Smart campus network security protection system

Abstract

The invention relates to the technical field of electric digital data processing, and discloses an intelligent campus network security protection system. A network data acquisition module of the system continuously monitors data transmission flow of a smart campus network environment to obtain an original data packet; the chaotic encryption engine encrypts an original data packet by using a key stream based on dynamic chaotic mapping, wherein the key stream is generated by multi-chaotic system switching and a random parameter distribution mechanism; the security protocol processing module converts the encrypted data packet into a format conforming to a network security protocol standard and transmits the encrypted data packet; the data decryption unit decrypts the received encrypted data packet; the security threat analysis module identifies and estimates potential network attack behaviors according to the decrypted plaintext data; and the protection strategy controller generates and executes a network security protection instruction according to the threat analysis result. The system can effectively protect the network security of the smart campus, resist various network attacks, and ensure the security of data transmission and storage.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of digital data processing, in particular to a network security protection system for a smart campus. BACKGROUND

[0002] With the rapid development of information technology, the education field is undergoing profound changes, and smart campus has emerged and gradually popularized in various schools. From the initial exploration stage in the late 1990s to the current deep integration and innovation stage, smart campus has made great progress. According to statistics, the market size of smart campus in China reached 88 billion yuan in 2024, with a year-on-year growth of 13%, and is expected to maintain a high growth trend in the coming years.

[0003] In terms of technology, advanced technologies such as 5G, artificial intelligence, Internet of Things, cloud computing, and big data provide strong support for the construction of smart campus. 5G network, with its high speed, low latency, and wide coverage, enables fast transmission of data within the campus, such as online teaching, holographic classroom, etc. The application can be carried out smoothly, breaking the time and space limitations of traditional teaching. Artificial intelligence technology is increasingly widely used in teaching, AI tutoring, and AI teaching assistants provide personalized learning paths for students, intelligently pushing learning content and exercises based on students' learning conditions and characteristics, meeting the learning needs of different students.

[0004] In terms of application scenarios, smart campus covers teaching, scientific research, management, campus security, logistics support, and other aspects. In the smart classroom, interactive teaching equipment makes communication between teachers and students more convenient and efficient; the smart library realizes intelligent retrieval and borrowing of books, and can also recommend related books based on students' reading habits; the smart laboratory monitors the running state of experimental equipment in real time through sensors to ensure experimental safety; the smart management system integrates various information of the school, realizes office automation and intelligence, and improves management efficiency.

[0005] At the same time, the amount of data carried by the campus network is also growing explosively. In terms of teaching data, online course videos, teaching courseware, student assignments, and other materials are increasing; management data involves student information, teacher personnel files, school financial data, etc.; there are also a large amount of personal data of teachers and students, such as health information, consumption records, etc. These data are of great significance to the improvement of teaching quality, management decision-making, and the learning and living of teachers and students.

[0006] With the rapid development of smart campus, network security problems have become increasingly prominent, becoming an important factor restricting its further development. Smart campus is facing many network attack risks. DDoS attack (Distributed Denial of Service attack) is a common one, through a large number of false requests to occupy network bandwidth and server resources, making the campus network service paralyzed, leading to online teaching unable to proceed normally, school management system cannot be accessed, etc. Malicious software intrusion is also a big threat, such as Trojan, virus and other malicious programs may steal the personal information of teachers and students, tamper with teaching data, and even destroy the school's network infrastructure. Data leakage incidents also occur from time to time. Once the sensitive data such as students' grades, personal identity information, teachers' research results, etc. are leaked, not only will it cause damage to the personal rights and interests of teachers and students, but also may trigger a crisis of trust, affecting the reputation of the school.

[0007] Traditional network security protection means gradually exposes many problems when dealing with these complex and variable attack scenarios. Insufficient detection capability is a major problem. Traditional firewalls, intrusion detection systems, etc. can only identify known attack patterns, and are difficult to detect new and variant attack methods. The protection mechanism is single, mainly relying on access control, encryption and other basic means, lacking a multi-level and all-round protection system, and unable to effectively resist attacks from all levels of the network. Moreover, traditional protection means is low in efficiency when dealing with massive data, and is difficult to meet the needs of high-speed data transmission and real-time processing of smart campus. For example, in the face of large-scale DDoS attack, traditional firewall may not be able to handle it in time due to too much traffic, causing network congestion and affecting normal teaching and management business.

[0008] Smart campus has an urgent need for data security, user privacy protection and business continuity protection. Data is the core asset of smart campus, and it is crucial to protect the confidentiality, integrity and availability of data. Students' personal information, learning records and other privacy-related information, once leaked, may have a negative impact on students' future development; teachers' research data is related to academic achievements and career development, and cannot be lost. Therefore, effective measures must be taken to protect data from being illegally obtained, tampered with and destroyed.

[0009] User privacy protection is also an issue that cannot be ignored in the construction of smart campus. With the continuous improvement of people's awareness of privacy protection, schools have the responsibility to take technical and management measures to ensure that teachers and students' personal privacy is fully respected and protected when using campus network services.

[0010] Business continuity assurance is also crucial for the normal operation of smart campus. Once the online teaching, management system and other businesses are interrupted, it will seriously affect the teaching order and the daily management of the school. For example, if the network fails during the examination, it will cause serious consequences. However, the current network security protection system is difficult to meet these needs, and there are many loopholes and deficiencies. Therefore, it is urgent to develop a more efficient, comprehensive and intelligent smart campus network security protection system. The protection system of the present patent is based on such background and is born in response to the situation, aiming to solve the difficulties faced by smart campus network security and provide solid protection for the stable development of smart campus. SUMMARY

[0011] The purpose of the present application is to provide a smart campus network security protection system to solve the problems raised in the background technology.

