM-Attention deep learning model and the normal operational feature sequence. The optimization objective is to minimize this difference.

[0041] The training termination condition is that the operation chain matching accuracy of the CNN-LSTM-Attention deep learning model on the validation set is ≥98%.

[0042] Furthermore, the online matching module includes:

[0043] The real-time processing submodule is configured to parse and distribute real-time TDS protocol ticket business data.

[0044] The real-time preprocessing submodule is configured to perform cleaning on the real-time offloaded data and to segment the data into business operation units.

[0045] The operation chain matching submodule is configured to extract the real-time operation unit sequence from the segmented operation units, obtain the real-time operation chain through the CNN-LSTM-Attention model, and match the real-time operation chain with the operation chain library.

[0046] The matching rules for the operation chain matching submodule include:

[0047] Exact match: The real-time operation chain is consistent with the operation unit sequence of a certain operation chain in the operation chain library. One non-critical operation unit deviation is allowed and it is judged as normal business traffic.

[0048] Partial match: If a key operation unit is missing or the order of operation units is reversed in the real-time operation chain, it is judged as suspicious traffic;

[0049] Mismatch: The real-time operation chain has no matching operation chain in the library, which is judged as abnormal traffic;

[0050] The statistical feature detection submodule is configured to perform statistical analysis on real-time TDS protocol ticket business data and compare it with the feature baseline table.

[0051] Furthermore, the audit results output by the security audit and high-risk event mining module include: normal traffic, compliance warnings, and high-risk events; high-risk events include at least one of business unauthorization, operational violations, and protocol attacks.

[0052] As a second aspect of the present invention, the present invention provides a method for security auditing and high-risk event mining based on TDS protocol logs and flow control. The method is implemented based on the system described in the first aspect, and the method includes the following steps:

[0053] The system performs protocol parsing on the received TDS protocol ticket service data packets and performs service routing according to predefined rules.

[0054] After the data is split, data preprocessing and statistical analysis are performed to construct feature baselines, and behavioral features are extracted to construct behavioral feature operation chains to establish an operation chain library.

[0055] The real-time received TDS protocol ticket business data will be diverted through the TDS protocol flow control management module and then matched online with the operation chain library to determine the legality of the traffic.

[0056] Based on online matching results and feature baselines, audit the compliance of ticketing business, identify high-risk events, and output audit results.

[0057] The present invention has the following beneficial effects:

[0058] This invention performs protocol parsing on received TDS protocol ticketing data packets and performs business diversion according to predefined rules. After diversion, it performs data preprocessing and statistical analysis to construct feature baselines and extracts behavioral features to build a behavioral feature operation chain to establish an operation chain library. Real-time received TDS protocol ticketing data is diverted through the TDS protocol flow control management module and then matched online with the operation chain library to determine traffic legitimacy. Based on the online matching results and feature baselines, it audits the compliance of ticketing business, identifies high-risk events, and outputs audit results. By combining behavioral sequence matching and statistical feature analysis of different dimensions of detection technology, it effectively reduces false alarms and false negatives, constructing a precise, automated, and self-learning proactive defense system.

[0059] Of course, any product implementing this invention does not necessarily need to achieve all of the advantages described above at the same time. Attached Figure Description

[0060] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0061] Figure 1 This is a structural block diagram of the security auditing and high-risk event mining system based on TDS protocol logs and flow control of the present invention;

[0062] Figure 2 This is a flowchart of the security auditing and high-risk event mining method based on TDS protocol logs and flow control of the present invention;

[0063] Figure 3 This is an offline training flowchart for the security auditing and high-risk event mining system based on TDS protocol logs and flow control of this invention;

[0064] Figure 4This is a system architecture diagram for security auditing and high-risk event mining based on TDS protocol logs and flow control, as presented in this invention.

[0065] Figure 5 This is a diagram of the CNN-LSTM-Attention network architecture. Detailed Implementation

[0066] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0067] It should be understood that, when used in this application specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or a collection thereof.

