Network security analysis system and method based on artificial intelligence

Abstract

The invention discloses a network security analysis system and method based on artificial intelligence, and relates to the technical field of network security, and the method comprises the steps: calculating an opposite-end clock rate sequence based on a message arrival interval sequence and a timestamp increment sequence of a target encrypted session; carrying out detrending processing on the sequence to obtain a clock rate micro-drift sequence; determining a warming resonance index based on the micro-drift sequence and the arrival interval sequence; determining whether the session is suspicious by combining the index setting threshold value of the historical normal session; and executing key refreshing, channel pause and evidence packet generation according to a judgment result. According to the method and the device, the abnormal state of the encrypted session can be accurately identified under the condition that the message is not decrypted.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a network security analysis system and method based on artificial intelligence. Background Technology

[0002] In network communication environments, encrypted sessions are widely used in scenarios such as cloud service access, enterprise intranet interconnection, remote office work, and IoT access. Encryption mechanisms at the transport and tunnel layers ensure that most business traffic exists in end-to-end encrypted form, meaning third-party nodes and security devices can typically only obtain limited information such as packet arrival time, length, and direction. Under actual operating conditions, network links experience slight clock rate drift due to changes in ambient temperature and load on terminals and servers. Simultaneously, congestion control mechanisms at the link layer cause periodic changes in packet queuing rhythm. When the communication link is stable, the relationship between these two fluctuations is relatively smooth; however, when malicious traffic injection, spoofed session establishment, or targeted delay interference occurs, the coordination between the device's clock drift and the link queuing rhythm changes significantly.

[0003] In existing technologies, the analysis of encrypted traffic often employs simple threshold monitoring, statistical deviation detection, or behavior recognition based on trained models. These methods typically only statistically analyze superficial quantities such as packet rate, session duration, and packet length distribution, lacking a fine-grained quantitative characterization of the intrinsic relationship between device clock variations and link congestion patterns. When abnormal time structures occur in the network due to clock drift, environmental changes, or malicious traffic manipulation, these methods often cannot distinguish between normal fluctuations and changes caused by abnormal behavior. This may lead to missed detections of hidden threats or a high false alarm rate due to a lack of clear criteria, failing to meet the needs for fine-grained analysis and reliable control of encrypted sessions in high-security scenarios. Summary of the Invention

[0004] The purpose of this invention is to address the shortcomings of existing technologies in which it is difficult to identify abnormal sessions and potential network threats in a timely and accurate manner using limited time-series information without parsing message content in encrypted traffic scenarios. Therefore, this invention proposes an artificial intelligence-based network security analysis system and method.

[0005] To address the problems existing in the prior art, the present invention adopts the following technical solution: An artificial intelligence-based cybersecurity analysis method includes: S1. Calculate the peer clock rate sequence based on the message arrival interval sequence and timestamp increment sequence of the target encrypted session; S2. Perform detrending processing on the peer clock rate sequence to obtain the peer clock rate micro-drift sequence; S3. Calculate the temperature-suppression co-oscillation index based on the peer clock rate drift sequence and the message arrival interval sequence. S4. Set a judgment threshold based on the temperature-co-resonance index of historical normal sessions, and judge the target encrypted session according to the judgment threshold to obtain the judgment result. S5. Based on the judgment result, refresh the key and suspend the channel for the target encrypted session, and generate an evidence package.

[0006] Preferably, calculating the peer clock rate sequence based on the message arrival interval sequence and timestamp increment sequence of the target encrypted session includes: Extract the arrival time and Transmission Control Protocol (TCP) timestamp of each message in the target encrypted session to form a message arrival time sequence and a TCP timestamp sequence; The message arrival interval sequence is obtained by the difference in arrival times of adjacent messages in the message arrival time sequence. The timestamp increment sequence is obtained by the difference between the Transmission Control Protocol (TCP) timestamps of adjacent messages in the TCP timestamp sequence. The timestamp increment sequence and the message arrival interval sequence are compared according to their corresponding numbers to form the peer clock rate sequence.

[0007] Preferably, the remote clock rate sequence is detrended to obtain a remote clock rate micro-drift sequence, including: Calculate the sample mean of the remote clock rate sequence, and then calculate the autocorrelation function of the remote clock rate sequence based on the sample mean. The autocorrelation function is: In the formula, It is the autocorrelation function. The number of sample points corresponding to the lag parameter. This represents the total number of samples in the clock rate sequence at the other end. For the first Each peer clock rate value This is the sample mean of the clock rate sequence at the other end; The first zero-crossing lag parameter of the autocorrelation function is determined as the detrending length; By detrending the peer clock rate sequence using a moving average of length equal to the detrending length, a peer clock rate micro-drift sequence is obtained.