[0012] To achieve the above purpose, the present application provides a smart campus network security protection system, which comprises: A network data acquisition module for continuously monitoring data transmission flow in the smart campus network environment and acquiring raw data packets; A chaotic encryption engine for encrypting the raw data packets using a key stream based on dynamic chaotic mapping, wherein the key stream is generated through a multi-chaotic system switching and random parameter allocation mechanism; A security protocol processing module for converting the encrypted data packets into a format conforming to the network security protocol standard and transmitting them through a network interface; A data decryption unit for decrypting the received encrypted data packets to restore them to plaintext data; A security threat analysis module for identifying and estimating potential attack behaviors in the network based on the decrypted plaintext data; A protection strategy controller for generating specific network security protection instructions based on the threat analysis results and performing corresponding actions.

[0013] Preferably, the chaotic encryption engine is specifically configured to perform the following encryption steps: Collecting network traffic real-time fluctuation characteristics as initial input values for chaotic mapping; Injecting the initial input values into a cascaded chaotic mapping sequence with variable iteration depth to generate a primary chaotic sequence; Adjusting the iteration parameters of the cascaded chaotic mapping sequence according to the network protocol end-to-end delay; Extracting specific segments of the primary chaotic sequence and performing nonlinear fusion with a random number pool to generate a final encryption key stream.

[0014] Preferably, the security protocol processing module and the data decryption unit cooperate to realize the following security protocol adaptation process: The network security protocol header information is parsed at the data transmission end to extract the protocol version identifier; According to the protocol version identifier, the data encapsulation format is dynamically selected, and the encrypted data packet is reorganized into a protocol data unit; A protocol analysis buffer is established at the data receiving end, and the encapsulation header is peeled off layer by layer according to the protocol specification; The decryption operation is triggered after verifying the data integrity through the protocol feature matching algorithm.

[0015] Preferably, the generation of the random number pool adopts a distributed entropy source collection method based on network topology: Deploy multiple entropy source collection nodes to continuously monitor network device operating state parameters; The entropy value data collected by each node is generated into an entropy pool seed through a weighted fusion algorithm; The entropy pool seed is periodically updated using a sliding time window mechanism; The irreversibility of the entropy pool seed update process is ensured through a hash chain structure.

[0016] Preferably, the switching control of the cascaded chaotic mapping sequence adopts the following adaptive mechanism: A network load state evaluation model is constructed to calculate the network traffic complexity index in real time; A chaotic mapping selection decision table is established to map the complexity index to a specific chaotic system combination; A feedback regulator is designed to dynamically adjust the chaotic system switching frequency according to the encryption delay; An abnormal state detection mechanism is set, and a backup chaotic sequence is enabled when abnormal traffic patterns are detected.

[0017] Preferably, the protection strategy controller executes the following protection strategy generation process: A multi-dimensional threat feature space is constructed to map the decrypted network data to the feature space; A sliding window mechanism is used to extract the time sequence evolution pattern of threat features; A strategy decision tree model is designed to generate a protection instruction sequence according to the feature matching degree; A strategy execution effect evaluation loop is established to adjust the strategy parameters in real time.

[0018] Preferably, the construction of the multi-dimensional threat feature space specifically includes: Define a set of network behavior primitives, including connection frequency, packet size distribution, and protocol type combination; Use principal component analysis to reduce the dimensionality of the primitive set and extract key feature vectors; Establish a dynamic feature vector update mechanism to adaptively adjust the feature weights according to new attack patterns; Design feature effectiveness verification process, eliminate invalid feature dimensions regularly.

[0019] Preferably, the entropy source collection node shares the same data collection framework with the threat feature space: Deploy a unified data collection agent to collect network status data and threat feature data simultaneously; Establish a data label association mechanism to associate entropy source data with threat features in space and time; Design a data quality evaluation module to score the credibility of collected data; Build a data fusion center to realize collaborative processing and analysis of multi-source data.

[0020] Preferably, the network data collection module executes the following intelligent data collection process: Configure programmable data collection strategies to dynamically adjust the collection granularity according to the importance of network regions; Use the combination of flow mirroring and deep packet inspection technology to capture raw data packets; Design a data preprocessing pipeline to denoise and standardize the collected data; Implement an online update mechanism for collection strategies to adaptively adjust collection parameters according to the network security situation.

[0021] Preferably, the network data collection module and the security threat analysis module establish the following data collaboration mechanisms: Design a data hierarchical transmission channel to use different encryption strengths according to data sensitivity; Establish a data timeliness management strategy to set the highest transmission priority for real-time alarm data; Implement a data analysis task scheduler to coordinate the processing rhythm of the collection module and the analysis module; Build a data quality feedback loop to optimize the collection strategy in reverse based on analysis results.

[0022] Compared with the prior art, the beneficial effects of the present application are: In the intelligent campus network security protection system, the chaotic encryption engine is the key defense line to protect data security. It uses a key stream based on dynamic chaotic mapping to encrypt the original data packet, which greatly improves the confidentiality of the data. Dynamic chaotic mapping has high complexity and randomness, making the generated key stream difficult to predict and crack.

[0023] The key stream is generated through a multi-chaotic system switching and random parameter allocation mechanism, which further enhances the randomness and security of the key. The multi-chaotic system switching mechanism can flexibly switch between multiple chaotic systems, and each switch will generate chaotic sequences with different characteristics, increasing the variation dimension of the key. The random parameter allocation mechanism assigns random parameters to each chaotic system, making the generated key stream more unpredictable. For example, in practical applications, when sensitive student performance data, teacher research achievement data, etc. are transmitted in the campus network, the chaotic encryption engine will quickly start the encryption program. After these data are encrypted, even if they are illegally obtained, attackers will face seemingly irregular ciphertexts. Due to the high randomness and complexity of the key stream, they are almost impossible to crack the original data through conventional means, effectively protecting the privacy and security of the data and ensuring the confidentiality of the data during transmission, preventing data leakage from affecting the school and students.