[0068] It should also be understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0069] As used in this application specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if detected [the described condition or event]" may be interpreted, depending on the context, as meaning "once determined," "in response to determination," "once detected [the described condition or event]," or "in response to detection [the described condition or event]."

[0070] Furthermore, in the description of this application and the appended claims, the terms "first," "second," "third," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0071] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0072] Example 1:

[0073] like Figure 1 As shown, as the first embodiment provided by the present invention, the present invention is a security auditing and high-risk event mining system based on TDS protocol logs and flow control, comprising:

[0074] The TDS protocol flow control management module is configured to receive TDS protocol ticket business data packets, perform protocol parsing, and perform business diversion according to predefined rules.

[0075] The offline training module is configured to perform data preprocessing and statistical analysis on the split data to build feature baselines, and extract behavioral features to build behavioral feature operation chains to establish an operation chain library.

[0076] The online matching module is configured to receive TDS protocol ticket business data in real time, and after being diverted by the TDS protocol flow control management module, match it with the operation chain library to determine the legality of the traffic;

[0077] The security audit and high-risk event mining module is configured to audit the compliance of ticket business and mine high-risk events based on online matching results and feature baselines, and output audit results.

[0078] like Figure 1 As shown, the system of this invention includes four core modules, and achieves security protection for ticketing services (including but not limited to gates, ticket sales, and automatic ticket vending machines) through a closed-loop process of "flow control and diversion - offline training - online matching - security audit".

[0079] Example 2:

[0080] As one embodiment of the present invention, the present invention is a security auditing and high-risk event mining system based on TDS protocol logs and flow control, based on embodiment one, such as Figure 4As shown, the TDS protocol flow control management module receives TDS protocol ticket business data packets, performs protocol parsing, and performs business traffic splitting according to predefined rules, including but not limited to those based on target ports; the offline training module performs data preprocessing on each business data after the TDS protocol flow control module, performs statistical analysis based on predefined features, extracts behavioral features from each business data, and establishes a behavioral feature operation chain; the online matching module receives TDS ticket business data in real time, splits the received data through the flow control management module, matches the ticket business data against the offline training operation chain library, and determines the legality of the traffic; the security audit and high-risk event mining module, based on the output results of the online matching module and combined with the statistical feature baseline of the offline training module, audits the compliance of ticket business and mines high-risk events. The entire process involves accurately parsing the ticket business data carried by the TDS protocol and implementing scientific and reasonable module classification according to business needs. It includes two closely linked sub-steps: TDS protocol parsing and ticket business module traffic splitting.

[0081] As an embodiment of the present invention, preferably, the TDS protocol flow control management module provided in this embodiment is responsible for receiving TDS protocol ticket business data packets. Upon receiving the data packet, it immediately performs a protocol parsing operation, disassembling and identifying the information in the data packet according to the TDS protocol rules, including:

[0082] The TDS protocol parsing submodule is configured to receive TDS protocol ticketing service data packets, perform protocol parsing operations, and extract a five-tuple containing the source IP (for the service terminal, such as a ticket vending terminal, automatic ticket vending machine, or turnstile), destination IP (for the core processing server of the ticketing service), source port (for different application processes on the terminal), destination port (for a specific business processing module on the server), and transport layer protocol (such as TCP or UDP), along with payload data, to form structured data. Through TDS protocol parsing, key and meaningful data fields can be extracted to form predefined structured data. The payload data, i.e., the specific ticketing service content carried in the TDS protocol ticketing service data packet, such as passenger ticketing information and turnstile passage record information, is the core basis for subsequent business modules to perform specific business processing.

[0083] By parsing the TDS protocol, not only was the "removal of impurities and retention of essence" of the data achieved, but the raw data that was originally difficult to use directly also became standardized and readable, providing accurate data support for the next step of the passenger ticket business module diversion.

