Multi-modal behavior anomaly detection method and system under condition that encrypted traffic is not decrypted

Abstract

The invention relates to the technical field of multi-modal behavior anomaly detection scheme design, in particular to a multi-modal behavior anomaly detection method and system under the condition that encrypted traffic is not decrypted. The method comprises the following steps: capturing a network encrypted traffic data packet in real time; on the premise that decryption is not carried out, multi-mode non-decryption features such as flow layer statistics, time sequence interaction, encryption handshake and context association are extracted in parallel; establishing a dynamic normal behavior baseline model of each feature based on historical data; the real-time features are compared with the baseline model, comprehensive judgment is carried out through a multi-mode correlation analysis algorithm, and an anomaly detection result is output; and when the abnormal condition is judged, the network control equipment is automatically linked for blocking. The method thoroughly gets rid of dependence on traffic decryption, realizes high-precision and self-adaptive detection and rapid automatic response to abnormal behaviors in encrypted traffic through multi-dimensional feature fusion and dynamic baseline technologies, and effectively solves the problem of failure of a traditional detection technology in an encrypted environment.

Description

Technical Field

[0001] This invention relates to the field of multimodal behavior anomaly detection scheme design technology, specifically to a multimodal behavior anomaly detection method and system under the condition of encrypted traffic without decryption. Background Technology

[0002] With the rapid development of internet technology, the demand for data transmission security and privacy protection has become increasingly prominent, and encryption protocols such as Transport Layer Security (TLS) have become standard features in network communication. While encryption technology effectively protects data content, it also poses significant challenges to network security supervision. Traditional network security detection technologies, such as Deep Packet Inspection (DPI), heavily rely on decrypting and pattern matching of packet payloads. However, in scenarios where decryption is impossible or prohibited due to privacy protection, legal and regulatory requirements (such as GDPR), or technical limitations (such as the widespread application of Perfect Forward Secrecy (PFS), these traditional detection methods become largely ineffective, creating a huge security blind spot.

[0003] To address this challenge, encrypted traffic analysis without decryption has become a research hotspot in recent years. Existing solutions primarily focus on analyzing encrypted traffic metadata or external characteristics, such as analyzing network flow quintuple information, flow duration, packet size, and quantity. Some advanced solutions attempt to utilize information from the TLS handshake phase, such as cipher suites, SNI (Server Name Indicator), or certificate information. However, these existing technologies generally suffer from several unresolved bottlenecks: First, most methods rely on relatively singular feature dimensions, focusing either solely on flow statistics or cryptographic features, making it difficult to construct a comprehensive behavioral profile. This results in insufficient detection capabilities for complex and covert attacks (such as Advanced Persistent Threats (APTs)) and a high false negative rate. Second, existing detection models are mostly based on static thresholds or predefined fixed rules, lacking self-learning and adaptive capabilities. They cannot effectively distinguish between normal network evolution and genuine abnormal behavior, easily generating numerous false positives due to normal fluctuations in business traffic, leading to high operational and maintenance costs. Finally, even when anomalies are detected, existing solutions mostly stop at generating alerts, lacking automated response mechanisms linked to network infrastructure. The delay between threat detection and manual intervention is significant, failing to meet the requirement for real-time containment of rapidly spreading network threats. Therefore, there is an urgent need in this field for an innovative solution for detecting encrypted traffic anomalies that can achieve high accuracy, adaptability, and rapid response without any decryption.

[0004] Therefore, existing technologies still need further development. Summary of the Invention

[0005] The purpose of this invention is to overcome the above-mentioned technical deficiencies and provide a method and system for detecting multimodal behavior anomalies under the condition of encrypted traffic without decryption, so as to solve the problems existing in the prior art.

[0006] To achieve the above-mentioned technical objectives, according to a first aspect of the present invention, the present invention provides a method for detecting multimodal behavioral anomalies under the condition of encrypted traffic without decryption, comprising: S1. Real-time capture of encrypted network traffic data packets; S2. Without performing decryption, extract at least three different types of undecrypted features from the data packet in parallel; S3. Establish a baseline model of normal behavior corresponding to the at least three undecrypted features based on historical data; S4. Compare the at least three undecrypted features extracted in real time with the normal behavior baseline model, make a comprehensive judgment through a multimodal correlation analysis algorithm, and output the anomaly detection result.

