Network security analysis system and method based on artificial intelligence

By calculating the peer clock rate sequence and the temperature-co-oscillation index, and combining key refresh and channel pause, the problem of refined analysis of abnormal sessions in encrypted traffic scenarios is solved, enabling accurate identification and security control of potential network threats.

CN121690653APending Publication Date: 2026-03-17SHANGHAI NAIR IND CO LTD
0 Cites 0 Cited by

Patent Information

Application Number
CN202511674003.8
Authority / Receiving Office
CN · China
Patent Type
Applications(China)
Current Assignee / Owner
Filing Date
2025-11-14
Publication Date
2026-03-17

AI Technical Summary

Technical Problem

Existing technologies struggle to identify abnormal sessions and potential network threats in encrypted traffic scenarios in a timely and accurate manner. In particular, without parsing the packet content, they lack a fine-grained quantitative characterization of the intrinsic relationship between device clock changes and link congestion patterns, resulting in high rates of missed detections or false alarms.

Method used

By calculating the peer clock rate sequence, detrending processing, calculating the temperature-co-current index, and determining the threshold, combined with the security control of key refresh and channel suspension, a refined analysis of encrypted sessions can be achieved.

Benefits of technology

It enables accurate anomaly detection and security control of encrypted traffic without decrypting message content, improving the stability and interpretability of detection results, ensuring data transmission security and avoiding business interruption.

✦ Generated by Eureka AI based on patent content.
Patent Text Reader

Abstract

The invention discloses a network security analysis system and method based on artificial intelligence, and relates to the technical field of network security, and the method comprises the steps: calculating an opposite-end clock rate sequence based on a message arrival interval sequence and a timestamp increment sequence of a target encrypted session; carrying out detrending processing on the sequence to obtain a clock rate micro-drift sequence; determining a warming resonance index based on the micro-drift sequence and the arrival interval sequence; determining whether the session is suspicious by combining the index setting threshold value of the historical normal session; and executing key refreshing, channel pause and evidence packet generation according to a judgment result. According to the method and the device, the abnormal state of the encrypted session can be accurately identified under the condition that the message is not decrypted.
Need to check novelty before this filing date? Find Prior Art