[0024] The security protocol processing module plays an important role in the smart campus network security protection system as a "regulator" of data transmission. Its main responsibility is to convert encrypted data packets into a format that complies with network security protocol standards, which is crucial for ensuring the safe and stable transmission of data in the network.

[0025] In today's complex network environment, different network devices and systems need to follow uniform protocol standards to achieve smooth communication. The security protocol processing module acts like a translator, converting encrypted data packets into a standard format that the network can recognize and understand. Whether in the campus internal local area network or in data interaction with external networks, this module ensures that data packets comply with relevant network security protocol standards such as TCP / IP protocol, SSL / TLS protocol, etc.

[0026] When the smart campus shares remote teaching resources with other schools or educational institutions, the security protocol processing module will convert encrypted teaching resource data packets into a standard protocol-compliant format for transmission. In this way, the receiving network system can accurately receive and analyze these data packets, avoiding data transmission failures or errors due to protocol incompatibility. At the same time, the transmission method that complies with network security protocol standards also enhances the security of data transmission, preventing malicious tampering or theft during transmission, ensuring smooth communication of the campus network, and enabling various teaching and management businesses to operate normally.

[0027] The security threat analysis module is the "early warning radar" of the smart campus network security protection system. Based on the decrypted plaintext data, it uses advanced technologies such as big data analysis and machine learning to accurately identify and estimate potential attack behavior in the network.

[0028] With the increasing amount of data in the smart campus network and the increasing complexity of attack methods, traditional threat identification methods have been difficult to meet the needs. This module can discover abnormal behavior and potential threats hidden in the massive network data through real-time analysis. For example, through machine learning algorithms to model network traffic data, when it is found that the network traffic in a certain period of time has abnormal fluctuations, far exceeding the normal range, the system will automatically trigger the early warning mechanism. It can also analyze the user's behavior patterns, and when it detects that the login location, login time, operation behavior of a user do not match the user's historical behavior patterns, it will also be judged as a potential security risk.

[0029] In practical applications, when an external malicious attacker tries to break into the campus network system by brute force password cracking, the security threat analysis module can quickly capture a large number of login failure requests from the same IP address, and according to the preset model and rules, it is judged that this is a potential attack behavior, and timely alarm is issued, providing accurate basis for subsequent protection measures, avoiding further attacks on the campus network. BRIEF DESCRIPTION OF DRAWINGS

[0030] Figure 1 The working principle diagram of the smart campus network security protection system described in the present application; Figure 2 The flowchart of the chaotic encryption engine encryption; Figure 3 The flowchart of the security protocol adaptation; Figure 4 The network load and chaotic mapping switching frequency and encryption delay relationship diagram; Figure 5 The threat feature dimension number and detection performance relationship diagram. DETAILED DESCRIPTION

[0031] The technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor are within the scope of protection of the present application.

[0032] Please refer to Figure 1 The present application provides a kind of smart campus network security protection system, the system includes: network data acquisition module, chaotic encryption engine, security protocol processing module, data decryption unit, security threat analysis module and protection strategy controller. Specific implementation is as follows: The network data acquisition module is deployed at the core switching node of the smart campus network, continuously captures original data packets in the network environment through a mirror port and a probe technology, and the original data packets include an Ethernet frame header and a payload part. The chaotic encryption engine is integrated at the output end of the network data acquisition module, a dynamic chaotic mapping algorithm is realized by using a field programmable gate array hardware, the dynamic chaotic mapping algorithm is based on a hybrid system of a Logistic mapping and a Chen mapping, and a network flow real-time feature is introduced as a disturbance factor in a key stream generation process. The security protocol processing module is located behind the chaotic encryption engine, processes an encapsulation format of an encrypted data packet, supports conversion of IPsec and TLS protocol standards, and maintains a protocol state machine inside the module to process handshake and retransmission logic. The data decryption unit symmetrically runs a decryption process of the chaotic encryption engine at a receiving end, the decryption process uses the same key stream generation mechanism, but applies an inverse mapping operation to restore data. The security threat analysis module is connected to an output of the data decryption unit, analyzes a decrypted plaintext data stream, and identifies attack signatures by using a pattern matching and an anomaly detection algorithm. The protection policy controller receives an alarm signal of the security threat analysis module, generates a firewall rule or a traffic shaping instruction, and delivers the firewall rule or the traffic shaping instruction to a network device through an SDN controller.

[0033] Embodiment 1: refer to Figure 2 The network data acquisition module sends the captured original data packets into a first-in-first-out preprocessing buffer, the existence of the preprocessing buffer enables the data packet stream to be processed by the chaotic encryption engine at a stable rate, and overflow caused by data bursts is avoided. Collection of real-time fluctuation features of network traffic depends on a separate statistical calculation module, the statistical calculation module continuously monitors arrival time intervals of data link layer frames and changes in data payload lengths, calculates short-time variances and means, and normalizes the short-time variances and means to an interval of 0 to 1, and the normalized values are used as initial input values required by a dynamic chaotic mapping system. The initial input values are injected into a cascaded chaotic mapping sequence composed of a plurality of chaotic mapping functions, the composition of the cascaded chaotic mapping sequence is not fixed, and the cascaded chaotic mapping sequence includes a Logistic mapping, a Chebyshev mapping, and an improved Henon mapping. The iteration depth of each chaotic mapping function in the cascaded chaotic mapping sequence is a variable iteration depth that can be dynamically adjusted, and the adjustment logic of the variable iteration depth is associated with a service level identifier of a current processing data packet, and a higher priority control signaling data packet triggers a deeper iteration number to enhance security. The generation process of the primary chaotic sequence is a continuous iteration calculation, and the iteration calculation is performed on a dedicated hardware logic circuit, and the hardware logic circuit realizes a parallel pipeline architecture to improve throughput.