[0007] Specifically, after step S2 and before steps S3 and S4, step S2a is also included: The extracted undecrypted feature data are standardized to eliminate the influence of differences in feature units and numerical ranges.

[0008] Specifically, the at least three different types of non-decryption features include: flow layer statistical features, temporal interaction features, and cryptographic handshake features.

[0009] Specifically, the stream layer statistical features include multiple parameters such as stream duration, total number of data packets, total number of bytes, and uplink / downlink data packet ratio; the temporal interaction features include the interval distribution entropy of data packet arrival time and the periodicity strength index of communication behavior; the cryptographic handshake features include the client greeting message fingerprint in the TLS handshake protocol, and the server certificate chain length and sequence features.

[0010] Specifically, the at least three different types of non-decryption features also include context-related features, which include the geographical location reputation value of the communication peer's IP and the status of the certificate authority in the trusted list.

[0011] Specifically, the establishment of a normal behavior baseline model in step S3 is as follows: For various features extracted from historical time periods, time series-based clustering algorithms or probability distribution estimation algorithms are used for modeling to obtain dynamic baselines that characterize the range of normal behavior.

[0012] Specifically, the dynamic baseline model can be incrementally updated according to a preset learning cycle to adapt to the normal evolution of network behavior.

[0013] Specifically, the multimodal correlation analysis algorithm in step S4 includes: S41. For each type of feature, calculate the deviation between its real-time feature value and the corresponding normal behavior baseline model; S42. Assign a weight to the deviation of each type of feature, and the weight is dynamically adjusted according to the ability of the feature type to represent abnormal behavior. S43. The weighted deviations of all features are fused to obtain a comprehensive anomaly score; S44. Compare the comprehensive anomaly score with the adaptive threshold. If the score exceeds the threshold, the score is determined to be an anomaly.

[0014] Specifically, after step S4, the following is also included: S5. When an anomaly is detected, a control command containing the five-tuple information of the abnormal flow and the anomaly type is automatically generated, and the control command is sent to the software-defined network (SDN) controller or next-generation firewall to block or isolate the abnormal traffic in real time.

[0015] According to a second aspect of the present invention, a multimodal behavior anomaly detection system is provided under the condition of encrypted traffic without decryption, comprising: The feature extraction module is used to capture encrypted network traffic data packets in real time and extract at least three different types of undecrypted features in parallel without decryption. The baseline modeling module is used to establish a normal behavior baseline model corresponding to the at least three undecrypted features based on historical data. The analysis and judgment module is used to compare the features extracted in real time with the normal behavior baseline model, make a comprehensive judgment through a multimodal association analysis algorithm, and output the anomaly detection result. The control response module is used to automatically generate control commands and send them to the network control device when an anomaly is detected.

[0016] Beneficial effects: The multimodal behavior anomaly detection method and system for encrypted traffic without decryption provided by this invention have the following significant advantages compared to existing technologies: (1) High detection accuracy and low false alarm / false alarm rate: The core innovation of this invention lies in its adoption of a multimodal feature fusion analysis strategy. By extracting flow layer statistical features, temporal interaction features, cryptographic handshake features, and contextual features in parallel, a three-dimensional, high-resolution network behavior profile can be constructed from multiple orthogonal dimensions such as traffic scale, interaction rhythm, cryptographic identity, and external reputation. This comprehensive perspective makes it extremely difficult for attackers to perfectly disguise themselves across all behavioral dimensions, thus effectively identifying complex, low-frequency, and disguised attacks that traditional single-feature detection methods cannot detect, significantly reducing the false negative rate. Simultaneously, by establishing a dynamically evolving baseline model of normal behavior and employing an intelligent judgment algorithm based on weighted fusion and adaptive thresholds, the system can accurately distinguish between normal fluctuations in network services and real security threats, greatly reducing false positives caused by static rule mismatches.

[0017] (2) Possesses self-learning and self-adaptive capabilities, resulting in low operation and maintenance costs: This invention introduces a dynamic baseline modeling and incremental update mechanism based on historical data, enabling the system to automatically learn and adapt to normal changes in the network environment (such as the launch of new services and differences in work and holiday patterns). This means that the system can maintain high detection accuracy over a long period without security administrators frequently adjusting detection thresholds and rules, achieving "one-time deployment, long-term effectiveness" and significantly reducing the manpower and technical barriers to security operations and maintenance.