[0008] Preferably, the temperature congestion co-resonance index is calculated based on the remote clock rate drift sequence and the message arrival interval sequence, including: Perform periodic graph processing on the message arrival interval sequence, and determine the positive frequency with the highest energy in the periodic graph as the congestion frequency; Centered on the congestion frequency, narrowband bandpass processing is performed on the message arrival interval sequence and the peer clock rate drift sequence to obtain two sets of bandpass signal sequences. Calculate the normalized cross-correlation of the two bandpass signal sequences at different sample level lags, and take the largest normalized cross-correlation as the Wen-Hung co-resonance index.

[0009] Preferably, a judgment threshold is set based on the warm-convergence co-resonance index of historical normal sessions, and the target encrypted session is judged according to the judgment threshold, including: The temperature-congestion co-resonance indexes corresponding to the historical normal sessions of the target host during the same period are used to form a set of historical normal baselines. Statistical analysis was performed on the temperature-emergence co-oscillation index in the historical normal baseline set to form an empirical distribution of the temperature-emergence co-oscillation index; The upper quantile of the empirical distribution is determined based on the total sample size of the historical normal baseline set, and the upper quantile is used as the judgment threshold. The current temperature-convergence co-resonance index of the target encrypted session is compared with the judgment threshold. If the current temperature-convergence co-resonance index is greater than the judgment threshold, the session is judged to be suspicious; otherwise, the session is judged to be normal.

[0010] Preferably, based on the determination result, the target encrypted session is key refreshed and the channel is paused, including: If the session is deemed suspicious, the key for the target encrypted session is refreshed and the channel for application data is suspended; otherwise, the current communication state of the target encrypted session is maintained.

[0011] Preferably, generating an evidence package includes: Record the time and execution status of key refresh and channel pause to form a session action record; The values ​​of congestion frequency, temperature-congestion co-occurrence index, judgment threshold, judgment result, and session action record are fixed. The solidified data is encapsulated into an evidence package and the evidence package is persistently stored.

[0012] To address the above problems, the present invention also provides an artificial intelligence-based network security analysis system, the system comprising: The clock rate module is used to calculate the peer clock rate sequence based on the message arrival interval sequence and timestamp increment sequence of the target encrypted session; The clock drift module is used to perform detrending processing on the peer clock rate sequence to obtain the peer clock rate drift sequence. The co-occurrence index module is used to calculate the co-occurrence index based on the peer clock rate drift sequence and the message arrival interval sequence. The threshold determination module is used to set a determination threshold based on the temperature-co-resonance index of historical normal sessions, and to determine the target encrypted session according to the determination threshold to obtain the determination result. The security control module is used to refresh the key and suspend the channel for the target encrypted session based on the judgment result, and generate an evidence package.

[0013] Compared with the prior art, the beneficial effects of the present invention are: 1. This invention constructs an analysis link based on the message arrival interval sequence and timestamp increment sequence. It can obtain the peer clock rate sequence, peer clock rate micro-drift sequence and temperature-co-oscillation index by relying only on observable time series information. Thus, without decrypting message content or changing the existing encryption protocol, it can quantitatively determine the abnormal state of the target encrypted session, realize refined security analysis of encrypted traffic, and achieve accurate detection of covert attacks.

[0014] 2. This invention adaptively determines the detrending length through the autocorrelation function, which can accurately separate the long-term trend of clock rate from the micro-drift components caused by temperature and load. Combined with periodogram analysis, it locates the congestion frequency and performs narrowband pass processing, which greatly improves the stability and discriminativeness of the temperature-congestion co-resonance index. At the same time, it dynamically sets the upper quantile as the threshold based on the empirical distribution of historical normal baseline sets, so that the threshold can adapt to changes in network environment and business scenario, effectively improving the stability and interpretability of detection results.

[0015] 3. When a session is deemed suspicious, this invention performs dual security control by refreshing the key and suspending the application data channel through the built-in mechanism of the encryption protocol. This ensures the security of data transmission in scenarios where the original key may be leaked, while avoiding business interruption caused by direct disconnection. At the same time, it generates an tamper-proof evidence package containing key parameters and operation records, providing a complete basis for audit review. Attached Figure Description

[0016] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings: Figure 1 This is a flowchart illustrating an artificial intelligence-based network security analysis method according to an embodiment of the present invention. Figure 2 This is a functional block diagram of an artificial intelligence-based network security analysis system provided in an embodiment of the present invention. Detailed Implementation