[0034] The network protocol end-to-end delay, as a dynamic feedback parameter, affects the iteration parameters of the cascaded chaotic mapping sequence. The end-to-end delay is periodically measured by delay probe agents deployed at both ends of the communication path. The measurement results are encapsulated in a feedback control packet and sent to the parameter controller of the chaotic encryption engine. According to the size of the delay value, the parameter controller adjusts the value range of the parameter μ of the Logistic mapping according to a predefined mapping relationship. After the primary chaotic sequence is generated, a specific segment of the sequence is extracted by a selector. The selection algorithm is based on the analysis of the autocorrelation characteristics of the sequence, and the goal is to select the segment with the lowest autocorrelation value to maximize randomness. The extracted primary chaotic sequence segment is sent to a nonlinear fusion unit. The other input of the nonlinear fusion unit comes from a random number pool, which is maintained and updated by an independent physical entropy source module in the system. The nonlinear fusion operation uses a custom S-box for byte substitution, followed by cyclic shift and modulo addition operations, and finally outputs a final encryption key stream that is the same length as the original data packet. The final encryption key stream and the original data packet taken from the preprocessing buffer are subjected to a bit-by-bit encryption operation in an XOR operation unit. The encryption operation process is implemented at the hardware level, and one byte of data can be processed per clock cycle. The encrypted data packet is attached with a message authentication code, which uses the SHA-256 algorithm to calculate the hash value of the encrypted data for data integrity verification.

[0035] The update mechanism of the key stream is tightly coupled with the network session state, and the key stream generator of the chaotic encryption engine is reinitialized whenever a new Transmission Control Protocol session or User Datagram Protocol data flow is established. The reinitialized seed value is derived from the session key and the current network traffic fluctuation features in real time, which makes each session use unique key material, and even the same plaintext will be encrypted into different ciphertext in different sessions. The chaotic encryption engine maintains the state variables of the chaotic map system inside, and the state variables are updated after each iteration, and their evolution path is slightly disturbed by the real-time collected network load indicators. Network load indicators such as the instantaneous throughput of the network interface are introduced into the calculation of the state variables. This disturbance makes the trajectory of the chaotic system more unpredictable, effectively preventing password analysis based on phase space reconstruction. The output end of the encryption engine is connected to the security protocol processing module, and the encryption engine records the key parameters used in this encryption operation before the packet is sent out. The key parameters include the type combination of the chaotic map, the number of iterations, and the random number pool version number used in nonlinear fusion. These parameters are encrypted and transmitted together with the ciphertext data for the data decryption unit of the receiving end. The design of the entire encryption process considers the balance between computational efficiency and security strength. The complexity of the cascaded chaotic map sequence can be dynamically adjusted according to the current threat level of the network. When the security threat analysis module indicates that the network is in a high-risk state, the chaotic encryption engine will automatically switch to a cascaded mode containing more chaotic maps, and increase the reference value of the variable iteration depth. Although this will increase a small amount of computational delay, it significantly improves the encryption strength. The hardware implementation of the chaotic encryption engine uses a partially reconfigurable field programmable gate array, which allows different encryption logic bit streams to be dynamically loaded during system operation to adapt to the needs of future cryptography development.

[0036] Embodiment 2: see Figure 3, the security protocol processing module is activated at the data transmission end, the module receives the data block with completed encryption processing from the chaos encryption engine, and the encrypted data block carries original meta-information including source and destination IP addresses and port numbers. The security protocol processing module integrates a protocol parser inside, the protocol parser deeply checks the network layer and the transmission layer header of the data packet, and extracts a protocol version identifier field used to identify the security protocol type. The value of the protocol version identifier field is matched and queried with a locally stored protocol configuration database, the protocol configuration database stores detailed encapsulation format requirements of IPsec protocols, TLS protocols and private protocols in the form of a table. According to the query result, a corresponding data encapsulation format is dynamically selected, and the encapsulation operation includes adding a new protocol header, fragmenting the encrypted data to adapt to the maximum transmission unit of the path, calculating and filling the integrity check value. The encapsulated data unit is called a protocol data unit, and the structure of the protocol data unit conforms to the standard protocol specification so as to interwork with third-party equipment. The protocol data unit is sent to the physical network through the network interface driver, and the sending process may involve multiple network hops. At the receiving end of the communication link, a protocol parsing buffer is deployed in front of the data decryption unit, the protocol parsing buffer uses a ring queue structure with read and write pointers to manage the arriving data packet. The protocol parsing buffer processes the protocol data unit according to the hierarchical order of the network protocol stack, starts from the outermost IP header, verifies the checksum and time-to-live value of the IP header. Then the exposed security protocol header is parsed by the receiving logic of the security protocol processing module, the parsing process confirms the protocol type, sequence number and anti-replay window information, and any data packet not conforming to the protocol specification will be recorded and discarded.

[0037] The data packets that pass the preliminary check enter the protocol feature matching stage, in which the key fields in the header are compared with the expected patterns. The key fields include the security parameter index and the sequence number, and the expected patterns are derived from the state of the current security association database. The protocol data units that match the expected patterns are determined to be complete and valid, and a hardware interrupt is triggered to inform the data decryption unit to prepare for the decryption operation. The data decryption unit reads the chaotic encryption engine initialization parameters from the shared memory, which are attached to the extended area of the protocol data unit by the sending end. The data decryption unit generates the keystream using the same concatenated chaotic mapping sequence, and the generation process needs to reproduce the chaotic system state of the sending end. The decryption operation is the inverse process of the encryption operation, and the decryption operation uses the same keystream to perform the XOR operation with the ciphertext data to recover the plaintext. The switching control of the concatenated chaotic mapping sequence is managed by a separate adaptive mechanism, and the core of the adaptive mechanism is a network load state evaluation model. The network load state evaluation model continuously monitors the throughput, packet queuing delay and packet loss rate of the network interface card, and these indicators are combined into a scalar value, i.e. the network traffic complexity indicator, by a multivariate equation. The network traffic complexity indicator is input into a predefined chaotic mapping selection decision table, which is a two-dimensional lookup table. One dimension is the segmented interval of the complexity indicator, and the other dimension is the recommended chaotic system combination. The chaotic system combination specifies the type of chaotic mapping that should be activated in the concatenated chaotic mapping sequence and its connection order.