[0018] (3) A safe closed loop is achieved, and the response speed is fast: This invention seamlessly integrates detection and response. Once an anomaly is detected, the system automatically generates precise control commands and sends them to network control units such as SDN controllers or next-generation firewalls, blocking or isolating malicious traffic within seconds. This "detect-as-respond" capability minimizes the threat's dwell time and impact, changing the passive situation of traditional security devices that only issue alerts without taking action, and achieving proactive, real-time, and in-depth defense.

[0019] (4) Fully compliant with regulations and with good privacy protection: Since the entire detection process does not require any decryption of the application layer data of the encrypted traffic, it completely avoids the legal and compliance risks of touching user privacy data, making it particularly suitable for operating environments with strict requirements for data privacy. Attached Figure Description

[0020] Figure 1 This is a flowchart illustrating the multimodal behavior anomaly detection method under the condition of encrypted traffic not being decrypted, provided in a specific embodiment of the present invention. Figure 2 This is a schematic diagram of the system composition of a multimodal behavior anomaly detection system under the condition of encrypted traffic without decryption, provided in a specific embodiment of the present invention. Detailed Implementation

[0021] To enable those skilled in the art to better understand the technical solutions of the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Based on the embodiments in this application, other similar embodiments obtained by those skilled in the art without creative effort should all fall within the scope of protection of this application. Furthermore, directional terms mentioned in the following embodiments, such as "up," "down," "left," and "right," are only for reference to the directions in the accompanying drawings; therefore, the directional terms used are for illustrative purposes and not for limiting the invention.

[0022] The present invention will be further described below with reference to the accompanying drawings and preferred embodiments.

[0023] Please see Figure 1 This invention provides a method for detecting multimodal behavioral anomalies in encrypted traffic without decryption, comprising: S1. Real-time capture of encrypted network traffic data packets.

[0024] It should be further explained that in step S1, real-time capture is achieved by setting the network card of the deployment server to promiscuous mode and utilizing a mature packet capture library (such as the libpcap library under Linux, or the high-performance DPDK framework). Specifically, port mirroring is configured on the network core switch to mirror the traffic to be monitored to the network interface of this invention. To avoid packet loss, it is recommended to use a 10 Gigabit or higher network card and set a ring buffer of 1024MB.

[0025] S2. Without performing decryption, extract at least three different types of undecrypted features from the data packet in parallel.

[0026] It should be further explained that the parallel extraction in step S2 refers to starting multiple independent feature extraction threads or processes to process the same batch of data packets simultaneously. For example, thread 1 is dedicated to calculating stream statistical features, thread 2 is dedicated to analyzing temporal features, and thread 3 is dedicated to parsing TLS handshake layer features. These threads obtain data packets from step S1 through shared memory or lock-free queues, thereby achieving efficient parallelism.

[0027] S3. Establish a baseline model of normal behavior corresponding to the at least three undecrypted features based on historical data.

[0028] It should be further noted that step S3, establishing the baseline model for normal behavior, requires a learning phase, preferably 7 calendar days. During these 7 days, the system continuously extracts features but does not perform anomaly detection; instead, it stores all feature data in a time-series database (such as Influx DB) or a large distributed file system. After 7 days, the system uses the complete data from these 7 days as the training set to train the initial baseline model offline or online.

[0029] S4. Compare the at least three undecrypted features extracted in real time with the normal behavior baseline model, make a comprehensive judgment through a multimodal correlation analysis algorithm, and output the anomaly detection result.

[0030] It should be further explained that the multimodal correlation analysis in step S4 is the core of the real-time detection phase. The beneficial effect of this four-step framework lies in its complete logical chain, progressing step by step from data acquisition, feature engineering, model learning to intelligent decision-making, laying a solid foundation for the specific implementation of each subsequent step, and ensuring the overall feasibility and integrity of the method.

[0031] Specifically, after step S2 and before steps S3 and S4, step S2a is also included: The extracted undecrypted feature data are standardized to eliminate the influence of differences in feature units and numerical ranges.