[0017] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0018] Example: This example provides an artificial intelligence-based network security analysis method. See [link to example]. Figure 1 Specifically, including: S1. Calculate the peer clock rate sequence based on the message arrival interval sequence and timestamp increment sequence of the target encrypted session; In an embodiment of the present invention, calculating the peer clock rate sequence based on the message arrival interval sequence and timestamp increment sequence of the target encrypted session includes: Extract the arrival time and Transmission Control Protocol (TCP) timestamp of each message in the target encrypted session to form a message arrival time sequence and a TCP timestamp sequence; Specifically, the target encrypted session to be processed is first identified. This target encrypted session is the session corresponding to an encrypted communication link in the network that is currently transmitting data or has completed transmission with a complete message record. All continuously transmitted messages of this target encrypted session are captured through the network protocol stack interface of the network traffic acquisition device or host, ensuring that the capture process covers all messages from the establishment of the session to the current moment without any message loss or duplicate capture. The acquisition device or interface synchronously records the arrival time of each message upon receipt. This arrival time is generated using the calibrated system clock of the acquisition device or host, and the time accuracy is consistent with the time recording accuracy of the network protocol stack to ensure timing accuracy. Simultaneously, each captured message is traversed one by one, the Transmission Control Protocol (TCP) header is parsed, the TCP timestamp field used to characterize the time count of the peer device is located, and the corresponding value is read, ensuring that the original data content of the message is not tampered with during the reading process. Subsequently, according to the actual transmission order of the messages in the target encrypted session, all recorded message arrival times are arranged sequentially to form an ordered message arrival time sequence. Similarly, all read Transmission Control Protocol (TCP) timestamp values ​​are arranged sequentially according to the transmission order of the messages to form an ordered TCP timestamp sequence. During the arrangement process, the rule of placing the time and timestamp values ​​of the first transmitted message before the time and timestamp values ​​of the last transmitted message after the time and timestamp values ​​of the last transmitted message is strictly followed. At the same time, the integrity of the two sequences is checked. If the arrival time or TCP timestamp of a message is found to be missing, a recapture mechanism is triggered to supplement the complete data, ensuring that the lengths of the two sequences are consistent and that each element at each position has a unique correspondence with a single message.

[0019] The message arrival interval sequence is obtained by the difference in arrival times of adjacent messages in the message arrival time sequence. The timestamp increment sequence is obtained by the difference between the Transmission Control Protocol (TCP) timestamps of adjacent messages in the TCP timestamp sequence. Specifically, obtaining the message arrival interval by using the arrival times of adjacent messages converts the original arrival times from absolute time coordinates into a locally observed rhythmic quantity, thereby eliminating the interference of absolute start times and time synchronization errors on subsequent analysis. At the same time, it allows the rhythmic changes caused by link queuing and congestion to be manifested in the form of energy concentration. Obtaining the timestamp increment by using the transmission control protocol timestamps of adjacent messages converts the discrete count changes of the peer time base from absolute counts into step quantities, thereby eliminating the initial value differences and long-term offsets of the peer implementation.

[0020] Specifically, the integrity of the existing message arrival time sequence and transmission control protocol timestamp sequence is first checked to ensure that both sequences are free of data loss, duplication, misalignment, or other anomalies, and that the sequence lengths are consistent. If anomalies are found during the check, the data is re-collected and rearranged until the sequence meets the calculation requirements. For the message arrival time sequence, starting from the second element of the sequence, the message arrival time corresponding to each position is selected sequentially. The message arrival time at the current position is subtracted from the message arrival time at the previous adjacent position to obtain the single message arrival interval value corresponding to that position. All calculated message arrival interval values ​​are then arranged sequentially according to the current position to form a complete message arrival interval sequence. For the transmission control protocol timestamp sequence, the same sequential processing logic as for calculating the message arrival interval sequence is used. Starting from the second element of the sequence, the transmission control protocol timestamp value corresponding to each position is selected sequentially. The transmission control protocol timestamp value at the current position is subtracted from the transmission control protocol timestamp value at the previous adjacent position to obtain the single timestamp increment value corresponding to that position. All calculated timestamp increment values ​​are then arranged sequentially according to the current position to form a complete timestamp increment sequence. During the calculation process, the calculation process of each difference is recorded synchronously. If the message arrival interval value or timestamp increment value is not positive, the corresponding abnormal position is immediately marked and the message arrival time or transmission control protocol timestamp value at the corresponding position in the original sequence is checked. The data is corrected by rereading or calibration and then recalculated to ensure that all values ​​in the final message arrival interval sequence and timestamp increment sequence are reasonable positive values ​​and strictly correspond to the message transmission order of the original sequence.

[0021] The timestamp increment sequence and the message arrival interval sequence are compared according to their corresponding numbers to form the peer clock rate sequence. Specifically, dividing the timestamp increment by the message arrival interval according to the corresponding sequence number to form the peer clock rate sequence unifies the peer counting step and the local observation time to the same scale, thereby obtaining the instantaneous rate representation of the peer time base relative to the observation time. This representation is independent of the equipment model and is positive, which facilitates the subsequent extraction of clock drift by determining the detrending window using autocorrelation and performing correlation measurement with the congestion rhythm in the same frequency band, ultimately improving the stability and interpretability of temperature-induced clock and congestion cooperative behavior identification.