[0084] As an embodiment of the present invention, preferably, the business diversion submodule provided in this embodiment, based on the completion of TDS protocol parsing, accurately allocates the passenger ticket business data that has been converted into structured data to the corresponding specific passenger ticket business module according to the needs of business management and processing, ensuring that different types of business data can be processed professionally and efficiently. This is a key step in realizing refined management of passenger ticket business. The business diversion submodule is configured to allocate structured data to the corresponding passenger ticket business module based on predefined diversion rules.

[0085] After being parsed by the TDS protocol, the structured data clearly shows the source, destination and specific business content of the data. However, the ticket business covers a variety of types, and different types of business need to be processed by different business modules. Therefore, it is necessary to achieve reasonable allocation of data through a diversion process.

[0086] During the traffic splitting process, the core basis is predefined splitting rules. These rules are formulated based on the actual needs of the ticketing business and the system architecture design, and are clear and operable. These predefined splitting rules include splitting rules based on target ports and / or target IPs.

[0087] As an embodiment of the present invention, a preferred classification method based on target ports utilizes the destination port information in structured data for data routing. In the design of the ticketing business system, specific destination ports are assigned to different business modules. For example, destination ports 6666 / 7777 are assigned to the [Remaining Ticket Inquiry] module, destination ports 6703 / 6704 are assigned to the [Window Ticketing Business] management module, destination ports 8848 / 8849 are assigned to the automatic ticketing business management module, and so on, achieving precise data routing.

[0088] As an embodiment of the present invention, a preferred classification method based on target IP is to distribute traffic according to the target IP information in structured data. In the ticketing business system, different target IP addresses are configured for business modules of different regions and levels. For example, IP address 192.xxx.1.120 is assigned to the [Ticket Availability Inquiry] business processing module, and target IPs 192.xxx.1.100-106 are assigned to the [Ticket Window] business processing modules of different stations.

[0089] As an embodiment of the present invention, preferably, the business diversion submodule identifies the destination IP in the data and allocates the ticket business data generated in the corresponding region to the corresponding regional business module, so as to facilitate regional business management and processing.

[0090] As an embodiment of the present invention, preferably, in addition to the two main classification methods mentioned above, the predefined diversion rules can also formulate more diversified diversion strategies based on actual business needs and in combination with other data fields (such as business type identifiers in payload data), to ensure that all types of passenger ticket business data can be accurately and quickly transferred to the corresponding business modules, and to ensure the efficient and stable operation of the entire passenger ticket business system.

[0091] As an embodiment of the present invention, preferably, the ticket service module identified by the predefined diversion rules includes at least one of the following: ticket availability query, ticket window, emergency ticketing, automatic ticket checking management (AFC), automatic ticketing service port, automatic ticketing management (SCM), manual real-name ticket verification, facial recognition, and POS payment.

[0092] As an embodiment of the present invention, preferably, more than 20 types of passenger ticket services are determined through the TDS protocol flow control management module and five-tuple learning and training, including ticket availability inquiry, ticket window, emergency ticketing, automatic ticket checking management (AFC), automatic ticketing service port, automatic ticketing management (SCM), manual real-name ticket verification, face recognition, POS payment, DBCS, load balancing, SSH (Secure Shell) port (the network port on the server used to listen for SSH connection requests), Zabbix, operation and maintenance platform, etc. The correspondence between passenger ticket service types and target ports and target IPs is shown in Table 1.

[0093] Table 1

[0094]

[0095] Example 3:

[0096] As an embodiment of the present invention, preferably based on embodiment one, such as Figure 3 As shown, the business operation chain library and statistical feature baseline are constructed using the collected normal behavior TDS protocol ticket business data. It mainly includes a data preprocessing submodule, a statistical analysis submodule, and a line operation chain training submodule.