[0032] It should be further explained that the standardization process in step S2a is crucial to ensuring the fairness of subsequent analysis. The specific implementation steps are as follows: First, standardize each numerical feature (such as stream duration, total bytes, etc.). The mean (μ) and standard deviation (σ) upon which standardization relies must come from the 7-day historical training data described in step S3. The specific calculation method is: for each feature in the training set, calculate the arithmetic mean of all its sample values ​​as μ, and calculate the standard deviation of these sample values ​​as σ. During real-time detection, for each newly arrived feature value x, perform Z-score standardization using the following formula: In this formula, z is the standardized new value, a dimensionless numerical value; x is the original feature value extracted in real time; μ is the average value of the feature over a 7-day training period; and σ is the standard deviation of the feature over a 7-day training period. For example, assuming the mean duration of historical streams is μ = 60 seconds and the standard deviation is σ = 30 seconds, and a new stream lasts for 150 seconds, then the standardized z = (150-60) / 30 = 3. This means that the duration of the stream deviates from the historical normal mean by 3 standard deviations. For categorical features (such as whether CA is trustworthy), one-hot encoding is used or predefined scores are directly assigned (e.g., 0 for trustworthy CA and 1 for untrustworthy CA). The beneficial effect of this step is the unification of dimensions, allowing features of different scales, such as duration (seconds), data volume (bytes), and entropy (dimensionless), to be placed in the same mathematical model for fair comparison and weighted calculation, fundamentally avoiding the problem of large data domain features overshadowing small data domain features.

[0033] Specifically, the at least three different types of non-decryption features include: flow layer statistical features, temporal interaction features, and cryptographic handshake features.

[0034] Further explanation is needed regarding the specific implementation: Flow statistics are extracted when a network flow (defined by the 5-tuple) ends or its lifetime exceeds a certain threshold (e.g., 30 minutes). Temporal interaction features are extracted by analyzing the arrival time sequence of packets during the flow's lifetime. Cryptographic handshake features are extracted only during the TLS handshake phase immediately following the TCP connection establishment three-way handshake. These three features are processed in parallel by different parsers: the flow statistics parser focuses on IP and TCP / UDP header information; the temporal parser focuses on packet timestamps; and the TLS parser deeply parses the fields of the TLS handshake protocol (but still does not decrypt application data). The beneficial effect of this multimodal design is that it provides orthogonal observation perspectives: flow statistics look at "quantity," temporal features look at "rhythm," and cryptographic handshake looks at "identity," making it extremely difficult for attackers to simultaneously impersonate normal behavior across all dimensions, thus significantly improving the robustness and accuracy of detection.

[0035] Specifically, the stream layer statistical features include multiple parameters such as stream duration, total number of data packets, total number of bytes, and uplink / downlink data packet ratio; the temporal interaction features include the interval distribution entropy of data packet arrival time and the periodicity strength index of communication behavior; the cryptographic handshake features include the client greeting message fingerprint in the TLS handshake protocol, and the server certificate chain length and sequence features.

[0036] It should be further explained that the solution specifically includes: Stream layer statistical characteristics: Stream duration = Stream end timestamp - Stream start timestamp (unit: seconds). Total number of packets and total number of bytes are obtained by summing the IP packet lengths of all packets in the stream. Uplink / downlink packet ratio = Number of uplink packets (usually with the destination port being the server port) ÷ Number of downlink packets.

[0037] Temporal interaction features - interval distribution entropy: The specific calculation steps are as follows: 1) Record the arrival time interval (IAT) between the first N consecutive data packets of the stream. N is preferably 100. If the number of stream packets is less than 100, calculate according to the actual number.

[0038] 2) Divide the IAT values ​​into 10 equally wide bins.

[0039] 3) Calculate the frequency p_i of the IAT value in each interval (i.e., the number of IAT values ​​in that interval divided by the total number of IAT values).

[0040] 4) Calculate Shannon entropy: A higher entropy value indicates a more random interaction, while a lower entropy value indicates a more regular interaction.

[0041] Temporal Interaction Characteristics - Periodicity Strength Index: Specifically, the power of the dominant frequency is extracted using Fast Fourier Transform (FFT). Steps: 1) Take a time sequence of continuous heartbeats or request data packets within a certain period (e.g., 5 minutes). 2) Perform an FFT on the sequence. 3) Find the maximum power value P_max in the power spectrum. 4) Periodicity strength index = P_max / total power. The closer this value is to 1, the stronger the periodicity.