[0038] The search result outputs a chaotic system configuration profile, which is issued to the controller logic of the chaotic encryption engine. The controller logic dynamically rearranges the function order of the cascaded chaotic mapping sequence or replaces the mapping type according to the configuration profile. The switching action occurs in the gap between two packet processing to avoid interrupting the data stream. A feedback regulator works in parallel, which monitors the time interval from the encryption request to the encryption completion, i.e. the encryption delay. The encryption delay data is compared with a dynamic threshold value. When the encryption delay continues to exceed the threshold value, the feedback regulator generates a control signal to reduce the chaotic system switching frequency. Reducing the switching frequency means reducing the number of changes in chaotic mapping combinations per unit time, thereby reducing the calculation overhead to stabilize the delay. An abnormal state detection mechanism operates as a safety backup scheme, which uses a lightweight machine learning model to analyze real-time traffic patterns. The machine learning model compares the deviation of the current traffic statistical features from the historical normal baseline. When the deviation exceeds the safety threshold, it is determined that the traffic pattern is abnormal. At this time, the adaptive mechanism is temporarily bypassed, and the cascaded chaotic mapping sequence switching control enables a preset backup chaotic sequence. The backup chaotic sequence uses a single chaotic mapping function with lower computational complexity to ensure that the encryption function remains available in extreme environments where the network is congested by attacks. The coordination of the entire security protocol processing module and the data decryption unit and the adaptive switching process constitute a closed control loop, which enables the encryption communication system to intelligently adapt to the dynamic changes of network conditions and balance security strength and transmission performance.

[0039] Referring to Figure 4 The figure takes network load as the horizontal axis, and takes chaotic mapping switching frequency and encryption delay as double vertical axes, clearly showing the performance of the chaotic encryption engine in the intelligent campus network security protection system as the network load changes. Among them, the black curve represents the chaotic mapping switching frequency, and the gray curve represents the encryption delay. The chart directly reflects the adaptive encryption characteristics of the system when the network load changes: in the light load scenario, the switching frequency and the encryption delay are low, which guarantees the encryption efficiency; in the high load scenario, the system automatically increases the chaotic mapping switching frequency to enhance the encryption security, although the encryption delay increases, but through dynamic balance, both security strength and performance can be considered in different network load scenarios, fully verifying the technical rationality and practicality of the chaotic mapping switching adaptive mechanism.

[0040] Embodiment 3: Generation of random number pool The distributed entropy source collection method based on network topology is adopted, and the entropy source collection nodes, as the starting point of physical randomness, are deployed on the key infrastructure nodes of the smart campus network. The entropy source collection nodes monitor various operating state parameters of the target network equipment, including the instantaneous utilization rate of each core of the central processing unit, the access delay of the memory controller, the hard disk read-write queue length, the error code statistics of the network port, and the readings of the internal temperature sensor of the device. These parameters have inherent randomness and unpredictability, and their original values are periodically sampled and temporarily stored in the local buffer of the node. Each sampling value undergoes a standardization process, which maps parameter values of different dimensions and ranges to a unified floating-point number interval between 0 and 1. The mapping function is adaptively adjusted according to the historical minimum and maximum values of each parameter. The standardized entropy value data is transmitted from each distributed node to a central fusion node, and an authenticated encryption channel is used during transmission to prevent the entropy value data from being stolen or tampered with during transmission. A weighted fusion algorithm is used to process the collected entropy value data in the central fusion node, and the weighted fusion algorithm assigns a dynamic weight to each entropy source collection node. The calculation of the weight is based on the credibility score of the entropy source collection node and the network distance from the fusion center. The credibility score is evaluated by the historical data quality, running stability, and management authority level of the node. The network distance is measured by round-trip time, and shorter network distance means lower delay and higher data freshness, thus obtaining a higher weight. The fusion calculation obtains a preliminary entropy pool seed, which is a fixed-length bit sequence.

[0041]

[0042] wherein: represents the fusion weight of the th entropy source collection node, represents the credibility coefficient of the th node, represents the network round-trip time to the th node, represents the total number of nodes participating in fusion.

[0043] The sliding time window mechanism manages the life cycle of the entropy pool seed. The sliding time window defines a fixed time length, and the entropy pool seed is valid within this time window. The window slides forward every fixed time interval, and each sliding triggers an update operation of the entropy pool seed. The update operation recalculates the entropy pool seed using new entropy value data. The generation of the new seed also follows the weighted fusion algorithm. A hash chain structure is introduced to guarantee the irreversibility of the entropy pool seed update process. Each time a new entropy pool seed is generated, the hash value of the old seed and the newly collected entropy value data are input into the hash function together. The hash function uses the SHA-3-512 algorithm, and the calculated new hash value is used as a core component of the new entropy pool seed.

[0044] The entropy source collection node and the threat feature space share the same data collection framework, which is logically a unified software-defined data plane. A unified data collection agent is deployed on each subnet gateway, server, and important terminal device in the campus network. The data collection agent has dual functions. On the one hand, it collects device running state parameters as the entropy source collection node, and on the other hand, it runs a traffic probe to capture network packets for threat feature analysis. The collected two types of data are assigned metadata tags of a unified format, which includes the device identifier of the data source, the accurate timestamp, the data type identifier, and the collection cycle sequence number. The data tag association mechanism is implemented in the data aggregation center, which is a message processing platform with high throughput. The association engine binds the entropy source data and network traffic data from the same device and the same time period according to the device identifier and timestamp in the metadata tag. The bound data records are stored in a time series database, forming a data set with spatiotemporal consistency. The data quality evaluation module scores the credibility of each data record stored in the database, and the score is based on the data integrity, whether it is within the expected range, the deviation from historical data, and the health status of the collection process. Low-score data records are marked and assigned a lower influence in subsequent analysis.