[0097] As an embodiment of the present invention, preferably, the offline training module includes:

[0098] The data preprocessing submodule is configured to perform data cleaning on the data after it has been diverted by the TDS protocol flow control management module, removing empty packets with a payload length of 0 and extracting business operation units from the payload data; and to perform data cleaning on the data that has passed through the TDS protocol flow control management module, removing invalid data, specifically including:

[0099] Delete empty packets with a payload length of 0 (no business operation information);

[0100] Extract the business operation units from the payload;

[0101] The statistical analysis submodule is configured to perform statistical analysis on preprocessed business data according to predefined features to obtain statistical features and generate normal feature baselines for each ticket business module; output: "Statistical Feature Baseline Table" for each business module, which includes feature name, normal range of the feature, and abnormal range of the feature;

[0102] As an embodiment of the present invention, preferably, the predefined features include:

[0103] Feature 1: Statistical features of local fields in the payload, including the distribution of 8b / 16b / 32b fields in the payload, payload length, and the ratio of payload length to packet length;

[0104] Feature 2: Minimum and maximum package length;

[0105] Feature 3: payload information entropy, specifically:

[0106] Feature 1: Local field statistics of payload, including the distribution of payload8b field, payload16b field, payload32b field, payload length, ratio of payload length to packet length, distribution of payload8b field values, and distribution of payload16b field values, such as the frequency of occurrence of each specified field in ticketing business;

[0107] Feature 2: Minimum and maximum packet length, minimum ratio of payload length to packet length;

[0108] Feature 3: Payload information entropy calculation (quantifies the randomness of specified field data in the payload; for example, the entropy value range of a normal ticketing business payload is [2.5, 4.0], while the entropy value of an anomaly is usually <2.5 or >4.0).

[0109] The operation chain training submodule establishes security baseline checks and security event analysis. It is used to check and analyze every user and network element in the network environment. Any significant deviation from the baseline will be triggered as an anomaly alarm. It uses anomaly detection and machine learning, including network traffic, terminal behavior, content payload, etc. It is configured to extract behavioral features from business operation units based on the CNN-LSTM-Attention deep learning model to build the operation chain library.

[0110] As an embodiment of the present invention, preferably, Deep Packet Inspection (DPI) is based on application-layer traffic detection and control technology. It analyzes IP packets, including source address, destination address, source port, destination port, and protocol type. Application-layer analysis identifies various applications and their content. When IP packets, TCP, or UDP data streams are processed, the DPI-based deep reading of the IP packet payload reconstructs the application-layer information in the OSI seven-layer protocol, thereby obtaining the content of the entire application. Specifically:

[0111] --Application Analysis: Network traffic composition analysis, performance analysis, flow analysis, etc.;

[0112] --User analytics: User segmentation, behavior analysis, device analysis, trend analysis, etc.;

[0113] Extract training samples:

[0114] -Information leakage: PHPINFO information leakage, etc.;

[0115] - Weak passwords: The real-name self-service verification management system, automatic ticketing management system, and daily operation and maintenance have high-risk issues such as weak passwords;

[0116] SQL injection: SQL injection vulnerabilities exist in passenger transport marketing management;

[0117] -Unauthorized access: The point of sale management system, automatic vending management system, and real-name self-service verification management system have unauthorized access issues;

[0118] -Unauthorized access: 11 items including unauthorized access were found in the passenger marketing management and real-name self-service verification systems;

[0119] - Login brute-force attacks: The real-name self-service verification management system, automatic ticketing management system, and Changxing membership program management system are vulnerable to login brute-force attacks;

[0120] As an embodiment of the present invention, the preferred anomaly detection threat / attack type, threat triggering mechanism / check, and blocking method are shown in Table 2:

[0121] Table 2

[0122]

[0123] Continued from Table 2

[0124]

[0125] As an embodiment of the present invention, preferably, based on Embodiment 1, the operation chain training submodule constructs a finite operation chain library based on the CNN-LSTM-Attention deep learning model, the operation chain training submodule comprising:

[0126] The segmentation unit is configured to divide the payload data of each ticketing business module into the smallest independent business operation unit according to the business operation logic using regular expression matching. Through TDS protocol payload operation unit segmentation, the payload data of each business module is divided into independent smallest operation units according to the "business operation logic" using regular expression matching. For example, in the ticketing business, the login operation begins with "select @@langid" and ends with "commit tran". The decimal value corresponding to the processed TDS protocol ticketing business data payload is denoted as... Then X i =(X i1 , X i2 , ..., X in ), according to regular expression matching, the sequence Recorded as data The first operation sequence is represented as , Recorded as data The second operation sequence is represented as ,..., Recorded as data The m-th operation sequence is represented as ;

[0127] The model training unit is configured to extract behavioral features and construct operational feature sequences using a CNN-LSTM-Attention deep learning model, and then train it. The CNN-LSTM-Attention deep learning model includes:

[0128] The CNN layer is configured to transform business operation units into low-dimensional feature vectors, capturing the local field patterns of each business operation unit.

[0129] The LSTM layer is configured to capture the logical dependencies between business operations based on the feature vector sequence of business operation units, and construct a logical temporal feature sequence.

[0130] The Attention layer is configured to assign weights to the temporal feature sequence and output a weighted operation feature sequence to enhance the features of key operation units.

[0131] As an embodiment of the present invention, preferably, the operation chain library construction unit is configured to generate operation chains corresponding to each ticket business module based on the operation feature sequence, forming an operation chain library. Deep learning model selection and training: such as... Figure 5 As shown, a "CNN-LSTM-Attention hybrid model" is used to extract behavioral features and construct a feature operation chain. The model structure and function are as follows:

[0132] First layer (CNN layer): This layer divides the operation units into segments.

[0133] The data is transformed into a computable low-dimensional feature vector to capture the local field patterns of each operation unit (dimension = 256). Specifically, the data of each operation unit is converted into a decimal numerical sequence and a 3×3 convolution kernel is used (stride of 1, padding="same").

[0134] The second layer (LSTM layer): This layer takes the input operation unit feature vector sequence as input, captures the logical dependencies between operations, and concatenates the independent unit feature vectors into a logical feature sequence. For example, in a ticketing query operation, the "select query function (query by train number or by destination station)" operation must precede the "enter train number" operation. Specifically, a hidden layer dimension of 128 is chosen, and a dropout rate of 0.2 is used to prevent overfitting.

[0135] The third layer (Attention layer): Weights are assigned to the temporal feature sequences output by the LSTM layer, emphasizing the feature proportion of key operation units and weakening the influence of non-key operation units to improve the accuracy of subsequent matching. Specifically, an additive attention mechanism is used to calculate the importance score of each sequence vector through a fully connected layer. The softmax function is then used to normalize the weights of all scores, outputting a weighted operation feature sequence with the same length as the input, but with an increased feature proportion of key operations.

[0136] As an embodiment of the present invention, preferably, the training conditions of the model training unit include:

[0137] The dataset uses historical normal operation data from each ticketing business module; historical normal operation data for each business module (e.g., 160,000 normal operation sequences labeled for ticketing business, 100,000 normal operation sequences labeled for gate business, and 120,000 normal operation sequences labeled for automatic vending business).

[0138] Mark whether the order of business operation units corresponding to each operation data is valid; specifically, each sequence needs to be marked to indicate whether the order of operation units is valid and whether it contains key operation step units;

[0139] The dataset was divided into training, validation and test sets in a 7:2:1 ratio. During the training process, other passenger ticket business data was mixed in as illegal operation sequences.

[0140] The cross-entropy loss function is used to calculate and optimize the difference between the operational feature sequence predicted by the CNN-LSTM-Attention deep learning model and the normal operational feature sequence. The optimization objective is to minimize this difference.

[0141] The training termination condition is that the operation chain matching accuracy of the CNN-LSTM-Attention deep learning model on the validation set is ≥98%.