[0022] Specifically, the generated timestamp increment sequence and message arrival interval sequence are first checked for synchronization consistency to confirm that the lengths of the two sequences are exactly equal and that each element corresponding to a sequence number uniquely matches a message in the same transmission order. If the check finds that the sequence lengths do not match or the sequence number correspondence is disordered, the process returns to the previous step to regenerate the sequence. If zero or negative values ​​are found in either sequence, the corresponding anomaly is located and the arrival time of the original message is checked against the transmission control protocol timestamp data. After data correction, a sequence that meets the requirements is regenerated. After the check passes, the ratio is calculated sequentially from the first element according to the natural order of the two sequences. The timestamp increment value corresponding to the current sequence number in the timestamp increment sequence is selected as the numerator, and the message arrival interval value corresponding to the same sequence number in the message arrival interval sequence is selected as the denominator. A division operation is performed to obtain the peer clock rate value corresponding to the current sequence number. After the ratio calculation is completed for all corresponding sequence numbers, all the obtained peer clock rate values ​​are arranged in the same sequence number order as the timestamp increment sequence and the message arrival interval sequence to form the peer clock rate sequence.

[0023] S2. Perform detrending processing on the peer clock rate sequence to obtain the peer clock rate micro-drift sequence; Calculate the sample mean of the remote clock rate sequence, and then calculate the autocorrelation function of the remote clock rate sequence based on the sample mean. The autocorrelation function is: In the formula, It is the autocorrelation function. The number of sample points corresponding to the lag parameter. This represents the total number of samples in the clock rate sequence at the other end. For the first Each peer clock rate value This is the sample mean of the clock rate sequence at the other end; Specifically, by calculating the sample mean of the peer clock rate sequence and constructing a normalized autocorrelation function based on the sample mean, the aim is to characterize the linear correlation of the sequence at different lag sample points on a uniform scale, distinguishing between slowly changing long-term trend components and short-term fluctuating micro-drift components. The normalized autocorrelation function only reflects relative correlation and is not affected by the absolute magnitude and unit selection of the peer clock rate, making the obtained correlation characteristics device-independent and comparable. Based on this, the number of lag sample points where the autocorrelation function is not positive for the first time can be selected as the detrending window. This detrending window directly corresponds to the correlation decay characteristics of the peer clock rate sequence itself, effectively suppressing time synchronization compensation and long-term offsets without the need for preset empirical thresholds, while retaining the true small changes caused by factors such as temperature. This provides a stable, accurate, and physically meaningful data foundation for forming the peer clock rate micro-drift sequence and subsequently determining the coordinated behavior of temperature-induced clocks and congestion rhythms.

[0024] The first zero-crossing lag parameter of the autocorrelation function is determined as the detrending length; By using a moving average with a length equal to the detrending length, the remote clock rate sequence is detrended to obtain the remote clock rate micro-drift sequence. Specifically, the autocorrelation function curve of the calculated peer clock rate sequence typically exhibits a slow decay trend within the low hysteresis range. When the long-term trend component in the sequence is canceled out, the autocorrelation value will first drop to zero or turn negative near a certain hysteresis sample point. The number of samples corresponding to this first zero-crossing hysteresis sample point is determined as the detrending length. This point reflects the time scale of the sequence's transition from strong to weak correlation, representing the natural boundary between stable trends and short-term fluctuations in the peer clock rate variation. The detrending length determined in this way can adapt to changes in different network conditions and transmission rates, possessing statistical consistency and interpretability. After determining the detrending length, the original clock rate sequence is smoothed using a moving average equal to the detrending length. That is, the average value within the neighborhood detrending length is calculated for each sample point, and this average value is used as the trend term for that point. Subtracting the trend term from the original clock rate yields the peer clock rate micro-drift sequence. This micro-drift sequence retains high-frequency, minute fluctuations caused by temperature drift, oscillator aging, or transient network load, while eliminating long-term linear drift. This ensures that subsequent correlation analysis between temperature-induced clocks and congestion rhythms only reflects the true cooperative phenomenon. This adaptive detrending process based on autocorrelation zero-crossing characteristics effectively enhances the system's robustness to cross-device clock differences and asynchronous communication delays, improving the stability and analytical accuracy of clock rate micro-drift characteristics under different environments.

[0025] S3. Calculate the temperature-suppression co-oscillation index based on the peer clock rate drift sequence and the message arrival interval sequence. In an embodiment of the present invention, the temperature congestion co-resonance index is calculated based on the peer clock rate drift sequence and the message arrival interval sequence, including: Perform periodic graph processing on the message arrival interval sequence, and determine the positive frequency with the highest energy in the periodic graph as the congestion frequency; Centered on the congestion frequency, narrowband bandpass processing is performed on the message arrival interval sequence and the peer clock rate drift sequence to obtain two sets of bandpass signal sequences. Specifically, the message arrival interval sequence is first preprocessed to remove potential extreme outliers and perform zero-mean normalization. Outlier determination is based on the arrival interval distribution range of similar encrypted sessions. If a value exceeds three times the standard deviation of the range, it is marked as an outlier and replaced using linear interpolation. Zero-mean normalization is achieved by subtracting the sample mean of the sequence to ensure that the sequence mean is zero, thus avoiding interference from DC components in the periodogram calculation. Periodogram estimation is then performed on the preprocessed message arrival interval sequence. The discrete Fourier transform of the sequence is calculated using a fast Fourier transform to obtain the complex spectrum corresponding to each frequency point. The square of the modulus of the complex spectrum is then divided by the sequence length to obtain the power spectrum, i.e., the periodogram. The frequency range covers all positive frequencies from zero to the Nyquist frequency. The frequency resolution is determined by both the sequence length and the sampling interval, which is the time interval unit between adjacent elements in the sequence. Traverse all positive frequency points in the periodic graph, compare the power values ​​corresponding to each frequency point, and determine the positive frequency with the largest power value as the congestion master frequency. This congestion master frequency reflects the main rhythm of periodic congestion and queuing fluctuations of network data packets in the target encrypted session, and is the center frequency for subsequent synchronization analysis.