[0045] The data fusion center is the core component of collaborative processing, which extracts the associated data from the time series database. The fusion analysis algorithm considers both the abnormal fluctuations of the entropy source data and the threat features in the network traffic. For example, a sudden and unexplained surge in the central processing unit utilization rate may be related to a new type of encryption mining attack. This correlation analysis provides a new detection dimension for the security threat analysis module, linking the changes in the system internal state to external network attack behavior. The deep combination of the entropy source collection node and the threat feature space creates a more three-dimensional security situation awareness capability, which not only focuses on network traffic itself, but also focuses on the health status of the network infrastructure that carries the traffic processing.

[0046] In the embodiment 4, the first task of the protection policy controller when starting the protection policy generation process is to build a multi-dimensional threat feature space that can accurately depict the security situation of the network behavior. The construction of the multi-dimensional threat feature space starts from defining a set of network behavior primitives covering multiple aspects of network communication, including the number of connection attempts initiated by the source IP address in a unit of time, the distribution histogram of the transport layer packet payload size, the combination mode of the application layer protocol type, and the statistical characteristics of the connection duration. These basic features are extracted from the clear data stream restored by the data decryption unit in real time. The feature extraction process uses sliding window technology to process continuous packet streams, and the sliding window defines the time span and step distance of observation. The original extracted network behavior primitive set has a high dimension and a large amount of redundant information, and principal component analysis is applied to reduce the dimension of the primitive set. Principal component analysis calculates the covariance matrix of the primitive data set and its eigenvalues and eigenvectors, and selects the eigenvectors corresponding to the first k largest eigenvalues with a cumulative contribution rate exceeding a predetermined threshold as the principal components. These principal components constitute the key feature vectors of the multi-dimensional threat feature space, and the key feature vectors are linear combinations of the original primitives, which maximize the variance information of the original data and thus capture the most significant behavior patterns. Each network connection or session, after feature extraction and projection, is represented as a point in the multi-dimensional threat feature space, and the position of the point reflects its behavior characteristics.

[0047] Referring to Table 1, the key feature vectors are not fixed, and a feature vector dynamic updating mechanism continuously runs to maintain the timeliness of the threat feature space. The feature vector dynamic updating mechanism monitors the emergence of new attack patterns, and when the security threat analysis module identifies a new attack method that is not effectively depicted by the existing feature space, the related data of the new attack pattern is added to the training data of the primitive set. The online learning algorithm is then triggered, which incrementally recalculates the principal components and adjusts the direction and weight of the key feature vectors, so that the new attack features can become significant in the threat feature space. The feature effectiveness verification process is executed as an independent background process, and the feature effectiveness verification process evaluates the discrimination ability of each key feature vector in historical detection tasks. The discrimination ability is measured by calculating the information gain of the feature in identifying known attacks and normal traffic. Key feature vectors with continuously low information gain are considered as invalid feature dimensions and are marked as to be eliminated. The elimination process is gradual, and the invalid feature dimensions are removed from the active feature vector list after confirming that their contribution is lower than the threshold, and their weights are redistributed to other features.

[0048] Table 1: Threat feature and protection action mapping table The sliding window mechanism is not only used for feature extraction, but also for analyzing the time-evolution pattern of threat features. The time-evolution pattern analysis investigates the trend of feature values within consecutive time windows, such as the sharp rise of connection frequency or the regular change of packet size. These time patterns reveal more complex and multi-stage network attack chains than static features at a single time point, which are utilized by the policy decision tree model for reasoning. The policy decision tree model is a classifier whose internal nodes are feature matching conditions, and leaf nodes are associated with specific sequences of protection instructions. The policy decision tree model traverses the decision nodes of the decision tree based on the coordinates of the feature vector in the multi-dimensional threat feature space and its time pattern, and finally reaches a leaf node. The leaf node predefines a sequence of protection instructions for this type of threat, which includes a series of atomic operation instructions such as modifying access control lists, isolating network nodes, and generating alarm logs. The protection policy controller issues the generated protection instruction sequence to the relevant network execution points, including software-defined network switches, next-generation firewalls, or terminal agents. The policy execution effect evaluation loop is responsible for collecting network feedback data after policy execution, including whether the attack traffic is suppressed, false positives, and changes in system resource occupation. The evaluation loop quantifies this feedback information into a set of effect indicators, which are compared with the decision thresholds in the policy decision tree model. If the effect indicators do not meet expectations, the adaptive adjustment algorithm will fine-tune the threshold parameters of the relevant decision nodes in the policy decision tree model or adjust the weight distribution of the feature vector. This closed-loop feedback mechanism enables the protection policy generation process to have self-optimization capabilities, adapting to the continuous evolution of network environments and attack technologies. The entire protection policy generation process from feature space construction to policy optimization forms a data-driven automated intelligent response system that significantly improves the proactive defense level of the smart campus network against advanced persistent threats.

[0049] Referring to Figure 5 The figure presents the impact of the number of threat feature dimensions on detection performance in the smart campus network security protection system. The gray curve represents the detection time, and the black curve represents the detection coverage. This chart clearly reflects the trade-off between feature dimensions and detection performance: as the number of threat feature dimensions increases, the system's description of network behavior becomes more comprehensive, and the detection coverage improves, enabling the identification of more types of network attacks. However, the complexity of feature calculation increases, leading to longer detection times. In applications, the number of threat feature dimensions can be dynamically adjusted according to the security needs of the campus network, ensuring detection effectiveness while maintaining efficient system operation, demonstrating the technical rationality and practicality of the smart campus network security protection system in threat feature analysis and situation awareness.