[0142] Example 4:

[0143] As an embodiment of the present invention, based on Embodiment 1, preferably, the online matching audit stage (real-time traffic legality determination and high-risk event mining) is used to determine the legality of real-time traffic and mine high-risk events based on the determination results and statistical feature baselines. The online matching module includes:

[0144] The real-time processing submodule is configured to process and distribute real-time TDS protocol data, and to parse and distribute real-time TDS protocol ticket business data. It repeats the parsing and distribution steps to parse and distribute real-time access TDS protocol data packets to the corresponding business modules.

[0145] The real-time preprocessing submodule is configured to perform cleaning on the real-time split data, repeat the splitting principle steps, and split the business operation units.

[0146] The operation chain matching submodule is configured to extract the real-time operation unit sequence from the segmented operation units, obtain the real-time operation chain through the CNN-LSTM-Attention model, and match the real-time operation chain with the operation chain library.

[0147] The matching rules for the operation chain matching submodule include:

[0148] Exact match: The real-time operation chain matches the operation unit sequence of an operation chain in the operation chain library, allowing one non-critical operation unit deviation, and is judged as normal business traffic; The real-time operation chain matches the operation unit sequence of an operation chain in the "Business Operation Chain Library" (allowing one non-critical operation unit deviation, such as adding "View Help" before "Return to Main Menu"), and is judged as "normal business traffic".

[0149] Partial matching: If a key operation unit is missing in the real-time operation chain or the operation unit order is reversed, it is judged as suspicious traffic; if a key operation unit is missing in the real-time operation chain (such as the ticket booking business missing "0x0211_ID_INPUT" authentication) or the operation unit order is reversed (such as "confirm ticket booking" before "select ticket booking function"), it is judged as "suspicious traffic".

[0150] Mismatch: The real-time operation chain has no matching operation chain in the library, which is judged as abnormal traffic;

[0151] The statistical feature detection submodule is configured to perform statistical analysis on real-time TDS protocol ticket business data and compare it with the feature baseline table. It calculates defined statistical features for real-time data and compares them with the "Statistical Feature Baseline Table". Anomaly judgment: if a single feature exceeds the normal range (such as the ticket sales business payload entropy value = 6.2 > 4.0) or multiple features are abnormal at the same time (such as "refund operation frequency" exceeding the statistical frequency, and the value of the payload8b field is outside the 80% statistical value), it is marked as "statistical abnormal traffic".

[0152] As an embodiment of the present invention, preferably, the security audit logic combines the "operation chain matching result" with the "statistical feature baseline" to output the audit result. The audit result output by the security audit and high-risk event mining module includes: normal traffic, compliance warning, and high-risk events; high-risk events include at least one of business unauthorized access, operational violations, and protocol attacks.

[0153] As an embodiment of the present invention, preferably, the audit result is output as follows:

[0154] Normal traffic: The operation chain is fully matched and the statistical characteristics are 80% consistent with the statistical characteristic baseline;

[0155] Compliance warning: The operation chain partially matches but is consistent with 80% of the statistical characteristic baseline (e.g., the ticket booking business omits "return to main menu");

[0156] High-risk incidents: sensitive data leakage, SQL injection vulnerability, cross-site scripting vulnerability, operation chain mismatch + abnormal statistical characteristics (such as ticket booking operation in the gate business and abnormal payload entropy value).

[0157] Type 1: Unauthorized business operations (such as performing real-name verification operations in automatic vending machines).

[0158] Type 2: Operational violation (such as booking tickets without identity verification);

[0159] Type 3: Protocol attacks (such as TDS packet flooding with abnormal payload entropy).

[0160] Output: Real-time Security Audit Report (including the business module to which the traffic belongs, matching results, anomaly characteristics, high-risk event type, and trigger time), and trigger alarms (such as pushing high-risk events to the operation and maintenance platform). Output report: Security audit paradigm; security issues and preventive measures of a certain station (example only), as shown in Table 3:

[0161] Table 3

[0162]

[0163] Example 5:

[0164] As an embodiment of the present invention, based on Embodiment 1, iterative optimization of the model and baseline is also included, specifically:

[0165] Every T periods (e.g., T=7 days), the newly added normal operation sequences and statistical data from the online audit are added to the offline training dataset. Repeat Example 2 to update the "Statistical Feature Baseline Table" and the "Business Operation Chain Library" to ensure that the model adapts to the updated business processes.