[0026] Specifically, after determining the congestion frequency, a narrowband bandpass filter is designed centered on this frequency. The filter bandwidth is intrinsically determined based on the data length and frequency resolution of the message arrival interval sequence, specifically two to three times the frequency resolution, ensuring that only frequency components near the congestion frequency are retained. The designed narrowband bandpass filter is applied to both the message arrival interval sequence and the peer clock rate drift sequence. Elements in each sequence are filtered sequentially, removing components with frequencies lower than the congestion frequency minus half the bandwidth or higher than the congestion frequency plus half the bandwidth, retaining signal components within that frequency range. After filtering, two sets of signal sequences with the same length as the original sequences are obtained: the bandpass signal sequence corresponding to the message arrival interval sequence and the bandpass signal sequence corresponding to the peer clock rate drift sequence. These two sets of bandpass signals maintain the same sampling length and synchronization step size in the time domain and share the same frequency center in the frequency domain, ensuring that signals from both sources are retained only on the same rhythmic components, providing a basis for phase consistency and energy correspondence in subsequent normalized cross-correlation calculations. Through this processing, the system retains the coupling components of congestion-dominant fluctuations and clock drift while minimizing environmental noise and trend interference.

[0027] Calculate the normalized cross-correlation of two sets of bandpass signal sequences under different sample level lags, and take the largest normalized cross-correlation as the Wen-Hung co-resonance index. Specifically, first determine the range of sample-level lag values, from negative sequence length minus one to positive sequence length minus one, covering all possible sample shifts. A positive lag indicates that the first bandpass signal sequence leads the second bandpass signal sequence by a corresponding number of samples, while a negative lag indicates that the first bandpass signal sequence lags the second bandpass signal sequence by a corresponding number of samples. Calculate the normalized cross-correlation value of the two bandpass signal sequences at this lag, where the normalized cross-correlation calculation formula is: In the formula, Two sets of narrowband signal sequences with sample-level lag Normalized cross-correlation value under the following conditions For sample-level lag parameters, This is the first group of bandpass signal sequences. This is the second group of bandpass signal sequences, where This serves as the sample index; the normalized cross-correlation calculation formula uses the numerator to analyze two sets of bandpass signal sequences. With sample-level lag Translation The corresponding sample values ​​are multiplied and summed to quantify the lag between the two sequences. The degree of linear correlation under the given time offset reflects their similarity at that time offset; the denominator calculates the linear correlation between the two sets of bandpass signal sequences respectively. and The energy of each molecule (i.e., the square root of the sum of squares of the sample values, also known as the L2 norm) is used to divide the cross-correlation result of the molecules by the product of their energies. This is to eliminate the interference of the amplitude difference of the sequences themselves on the degree of correlation, and to achieve normalization. This ensures that the final normalized cross-correlation value is constrained to the range of -1 to 1, thereby guaranteeing that the correlation measure only reflects the relative consistency of the two sets of signals within the same frequency band and is not affected by the amplitude scale. The normalized cross-correlation values ​​corresponding to all sample-level lag values ​​are iterated through, and the normalized cross-correlation value with the largest value is selected and determined as the Wen-Hung co-resonance index.

[0028] Specifically, the Temperature-Congestion Co-resonance Index (TCCCI) is a quantitative indicator characterizing the cooperative relationship between changes in the peer clock rate and the arrival rhythm of data packets during network communication. This index takes the packet arrival interval sequence and the peer clock rate drift sequence as inputs, reflecting their energy synchronization and phase correlation near the congestion frequency. Its core idea is that, under conditions of temperature fluctuations or device clock drift in the network link, small changes in the peer clock rate can affect the packet arrival interval through round-trip delay and queuing rhythm, causing them to exhibit phase locking or energy resonance characteristics within a narrow frequency band. The index ranges from -1 to 1; a larger value indicates stronger synchronization between clock drift and congestion fluctuations, meaning a more pronounced interaction between potential clock thermal drift and traffic cycles in the network. This index not only reflects the coupling characteristics between the physical layer clock and the link layer transmission but also reveals potential security vulnerabilities caused by environmental temperature changes, device oscillator drift, or transmission congestion, providing a quantifiable basis for network anomaly detection and encrypted session security analysis based on physical clock behavior.