[0042] Cryptographic Handshake Characteristics - Client Greeting Message Fingerprint (JA3): Specific generation method: Concatenate the decimal values ​​of the following fields from the TLS handshake: SSL version, list of acceptable cipher suites, list of extensions, supported elliptic curves, and supported elliptic curve formats. Then calculate the MD5 hash value of the concatenated string to obtain a 32-bit hexadecimal string as the fingerprint. Server certificate chain length = the number of certificates included in the certificate list sent by the server in the Certificate message. Server certificate chain sequence characteristics refer to checking whether the order of the certificate chain is: terminal entity certificate -> intermediate CA certificate -> (optional) root CA certificate. An anomaly occurs if the order is reversed or missing. The beneficial effect of this detailed definition is that it provides a precise blueprint for programming implementation. Engineers can strictly follow this description to write feature extraction code, ensuring the feasibility of the solution.

[0043] Specifically, the at least three different types of non-decryption features also include context-related features, which include the geographical location reputation value of the communication peer's IP and the status of the certificate authority in the trusted list.

[0044] Further explanation is needed regarding the specific implementation: The geographic reputation value of the communicating peer's IP is obtained by querying the API interface of a commercial or open-source threat intelligence platform (such as Virus Total, Alien Vault OTX). Specifically, whenever a new destination IP is encountered, the system sends a query request to its RESTful API, including the IP address in the request. The returned JSON data typically contains a comprehensive threat score (e.g., 0-100, with higher scores indicating greater danger). This score is normalized to between 0 and 1 as the numerical value for this feature. To improve performance, an IP reputation cache with an expiration time (e.g., 24 hours) can be maintained locally. The status of Certificate Authorities (CAs) in the trusted list is implemented by maintaining a dynamically updated trusted CA list file within the system (e.g., periodically downloaded from the Mozilla official repository). When a server certificate is parsed, its issuer field is extracted, and the existence of the issuer in the trusted CA list is checked. If it exists, the status value is 0 (trusted); otherwise, the status value is 1 (untrusted). The benefit of this step is that it introduces external knowledge and a global perspective, enabling the detection system to go beyond the microscopic behavior of the traffic itself and identify communications associated with known malicious entities. This is crucial for detecting targeted attacks and advanced persistent threats (APTs).

[0045] Specifically, the establishment of a normal behavior baseline model in step S3 is as follows: For various features extracted from historical time periods, time series-based clustering algorithms or probability distribution estimation algorithms are used for modeling to obtain dynamic baselines that characterize the range of normal behavior.

[0046] Furthermore, for continuous numerical features such as flow duration and total bytes, Gaussian Mixture Model (GMM) is preferred for probability distribution estimation. The specific steps are: 1) Collect all samples of this feature from 7 days of historical data. 2) Fit a GMM model using the Expectation-Maximization (EM) algorithm. The number of Gaussian components K is determined by the Bayesian Information Criterion (BIC), typically between 1 and 3. 3) After training, the baseline model is the parameter of the GMM (weights, mean, and variance of each component). The normal range of a feature is the high probability density region described by the GMM. For features such as the interval distribution entropy of packet arrival times, whose distribution may not be Gaussian, kernel density estimation (KDE) is used for nonparametric modeling. For traffic pattern features aggregated by hour, K-Means clustering is used for modeling: 1) Divide the historical data into hourly windows, extracting a feature vector for each window. 2) Use the K-Means algorithm to cluster these vectors into multiple clusters (e.g., 5). 3) The cluster containing the most data points is considered the "normal behavior cluster," and its centroid represents the normal baseline pattern for that hourly period. The baseline model is incrementally updated every 24 hours, meaning the GMM / KDE / K-Means model is retrained using the latest 7 days of data. The beneficial effect of this detailed modeling method is that it selects the most suitable statistical learning model for different types of features, enabling a more accurate description of the complex forms of "normal," and providing a scientific basis for subsequent anomaly detection.

[0047] Specifically, the dynamic baseline model can be incrementally updated according to a preset learning cycle to adapt to the normal evolution of network behavior.