[0166] Example 6:

[0167] As an embodiment of the present invention, the present invention is a method for security auditing and high-risk event mining based on TDS protocol logs and flow control, such as... Figure 2 As shown, the method is implemented based on the system described in Embodiment 1, and the method includes the following steps:

[0168] The system performs protocol parsing on the received TDS protocol ticket service data packets and performs service routing according to predefined rules.

[0169] After the data is split, data preprocessing and statistical analysis are performed to construct feature baselines, and behavioral features are extracted to construct behavioral feature operation chains to establish an operation chain library.

[0170] The real-time received TDS protocol ticket business data will be diverted through the TDS protocol flow control management module and then matched online with the operation chain library to determine the legality of the traffic.

[0171] Based on online matching results and feature baselines, audit the compliance of ticketing business, identify high-risk events, and output audit results.

[0172] A security auditing and high-risk event mining method and system based on TDS protocol logs and flow control is proposed. This system performs protocol parsing on received TDS protocol ticketing data packets and performs business traffic diversion according to predefined rules. After diversion, data preprocessing and statistical analysis are performed on each data packet to construct a feature baseline, and behavioral features are extracted to construct a behavioral feature operation chain to establish an operation chain library. Real-time received TDS protocol ticketing data is diverted through the TDS protocol flow control management module and matched online with the operation chain library to determine the legality of the traffic. Based on the online matching results and feature baseline, the system audits the compliance of ticketing business, mines high-risk events, and outputs audit results. By combining behavioral sequence matching and statistical feature analysis of different dimensions of detection technology, false positives and false negatives are effectively reduced, constructing a precise, automated, and self-learning proactive defense system.

[0173] In the description of this specification, references to terms such as "an embodiment," "example," "specific example," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0174] The preferred embodiments of the present invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to the specific implementations described. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention. The invention is limited only by the claims and their full scope and equivalents.

Claims

1. A security auditing and high-risk event mining system based on TDS protocol logs and flow control, characterized in that, include: The TDS protocol flow control management module is configured to receive TDS protocol ticket business data packets, perform protocol parsing, and perform business diversion according to predefined rules. The offline training module is configured to perform data preprocessing and statistical analysis on the split data to build feature baselines, and extract behavioral features to build behavioral feature operation chains to establish an operation chain library. The online matching module is configured to receive TDS protocol ticket business data in real time, and after being diverted by the TDS protocol flow control management module, match it with the operation chain library to determine the legality of the traffic; The security audit and high-risk event mining module is configured to audit the compliance of ticket business and mine high-risk events based on online matching results and feature baselines, and output audit results.

2. The security auditing and high-risk event mining system based on TDS protocol logs and flow control according to claim 1, characterized in that, The TDS protocol flow control management module includes: The TDS protocol parsing submodule is configured to receive TDS protocol ticket business data packets, perform protocol parsing operations, and extract a five-tuple including source IP, destination IP, source port, destination port, transport layer protocol, and payload data from the data packets to form structured data. The business routing submodule is configured to distribute structured data to the corresponding ticketing business module based on predefined routing rules; The predefined traffic splitting rules include traffic splitting rules based on the target port and / or the target IP.

3. The security auditing and high-risk event mining system based on TDS protocol logs and flow control according to claim 2, characterized in that, The predefined diversion rules identify at least one of the following ticket service modules: ticket availability inquiry, ticket window, emergency ticketing, automatic ticket checking management (AFC), automatic ticketing service port, automatic ticketing management (SCM), manual real-name ticket verification, facial recognition, and POS payment.