[0029] S4. Set a judgment threshold based on the temperature-co-resonance index of historical normal sessions, and judge the target encrypted session according to the judgment threshold to obtain the judgment result. In an embodiment of the present invention, a judgment threshold is set based on the warm-convergence co-resonance index of historical normal sessions, and the target encrypted session is judged according to the judgment threshold to obtain a judgment result, including: The temperature-congestion co-resonance indexes corresponding to the historical normal sessions of the target host during the same period are used to form a set of historical normal baselines. Specifically, first, determine the target host's device type, network role, and business scenario. Select other hosts of the same type, with the same network role, and running the same business scenario as the target host as a reference sample set. Ensure that the hosts in the reference sample set are consistent with the target host in terms of hardware configuration, operating system, and running application services to guarantee the comparability of historical data. Define similar time periods. Divide the day into multiple time periods based on the target host's business operation patterns, such as working hours, non-working hours, or peak, off-peak, and low-peak periods. Select historical time periods that are the same as the current target encrypted session as similar time periods to ensure the temporal correlation of historical data. Filter historical normal sessions. From all encrypted sessions generated by the reference sample set hosts within the similar time periods, remove sessions that are judged as abnormal by manual review or preset rules, and retain sessions confirmed as normal communication as historical normal sessions. During the filtering process, the criteria for judging each session must be recorded to ensure the reliability of normality. For each selected historical normal session, following the same calculation process as the target encrypted session, the following steps are performed sequentially: extraction of message arrival time and Transmission Control Protocol timestamp; generation of message arrival interval sequence and timestamp increment sequence; calculation of peer clock rate sequence; detrending processing; determination of congestion frequency; narrowband passthrough processing; and normalized cross-correlation calculation, resulting in the temperature-congestion co-resonance index corresponding to each historical normal session. Finally, the temperature-congestion co-resonance indices of all historical normal sessions are arranged chronologically according to the session generation time to form a historical normal baseline set. After the set is formed, it is necessary to periodically check and supplement new historical normal session data, while removing data that exceeds the preset retention period to ensure that the baseline set can reflect the latest normal communication characteristics and provide accurate benchmark data for subsequent threshold determination.

[0030] Statistical analysis was performed on the temperature-emergence co-oscillation index in the historical normal baseline set to form an empirical distribution of the temperature-emergence co-oscillation index; The upper quantile of the empirical distribution is determined based on the total sample size of the historical normal baseline set, and the upper quantile is used as the judgment threshold. Specifically, the data of all temperature-encroachment resonance indices in the historical normal baseline set is first cleaned to remove any potential extreme outliers. Outlier determination is based on the three-standard-deviation rule: if a temperature-encroachment resonance index exceeds the range of the mean of all values ​​in the set plus or minus three standard deviations, it is marked as an outlier and removed from the set to avoid interference from outliers in the statistical analysis results. After cleaning, the total sample size of the remaining temperature-encroachment resonance indices is counted, and the frequency of each value in the set is calculated. By plotting a frequency distribution histogram or cumulative distribution curve, the distribution characteristics of temperature-encroachment resonance indices in normal scenarios are visually presented, forming an empirical distribution of temperature-encroachment resonance indices. This distribution can fully reflect the probability distribution law of temperature-encroachment resonance indices in historical normal sessions. Based on the characteristics of the empirical distribution and the security control requirements of the target encrypted session, the specific proportion of the upper quantile is determined. This proportion is dynamically adjusted based on the total sample size of the historical normal baseline set. When the total sample size is large, a higher proportion, such as 99.5%, can be selected; when the total sample size is small, the proportion can be appropriately reduced, such as 99%, to balance the strictness of the threshold and the risk of misjudgment. Based on a defined proportion, the corresponding upper quantile is located in the empirical distribution. That is, the cumulative probability of the temperature-convergence co-resonance index to the right of the position appearing in the historical normal baseline set is equal to the set proportion. The temperature-convergence co-resonance index value corresponding to the upper quantile is determined as the judgment threshold, ensuring that the temperature-convergence co-resonance index of normal sessions will not exceed the threshold in most cases, thus providing a clear and suitable benchmark for the anomaly judgment of the target encrypted session.

[0031] The current temperature-convergence co-resonance index of the target encrypted session is compared with the judgment threshold. If the current temperature-convergence co-resonance index is greater than the judgment threshold, the session is judged to be suspicious; otherwise, the session is judged to be normal. Specifically, the current temperature-congestion co-resonance index (TCC) is directly compared with the threshold value. If the current TCC is significantly greater than the threshold, it indicates that the TCC of this session exceeds the normal range defined by the historical normal baseline set, and the coordination of its peer clock rate drift and congestion rhythm is different from that of a normal session. Therefore, the target encrypted session is determined to be a suspicious session. If the current TCC is less than or equal to the threshold, it indicates that the coordination of the session is within the historical normal range and conforms to the characteristics of normal communication. Therefore, the target encrypted session is determined to be a normal session. After the determination is completed, the comparison result and the corresponding TCC and threshold values ​​are recorded immediately to ensure the traceability of the determination process.