[0050] Embodiment 5: The network data collection modules are deployed at the mirror ports of the core switches, regional aggregation nodes and key server access points in the campus network. The software agents of the network data collection modules are loaded onto these nodes. The programmable data collection policy allows the system administrator to define differentiated collection rules according to the importance of the network region. For example, for the data center server region storing student performance and scientific research data, the collection policy is set to the finest granularity. The finest granularity collection means recording the complete content of each data packet including the Ethernet frame header, IP header, transport layer header and application layer payload, as well as recording high-precision timestamps and input / output interface indexes. For the administrative office network region, the collection granularity can be set to medium, mainly collecting flow level statistical information and connection metadata. In the dormitory area, the collection granularity can be set to a coarse level, focusing on abnormal traffic monitoring and sampling analysis.

[0051] The programmable data collection policy is issued and updated by a centralized policy controller, which compiles the policy into a rule set that can be executed by the underlying collection agent. The traffic mirroring technology works in conjunction with the deep packet inspection technology. The traffic mirroring technology is configured on the network switch to copy a copy of the bidirectional traffic of the specified port to the collection agent. After receiving the mirrored traffic, the deep packet inspection engine parses the data packet. The deep packet inspection engine can identify hundreds of application layer protocols and extract structured information from them. For example, for the HTTP protocol, the deep packet inspection engine can parse the request method, URL, host header, user agent and other fields; for the DNS protocol, it can parse the query domain name, record type and response result.

[0052] The data preprocessing pipeline cleans and standardizes the raw collected data. The data preprocessing pipeline includes a denoising module that filters out irrelevant network noise according to predefined rules. Network noise includes periodic keep-alive packets generated by network management protocols, multicast packets, and known benign broadcast traffic. Standardization processing unifies the data formats reported by different collection points into an internal standard format, which includes a fixed field sequence and encoding method. Standardization processing ensures that subsequent analysis modules can process data from different sources without discrimination. The online update mechanism of the collection strategy enables the system to dynamically adapt to changes in network situation. When the security threat analysis module detects new attack activities in a subnet, it can send a policy update request to the policy controller of the network data collection module. The policy update request temporarily increases the collection granularity of the subnet and may enable deep log recording of specific protocols or specific ports to collect more detailed data for attack analysis. The data collaboration mechanism established between the network data collection module and the security threat analysis module is the core of the design of the data hierarchical transmission channel. The data hierarchical transmission channel applies different transmission security measures according to the sensitivity level and potential value of the data itself. For example, network traffic collected from the data center area that contains user privacy information is labeled as "high sensitivity" data. This type of data must be end-to-end encrypted using the highest strength encryption algorithm before being transmitted to the security threat analysis module. Performance monitoring data collected from network devices may be labeled as "low sensitivity" data and only need to be integrity checked for transmission. The data timeliness management strategy sets transmission priorities for different types of data. Data triggered by real-time alert rules defined by the security threat analysis module, such as detecting data packets that match known attack characteristics, are labeled as "urgent" level. Urgent level data packets enjoy the highest priority in the transmission queue and can even interrupt ongoing batch data transmission tasks to minimize the delay from detecting threats to launching analysis.

[0053] The data analysis task scheduler is responsible for coordinating the work pace between the network data collection module and the security threat analysis module. The data analysis task scheduler monitors the processing load and queue depth of the security threat analysis module. When the security threat analysis module is in a high-load state, the data analysis task scheduler can send a flow control signal to the network data collection module, and the network data collection module temporarily reduces the data sending rate or switches to a metadata-only sending mode to prevent the analysis module from being overwhelmed by massive data. Conversely, when the analysis module is idle, the scheduler instructs the collection module to upload more historical data or more detailed traffic records for deep mining and model training. The data quality feedback loop constitutes a closed-loop optimization system. After analyzing the data, the security threat analysis module generates evaluation feedback on the quality of the data. The evaluation feedback may indicate that there are a large number of packet losses in the data of certain collection points, resulting in discontinuous time series, or that the extraction accuracy of certain features is insufficient to support accurate classification and judgment. These feedback information is sent back to the network data collection module, which adjusts the collection parameters accordingly, such as replacing the mirror port, optimizing the analysis rules of the deep packet inspection engine, or adjusting the feature extraction algorithm.

[0054] In a specific operation example, consider a distributed denial of service attack detection scenario. The network data collection module is deployed at a collection point inside the campus network firewall. First, through traffic mirroring, it captures the abnormal growth of traffic to the campus Web server group. The programmable data collection strategy at this time stipulates that when the traffic is detected to exceed the normal baseline by 50%, the collection granularity is automatically increased from flow-level statistics to packet-level sampling. The raw data packets collected are filtered through the preprocessing pipeline to filter out obvious noise, and are marked as "potential attack data" and assigned a high sensitivity level. The data hierarchical transmission channel uses strong encryption algorithms to encapsulate these data, and the data timeliness management strategy sets its priority to the highest, and immediately sends it to the security threat analysis module. After the security threat analysis module receives the data, the data analysis task scheduler temporarily suspends other non-urgent analysis tasks and concentrates resources on distributed denial of service attack feature matching. After the analysis result confirms the attack, the generated high-priority alarm data is also fed back to the protection strategy controller through the high-speed channel. At the same time, the data quality feedback loop may indicate that in order to more accurately distinguish between attack traffic and sudden normal traffic, more detailed TCP flag sequence information needs to be collected. The network data collection module updates its collection strategy online according to this feedback and starts to record the TCP control bits in the deep packet inspection. The whole process demonstrates the intelligent adaptive ability of the network data collection module and the efficient cooperation with the downstream analysis module, ensuring that the security protection system can quickly respond to the evolving network threats.