[0048] The specific implementation mechanism for incremental updates is as follows: The system maintains a sliding time window database that lasts for 7 days. Every day at 2:00 AM (off-peak business hours), the system automatically executes a baseline update task. The specific steps of this task are: 1) Delete historical feature data older than 8 days from the database. 2) Add the newly generated feature data from yesterday (day 7) to the training set. 3) Call the training algorithm corresponding to the feature type (such as the EM algorithm of GMM, K-Means algorithm), and retrain the baseline model using the latest 7-day complete dataset. 4) Atomically replace the old model currently in memory with the newly trained model, ensuring uninterrupted detection service. The reason for setting the learning cycle to 24 hours (updated daily) is to both promptly capture changes in network business (such as traffic changes brought about by the launch of new applications) and avoid the computational overhead and model instability caused by overly frequent updates. The beneficial effect of this design is that it enables the system to have "lifelong learning" capabilities, automatically adapting to normal changes in the network environment, thereby maintaining a low false alarm rate over a long period and significantly reducing operation and maintenance costs.

[0049] Specifically, the multimodal correlation analysis algorithm in step S4 includes: S41. For each type of feature, calculate the deviation between its real-time feature value and the corresponding normal behavior baseline model; S42. Assign a weight to the deviation of each type of feature, and the weight is dynamically adjusted according to the ability of the feature type to represent abnormal behavior. S43. The weighted deviations of all features are fused to obtain a comprehensive anomaly score; S44. Compare the comprehensive anomaly score with the adaptive threshold. If the score exceeds the threshold, the score is determined to be an anomaly.

[0050] It should be further explained that this algorithm is the brain of this invention, and its implementation details are as follows: S41. Calculate the deviation: For numerical features modeled based on GMM, the deviation is defined as the negative log-likelihood (NLL) of the feature value under GMM. .in, It is the number of Gaussian components. These are the weight, mean, and variance of the k-th component, respectively. It is a Gaussian probability density function. The larger the NLL value, the lower the probability that the feature value appears within the normal range, i.e., the greater the deviation. For binary features like "CA state", the deviation is directly 0 (confidential) or 1 (unreliable).

[0051] S42. Dynamic Weight Allocation: The weight adjustment strategy is very specific. The system records the deviation of each feature in each alarm over the past week, and whether the alarm was ultimately confirmed by the administrator as a true anomaly (true positive). Then, the weight of each feature is calculated weekly. Here, AUC_i is the area under the ROC curve when the deviation of this feature is used alone as a detector over the past week. F1_i is the proportion of high deviation contributed by this feature among all alarms involved in by this feature and among confirmed true anomalies. This formula balances the discriminative power (AUC) and reliability (F1) of the feature. Finally, the weights of all features are normalized so that their sum is 1.

[0052] S43, Weighted Fusion: Comprehensive Abnormal Score N is the total number of features.

[0053] S44. Adaptive Threshold Comparison: The adaptive threshold T is set to the 99.7th quantile of the historical composite anomaly score distribution. This quantile is recalculated every 24 hours. The 99.7th quantile is chosen because it approximates the μ+3σ position of the normal distribution, is a commonly used outlier boundary in statistics, and can capture the vast majority of anomalies within an acceptable false alarm rate. Judgment Rule: If... If the result is not found, it is considered abnormal. The beneficial effect of this sophisticated algorithm design is that it enables intelligent and adaptive multi-source information fusion decision-making, rather than simple rule stacking, making the detection results more scientific, accurate and reliable.

[0054] Specifically, after step S4, the following is also included: S5. When an anomaly is detected, a control command containing the five-tuple information of the abnormal flow and the anomaly type is automatically generated, and the control command is sent to the software-defined network (SDN) controller or next-generation firewall to block or isolate the abnormal traffic in real time.

[0055] It should be further explained that the automated response in step S5 is implemented as follows: Upon an anomaly detection, the system immediately constructs a JSON-formatted control command. This JSON object contains the following required fields: action: "block", src_ip, dst_ip, src_port, dst_port, protocol (e.g., TCP / UDP), and alert_type (e.g., "C2_Communication"). Subsequently, the system sends a POST request via HTTPS (port 443) to a pre-configured SDN controller (e.g., ONOS's REST API address https: / / [controller_ip]:8181 / onos / v1 / flows) or a next-generation firewall (e.g., Palo Alto Networks' API address https: / / [fw_ip] / api / ). The request body is the aforementioned JSON command. After receiving the command, the SDN controller or firewall converts it into its own policy (e.g., OpenFlow flow table entries or security policy rules) and immediately issues it, typically taking effect within seconds, achieving precise blocking of abnormal flows. The beneficial effect of this step is that it forms a complete "perception-decision-response" security closed loop, reducing the time from threat detection to handling from hours in traditional manual response to seconds, thus achieving true proactive defense.