4. The security auditing and high-risk event mining system based on TDS protocol logs and flow control according to claim 1, characterized in that, The offline training module includes: The data preprocessing submodule is configured to perform data cleaning on the data after it is diverted by the TDS protocol flow control management module, remove empty packets with a payload data length of 0, and extract the business operation units in the payload data. The statistical analysis submodule is configured to perform statistical analysis on the preprocessed business data according to predefined characteristics to obtain statistical characteristics and generate normal characteristic baselines for each ticket business module; The operation chain training submodule is configured to extract behavioral features from business operation units and build an operation chain library based on the CNN-LSTM-Attention deep learning model.

5. The security auditing and high-risk event mining system based on TDS protocol logs and flow control according to claim 4, characterized in that, The predefined features include: Feature 1: Statistical features of local fields in the payload, including the distribution of 8b / 16b / 32b fields in the payload, payload length, and the ratio of payload length to packet length; Feature 2: Minimum and maximum package length; Feature 3: payload information entropy.

6. The security auditing and high-risk event mining system based on TDS protocol logs and flow control according to claim 4, characterized in that, The operation chain training submodule includes: The segmentation unit is configured to segment the payload data of each ticket business module into the smallest independent business operation unit according to the business operation logic using a regular expression matching method. The model training unit is configured to use a CNN-LSTM-Attention deep learning model to extract behavioral features, construct operational feature sequences, and train the model. The operation chain library construction unit is configured to generate operation chains corresponding to each ticket business module based on the operation feature sequence, thus forming the operation chain library. The CNN-LSTM-Attention deep learning model includes: The CNN layer is configured to transform business operation units into low-dimensional feature vectors, capturing the local field patterns of each business operation unit. The LSTM layer is configured to capture the logical dependencies between business operations based on the feature vector sequence of business operation units, and construct a logical temporal feature sequence. The Attention layer is configured to assign weights to the temporal feature sequence and output a weighted operational feature sequence.

7. The security auditing and high-risk event mining system based on TDS protocol logs and flow control according to claim 6, characterized in that, The training conditions for the model training unit include: Use historical normal operation data from each ticketing business module as the dataset; The dataset is divided into training, validation, and test sets in a 7:2:1 ratio. The cross-entropy loss function is used to calculate and optimize the difference between the operational feature sequence predicted by the CNN-LSTM-Attention deep learning model and the normal operational feature sequence. The training termination condition is that the operation chain matching accuracy of the CNN-LSTM-Attention deep learning model on the validation set is ≥98%.

8. The security auditing and high-risk event mining system based on TDS protocol logs and flow control according to claim 1, characterized in that, The online matching module includes: The real-time processing submodule is configured to parse and distribute real-time TDS protocol ticket business data. The real-time preprocessing submodule is configured to perform cleaning on the real-time offloaded data and to segment the data into business operation units. The operation chain matching submodule is configured to extract the real-time operation unit sequence from the segmented operation units, obtain the real-time operation chain through the CNN-LSTM-Attention model, and match the real-time operation chain with the operation chain library. The statistical feature detection submodule is configured to perform statistical analysis on real-time TDS protocol ticket business data and compare it with the feature baseline table.

9. The security auditing and high-risk event mining system based on TDS protocol logs and flow control according to claim 1, characterized in that, The audit results output by the security audit and high-risk event mining module include: normal traffic, compliance warnings, and high-risk events; high-risk events include at least one of the following: unauthorized business operations, operational violations, and protocol attacks.

10. A method for security auditing and high-risk event mining based on TDS protocol logs and flow control, characterized in that, The method is implemented based on the system according to any one of claims 1-9, and the method includes the following steps: The system performs protocol parsing on the received TDS protocol ticket service data packets and performs service routing according to predefined rules. After the data is split, data preprocessing and statistical analysis are performed to construct feature baselines, and behavioral features are extracted to construct behavioral feature operation chains to establish an operation chain library. The real-time received TDS protocol ticket business data will be diverted through the TDS protocol flow control management module and then matched online with the operation chain library to determine the legality of the traffic. Based on online matching results and feature baselines, the audit of ticket business compliance is conducted, high-risk events are identified, and audit results are output.

Images