[0032] S5. Based on the judgment result, refresh the key and suspend the channel for the target encrypted session, and generate an evidence package; In an embodiment of the present invention, based on the determination result, the target encrypted session is key refreshed and the channel is paused, and an evidence package is generated, including: If the session is deemed suspicious, the key for the target encrypted session is refreshed and the channel in the application data direction is suspended; otherwise, the current communication state of the target encrypted session is maintained. Specifically, the target encrypted session determination result obtained from the aforementioned steps is first obtained. The validity of the determination result is verified to confirm that the result fully corresponds to the evaluation cycle of the current target encrypted session and that there is no data transmission delay or misjudgment. If the verification finds that the determination result is abnormal, the calculation of the Warm-Hum Co-resonance Index and the threshold comparison process are re-executed until a valid determination result is obtained. If the determination result indicates that the session is suspicious, dual security control operations are immediately initiated for the target encrypted session. The key refresh operation is implemented through the key renegotiation mechanism built into the encryption protocol, sending a key update request to the peer device. After both parties complete the negotiation and confirmation of the new key, the use of the original session key is terminated and the new key is enabled for subsequent data encryption transmission, ensuring that even if the original key is at risk of leakage, it cannot decrypt the newly transmitted data. The application data direction channel suspension operation targets the bidirectional application data transmission link corresponding to the encrypted session, suspending only the data transmission function while retaining the session connection to avoid service interruption due to direct disconnection. After the suspension is triggered, the channel status is monitored in real time to prevent abnormal channel closure or data loss. If the determination result indicates that the session is normal, no security control operations are triggered, maintaining the current key status, channel transmission status, and data transmission rate of the target encrypted session to ensure that normal business communication is not interfered with. Regardless of the operation performed, the operation type, execution time, operation result, and corresponding judgment result are recorded in real time to form a complete operation record, providing data support for the subsequent generation of evidence packages.

[0033] Record the time and execution status of key refresh and channel pause to form a session action record; The values ​​of congestion frequency, temperature-congestion co-occurrence index, judgment threshold, judgment result and session action record are fixed, the solidified data is encapsulated into evidence package, and the evidence package is persistently stored. Specifically, when performing a key refresh operation, the system time initiating the operation, the start and completion times of key negotiation, and the success or failure status of the operation are recorded. If the operation fails, the reason for failure is recorded. When performing a channel pause operation, the time the pause command is issued, the actual pause time of the channel, the direction of application data involved in the pause, and the maintenance status of the channel pause state are recorded. These records are organized in chronological order to form a session action record that includes the operation type, time node, and execution status. If no security control operation is performed, the session is marked as normal and the corresponding time in the session action record. Subsequently, at the end of the current evaluation cycle, the specific value of the congestion main frequency temperature co-resonance index judgment threshold is fixed to ensure that the fixed value is completely consistent with the calculation result within the evaluation cycle, without any modification or deviation. At the same time, the content of the session action record is fixed to maintain the originality and integrity of the record. Following the order of session action records based on the congestion frequency, temperature, and resonance index threshold determination results, all solidified data is integrated and encapsulated into a structured evidence package. During encapsulation, a unique identifier is added to the evidence package, containing the session ID of the target encrypted session and the evaluation period timestamp, to achieve precise association between the evidence package and the corresponding session and period. The evidence package is persistently stored using a storage method with data integrity verification capabilities. The storage medium must meet tamper-proof requirements to ensure that the evidence package is not illegally modified or deleted during storage. Simultaneously, a storage index is established to facilitate quick retrieval and access to the corresponding evidence package during subsequent auditing and review.

[0034] like Figure 2 The diagram shown is a functional block diagram of an artificial intelligence-based network security analysis system provided in an embodiment of the present invention.

[0035] In this embodiment, the functions of each module / unit are as follows: The clock rate module is used to calculate the peer clock rate sequence based on the message arrival interval sequence and timestamp increment sequence of the target encrypted session; The clock drift module is used to perform detrending processing on the peer clock rate sequence to obtain the peer clock rate drift sequence. The co-occurrence index module is used to calculate the co-occurrence index based on the peer clock rate drift sequence and the message arrival interval sequence. The threshold determination module is used to set a determination threshold based on the temperature-co-resonance index of historical normal sessions, and to determine the target encrypted session according to the determination threshold to obtain the determination result. The security control module is used to refresh the key and suspend the channel for the target encrypted session based on the judgment result, and generate an evidence package.