[0056] Please see Figure 2 The present invention provides another embodiment, which provides a multimodal behavior anomaly detection system under the condition of encrypted traffic without decryption. The multimodal behavior anomaly detection system under the condition of encrypted traffic without decryption includes: The feature extraction module 100 is used to capture encrypted network traffic data packets in real time and extract at least three different types of undecrypted features in parallel without decryption. Baseline modeling module 200 is used to establish a normal behavior baseline model corresponding to the at least three undecrypted features based on historical data; The analysis and judgment module 300 is used to compare the features extracted in real time with the normal behavior baseline model, make a comprehensive judgment through a multimodal association analysis algorithm, and output the anomaly detection result. The control response module 400 is used to automatically generate control commands and send them to the network control device when an anomaly is detected.

[0057] Further explanation is needed regarding the specific physical implementation of this system: The system is deployed on one or more standard x86 servers. The feature extraction module 100 is a high-performance program written in C++ that directly calls the DPDK user-space driver to poll network interface card (NIC) packets and distributes the packets to subsequent feature calculation threads via a lock-free queue. The baseline modeling module 200 is a background service written in Python that relies on the Scikit-learn machine learning library. It periodically reads historical data from a MySQL database, performs training tasks such as GMM and K-Means, and serializes the trained model before saving it to a Redis cache. The analysis and judgment module 300 is a resident memory service written in Java or Go. It loads the model from Redis, receives real-time feature vectors from the feature extraction module, executes the complex algorithm detailed in claim 8, and writes the judgment result to a message queue (such as Kafka). The control and response module 400 is another microservice that consumes Kafka messages. Written in Python, it is responsible for constructing and sending HTTPS API requests to network devices. The modules communicate asynchronously through Kafka and Redis, decoupling dependencies and ensuring high availability and scalability of the system. The beneficial effect of this system-level description is that it clarifies the physical form and software architecture of the invention, enabling those skilled in the art to build a complete, efficient, and commercially viable product prototype based on mature programming languages, libraries, and middleware.

[0058] In a preferred embodiment, this application also provides an electronic device, the electronic device comprising: The computer device includes a memory and a processor, wherein the memory stores computer-readable instructions that, when executed by the processor, implement the multimodal behavior anomaly detection method under the condition of encrypted traffic without decryption. The computer device can be broadly categorized as a server, terminal, or any other electronic device with the necessary computing and / or processing capabilities. In one embodiment, the computer device may include a processor, memory, network interface, communication interface, etc., connected via a system bus. The processor of the computer device can be used to provide the necessary computing, processing, and / or control capabilities. The memory of the computer device may include a non-volatile storage medium and internal memory. The non-volatile storage medium may store an operating system, computer programs, etc. The internal memory can provide an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The network interface and communication interface of the computer device can be used to connect and communicate with external devices via a network. When the computer program is executed by the processor, it performs the steps of the method of the present invention.

[0059] This invention can be implemented as a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, causes the steps of the methods of embodiments of the invention to be performed. In one embodiment, the computer program is distributed across multiple network-coupled computer devices or processors, such that the computer program is stored, accessed, and executed in a distributed manner by one or more computer devices or processors. A single method step / operation, or two or more method steps / operations, may be executed by a single computer device or processor or by two or more computer devices or processors. One or more method steps / operations may be executed by one or more computer devices or processors, and one or more other method steps / operations may be executed by one or more other computer devices or processors. One or more computer devices or processors may execute a single method step / operation, or execute two or more method steps / operations.

[0060] Those skilled in the art will understand that the method steps of this invention can be performed by a computer program instructing related hardware, such as a computer device or processor, which may be stored in a non-transitory computer-readable storage medium. When the computer program is executed, the steps of this invention are performed. Depending on the context, any references herein to memory, storage, databases, or other media may include non-volatile and / or volatile memory. Examples of non-volatile memory include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), flash memory, magnetic tape, floppy disk, magneto-optical data storage device, optical data storage device, hard disk, solid-state drive, etc. Examples of volatile memory include random access memory (RAM), external cache memory, etc.