[0055] It is to be understood that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting; it is not intended to exclude myriad other embodiments of the present application that other inventors can develop based on the same general inventive concepts embodied by the described embodiments. That is, although the present application is described in terms of particular embodiments and illustrative figures, it should be apparent that the scope of the present application is not limited to these specific embodiments.

[0056] While the embodiments of the application have been shown and described herein, it will be understood by those skilled in the art that many changes, modifications, substitutions and alterations to these embodiments can be made without departing from the principles and spirits of the application, and it is intended that the scope of the application be limited solely by the scope of the appended claims and the equivalents thereof.

Claims

1. A smart campus network security protection system, characterized in that, include: The network data acquisition module is used to continuously monitor data transmission traffic in the smart campus network environment and acquire raw data packets; A chaotic encryption engine is used to encrypt the original data packet using a key stream based on dynamic chaotic mapping, wherein the key stream is generated by a mechanism of switching chaotic systems and random parameter allocation. The security protocol processing module is used to convert encrypted data packets into a format that conforms to network security protocol standards and transmit them through the network interface. The data decryption unit is used to decrypt the received encrypted data packets to restore them to plaintext data; The security threat analysis module is used to identify and estimate potential attack behaviors in the network based on decrypted plaintext data; The protection policy controller is used to generate specific network security protection instructions and execute corresponding actions based on threat analysis results.

2. The smart campus network security protection system according to claim 1, characterized in that, The chaotic encryption engine is specifically used to perform the following encryption steps: Real-time fluctuation characteristics of network traffic are collected as the initial input values ​​for the chaotic mapping; The initial input value is injected into a cascaded chaotic mapping sequence with a variable iteration depth to generate a primary chaotic sequence; The iteration parameters of the cascaded chaotic mapping sequence are dynamically adjusted based on the end-to-end delay of the network protocol. A specific segment of the primary chaotic sequence is extracted and nonlinearly fused with a random number pool to generate the final encryption key stream.

3. The smart campus network security protection system according to claim 2, characterized in that, The security protocol processing module and the data decryption unit work together to implement the following security protocol adaptation process: At the data transmission end, parse the network security protocol header information and extract the protocol version identifier; The data encapsulation format is dynamically selected based on the protocol version identifier, and the encrypted data packets are reassembled into protocol data units. Establish a protocol parsing buffer at the data receiving end and peel off the encapsulation header layer by layer according to the protocol specification; Decryption is triggered after verifying data integrity using a protocol feature matching algorithm.

4. The smart campus network security protection system according to claim 2, characterized in that, The random number pool is generated using a distributed entropy source collection method based on network topology. Deploy multiple entropy source collection nodes to continuously monitor the operating status parameters of network devices; The entropy data collected from each node are used to generate an entropy pool seed through a weighted fusion algorithm; A sliding time window mechanism is used to periodically update the entropy pool seed; The hash chain structure ensures the irreversibility of the entropy pool seed update process.

5. A smart campus network security protection system according to claim 2, characterized in that, The switching control of the cascaded chaotic mapping sequence adopts the following adaptive mechanism: Build a network load status assessment model and calculate network traffic complexity indicators in real time; Establish a chaotic mapping selection decision table to map complexity indicators to specific combinations of chaotic systems; Design a feedback regulator to dynamically adjust the switching frequency of the chaotic system based on the encryption delay; Set up an abnormal state detection mechanism and activate the backup chaotic sequence when an abnormal traffic pattern is detected.

6. The smart campus network security protection system according to claim 1, characterized in that, The protection policy controller executes the following protection policy generation process: Construct a multi-dimensional threat feature space and map the decrypted network data into the feature space; A sliding window mechanism is used to extract the temporal evolution pattern of threat features; Design a strategy decision tree model to generate a sequence of protection instructions based on feature matching degree; Establish a strategy execution effectiveness evaluation loop and adjust strategy parameters in real time.

7. A smart campus network security protection system according to claim 6, characterized in that, The construction of the multidimensional threat feature space specifically includes: Define a set of network behavior primitives, including connection frequency, packet size distribution, and protocol type combinations; Principal component analysis is used to reduce the dimensionality of the primitive set and extract key feature vectors; Establish a dynamic feature vector update mechanism to adaptively adjust feature weights based on new attack patterns; Design a feature validity verification process and periodically eliminate invalid feature dimensions.

8. A smart campus network security protection system according to claim 4, characterized in that, The entropy source acquisition node shares the same data acquisition framework with the threat feature space: Deploy a unified data collection agent to collect both network status data and threat signature data. Establish a data tagging and association mechanism to spatiotemporally correlate entropy source data with threat characteristics; Design a data quality assessment module to score the credibility of the collected data; Build a data fusion center to achieve collaborative processing and analysis of multi-source data.

9. A smart campus network security protection system according to claim 1, characterized in that, The network data acquisition module executes the following intelligent data acquisition process: Configure programmable data acquisition strategies to dynamically adjust the acquisition granularity based on the importance of network regions; The original data packets are captured using a combination of traffic mirroring and deep packet inspection techniques. Design a data preprocessing pipeline to perform noise reduction and standardization on the collected data; Implement an online update mechanism for the data collection strategy, and adaptively adjust the data collection parameters based on the network security situation.

10. A smart campus network security protection system according to claim 9, characterized in that, The following data collaboration mechanism is established between the network data acquisition module and the security threat analysis module: Design a hierarchical data transmission channel and adopt different encryption strengths according to the data sensitivity; Establish a data timeliness management strategy and set the highest transmission priority for real-time alarm data; Implement a data analysis task scheduler to coordinate the processing rhythm of the acquisition module and the analysis module; Construct a data quality feedback loop to optimize the data collection strategy by using the analysis results in reverse.

Images