[0036] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. An artificial intelligence-based network security analysis method, characterized by, The method comprises the following steps: S1. Calculate the opposite end clock rate sequence based on the message arrival interval sequence and the timestamp increment sequence of the target encrypted session; S2. Perform detrending processing on the opposite end clock rate sequence to obtain the opposite end clock rate micro-drift sequence; S3. Calculate the warm congestion and oscillation index based on the opposite end clock rate micro-drift sequence and the message arrival interval sequence; S4. Set the judgment threshold based on the warm congestion and oscillation index of the historical normal session, and judge the target encrypted session according to the judgment threshold to obtain the judgment result; S5. Refresh the key and suspend the channel of the target encrypted session based on the judgment result, and generate an evidence package.

2. The network security analysis method based on artificial intelligence according to claim 1, characterized in that, The method for calculating the opposite end clock rate sequence based on the message arrival interval sequence and the timestamp increment sequence of the target encrypted session comprises the following steps: Extract the arrival time and transmission control protocol timestamp of each message in the target encrypted session to form the message arrival time sequence and the transmission control protocol timestamp sequence; Obtain the message arrival interval sequence according to the difference between the arrival times of adjacent messages in the message arrival time sequence; Obtain the timestamp increment sequence according to the difference between the transmission control protocol timestamps of adjacent messages in the transmission control protocol timestamp sequence; Take the ratio of the timestamp increment sequence and the message arrival interval sequence according to the corresponding sequence number to form the opposite end clock rate sequence.

3. The network security analysis method based on artificial intelligence according to claim 1, characterized in that, The method for performing detrending processing on the opposite end clock rate sequence to obtain the opposite end clock rate micro-drift sequence comprises the following steps: Calculate the sample mean of the opposite end clock rate sequence, and calculate the autocorrelation function of the opposite end clock rate sequence based on the sample mean; Determine the first zero-crossing lag parameter of the autocorrelation function as the detrending length; Perform detrending processing on the opposite end clock rate sequence by using a sliding mean with a length equal to the detrending length to obtain the opposite end clock rate micro-drift sequence.

4. The network security analysis method based on artificial intelligence according to claim 3, characterized in that, The method for calculating the warm congestion and oscillation index based on the opposite end clock rate micro-drift sequence and the message arrival interval sequence comprises the following steps: Perform periodogram processing on the message arrival interval sequence, and determine the maximum positive frequency in the periodogram as the congestion main frequency; Perform narrow-band bandpass processing on the message arrival interval sequence and the opposite end clock rate micro-drift sequence respectively with the congestion main frequency as the center to obtain two groups of bandpass signal sequences; Calculate the normalized cross-correlation of the two groups of bandpass signal sequences at different sample level lags, and take the maximum normalized cross-correlation as the warm congestion and oscillation index.

5. The network security analysis method based on artificial intelligence according to claim 1, characterized in that, The method for setting the judgment threshold based on the warm congestion and oscillation index of the historical normal session and judging the target encrypted session according to the judgment threshold comprises the following steps: Form a historical normal baseline set by using the warm congestion and oscillation indexes corresponding to the historical normal sessions of the target host in the same period; Perform statistical analysis on the warm congestion and oscillation indexes in the historical normal baseline set to form an empirical distribution of the warm congestion and oscillation index; Determine the upper quantile point of the empirical distribution according to the total sample amount of the historical normal baseline set, and take the upper quantile point as the judgment threshold; Compare the warm congestion and oscillation index of the current target encrypted session with the judgment threshold, if the current warm congestion and oscillation index is greater than the judgment threshold, the session is determined to be suspicious, otherwise the session is determined to be normal.

6. The network security analysis method based on artificial intelligence according to claim 1, characterized in that, The method for refreshing the key and suspending the channel of the target encrypted session based on the judgment result comprises the following steps: If the determination result is suspicious, the target encryption session is refreshed and the channel in the data direction is suspended; otherwise, the current communication state of the target encryption session is maintained.

7. The network security analysis method based on artificial intelligence according to claim 6, characterized in that, The evidence package is generated, including: The time and execution state of the key refresh and channel suspension are recorded to form a session action record; The congestion master frequency, warm congestion index, determination threshold, determination result, and session action record are fixed, the fixed data is encapsulated as an evidence package, and the evidence package is stored persistently.

8. An artificial intelligence-based network security analysis system, characterized by, The system comprises: A clock rate module configured to calculate a peer clock rate sequence based on a message arrival interval sequence and a timestamp increment sequence of a target encryption session; A clock micro-drift module configured to perform detrending processing on the peer clock rate sequence to obtain a peer clock rate micro-drift sequence; A congestion and cooperation vibration index module configured to calculate a warm congestion and cooperation vibration index based on the peer clock rate micro-drift sequence and the message arrival interval sequence; A threshold determination module configured to set a determination threshold based on the warm congestion and cooperation vibration index of a historical normal session, determine the target encryption session according to the determination threshold, and obtain a determination result; A security control module configured to refresh the target encryption session and suspend the channel based on the determination result, and generate an evidence package.

Images