[0061] The technical features described above can be combined arbitrarily. Although not all possible combinations of these technical features are described, any combination of these technical features should be considered to be covered by this specification, provided that such combination does not contain contradictions.

[0062] The specific embodiments of the present invention described above do not constitute a limitation on the scope of protection of the present invention. Any other corresponding changes and modifications made in accordance with the technical concept of the present invention should be included within the scope of protection of the claims of the present invention.

Claims

1. A method for multi-modal behavior anomaly detection under encrypted traffic without decryption, characterized in that, The method comprises the following steps: S1, capturing network encrypted traffic data packets in real time; S2, extracting at least three different types of non-decryption features from the data packets in parallel without decryption operation; S3, establishing a normal behavior baseline model corresponding to the at least three non-decryption features based on historical data; S4, comparing the at least three non-decryption features extracted in real time with the normal behavior baseline model, comprehensively determining by a multi-modal correlation analysis algorithm, and outputting an abnormality detection result.

2. The method of claim 1, wherein, After the step S2 and before the steps S3 and S4, the method further comprises a step S2a: standardizing the extracted non-decryption feature data of each type to eliminate the influence of different feature dimensions and numerical range differences.

3. The method according to claim 1 or 2, characterized in that, The at least three different types of non-decryption features include flow layer statistical features, time sequence interaction features, and cryptography handshake features.

4. The method of claim 3, wherein, The flow layer statistical features include multiple types of flow duration, total packet number, total byte number, and uplink / downlink packet ratio; The time sequence interaction features include interval distribution entropy of data packet arrival time and periodicity strength index of communication behavior; and the cryptography handshake features include client greeting message fingerprint in TLS handshake protocol, server certificate chain length and sequence features.

5. The method of claim 4, wherein, The at least three different types of non-decryption features further include context correlation features, and the context correlation features include geographical location reputation value of a communication opposite IP and state of a certificate authority in a trusted list.

6. The method of claim 5, wherein, In the step S3, the normal behavior baseline model is established by: respectively modeling the extracted features of each type in a historical time period by using a time sequence-based clustering algorithm or a probability distribution estimation algorithm to obtain a dynamic baseline representing a normal behavior range.

7. The method of claim 6, wherein, The dynamic baseline model can be incrementally updated according to a preset learning period to adapt to the normal evolution of network behavior.

8. The method of claim 5, wherein, The multi-modal correlation analysis algorithm in the step S4 specifically comprises: S41, calculating a deviation degree of each type of feature from a corresponding normal behavior baseline model; S42, assigning a weight to the deviation degree of each type of feature, and dynamically adjusting the weight according to the feature type and the representation ability of abnormal behavior; S43, fusing the weighted deviation degrees of all features to obtain a comprehensive abnormal score; S44, comparing the comprehensive abnormal score with an adaptive threshold value, and determining as abnormal if the comprehensive abnormal score exceeds the adaptive threshold value.

9. The method of claim 8, wherein, After the step S4, the method further comprises: S5, when determining as abnormal, automatically generating a control instruction containing abnormal flow five-tuple information and abnormal type, and delivering the control instruction to a software defined network (SDN) controller or a next-generation firewall to block or isolate the abnormal traffic in real time.

10. A multi-modal behavior anomaly detection system under encrypted traffic without decryption condition, for implementing the method of any one of claims 1-9, characterized in that, The method comprises: a feature extraction module, configured to capture network encrypted traffic data packets in real time and extract at least three different types of non-decryption features in parallel without decryption; a baseline modeling module, configured to establish a normal behavior baseline model corresponding to the at least three non-decryption features based on historical data; and a baseline modeling module, configured to establish a normal behavior baseline model corresponding to the at least three non-decryption features based on historical data; and An analysis and determination module is configured to compare the real-time extracted features with the normal behavior baseline model, comprehensively determine through a multi-modal correlation analysis algorithm, and output an abnormality detection result. A control response module is configured to automatically generate a control instruction and issue it to a network control device when it is determined to be abnormal.

Images