Communication monitoring method and communication system

Abstract

The invention discloses a communication monitoring method and a communication system. The system comprises a monitoring module, a feature extraction module, a dynamic identification module, a behavior analysis module, an adaptive optimization module and a visual interface module. The monitoring module collects communication data flow through a mirror image port, the feature extraction module extracts packet length, time interval, direction sequence and encryption features by using a multi-dimensional feature fusion algorithm, and the dynamic recognition module realizes multi-protocol type recognition based on an improved self-attention convolutional neural network. The behavior analysis module constructs a communication relation graph and performs abnormal communication tracing; and the adaptive optimization module realizes model self-learning and parameter optimization through reinforcement learning. According to the method, through sliding window sampling, self-correlation analysis, entropy detection and GNN map modeling, accurate identification and behavior restoration of implicit traffic in a complex network environment are realized. According to the method, high-precision identification can be kept under the conditions of multi-protocol mixing and encrypted communication, and the characteristics of intelligence, self-adaption and expandability are achieved.

Description

Technical Field

[0001] This invention relates to the field of communication technology, specifically to a communication monitoring method and a communication system. Background Technology

[0002] With the rapid development of communication technology, network communication structures are becoming increasingly complex, communication protocol types are numerous, and the level of encryption of communication data is constantly improving. Traditional communication monitoring systems generally adopt static detection methods based on fixed protocol characteristics or port numbers. This approach suffers a significant decrease in monitoring accuracy when faced with mixed protocols, dynamically allocated ports, and encrypted traffic, making it impossible to effectively identify covert communication activities.

[0003] In existing technologies, some systems attempt to introduce deep packet inspection (DPI) or rule-based recognition algorithms, but these methods rely on manually maintained rule bases or signature databases, making it difficult to adapt to the speed of protocol updates. Furthermore, traditional eavesdropping methods cannot achieve real-time tracking and behavior reconstruction for cross-domain communication, multi-channel converged communication, and data streams in virtualized network environments.

[0004] Therefore, there is an urgent need for a new communication monitoring method and system that can automatically identify, intelligently analyze, and dynamically adapt to complex communication environments in order to improve the accuracy, intelligence, and real-time performance of monitoring. Summary of the Invention

[0005] (a) Technical problems to be solved

[0006] To address the shortcomings of existing technologies, this invention provides a communication monitoring method and system. It solves the problem that some systems attempt to introduce deep packet inspection (DPI) or rule-based recognition algorithms, but these methods rely on manually maintained rule bases or signature databases, making them difficult to adapt to the rapid pace of protocol updates. Furthermore, traditional monitoring methods cannot achieve real-time tracking and behavior reconstruction for cross-domain communication, multi-channel converged communication, and data streams in virtualized network environments.

[0007] (II) Technical Solution

[0008] The purpose of this invention is to overcome the shortcomings of existing communication monitoring technologies, such as strong protocol dependence, lagging rule updates, and low monitoring accuracy. It provides a communication monitoring method and system that integrates multi-source data feature analysis and adaptive model learning mechanisms, achieving high-precision monitoring and behavior tracking of multi-protocol, multi-channel hybrid communication. This is achieved through the following technical solution: A communication monitoring system, comprising a monitoring module, a feature extraction module, a dynamic recognition module, a behavior analysis module, an adaptive optimization module, and a visualization interface module.

[0009] The monitoring module collects network communication data packets via mirrored ports; the feature extraction module performs layered parsing of the data packets, extracting packet length, time interval, direction sequence, and encryption fingerprint features; the dynamic recognition module performs deep learning inference on the feature vectors and outputs communication type labels; the behavior analysis module constructs a communication entity relationship graph to identify and trace abnormal communication; and the adaptive optimization module adjusts network parameters based on the model's accuracy feedback to achieve continuous learning.

[0010] A communication monitoring method, specifically including:

[0011] S1. Data Acquisition: Acquire communication data streams through the bypass mirroring interface without interfering with normal network communication;

[0012] S2. Feature Extraction: Extract multi-dimensional features from communication data, including packet length mean, delay variance, spectral energy density, and encryption identifier bits;

[0013] S3. Model Recognition: The trained SACNN model is used to classify the input features and automatically identify the communication protocol type and communication direction;

[0014] S4, Implicit Traffic Detection;

[0015] S5. Behavior Analysis: Construct a session association graph and perform cluster analysis and path tracing on the behavior of target communication nodes;

[0016] S6. Self-learning optimization: The system adjusts model parameters based on the feedback of recognition results to achieve continuous optimization and accuracy improvement.

[0017] As a further preferred embodiment of the present invention, in step S1, after the monitoring is initiated, the real-time communication stream is acquired through the link access unit, and the sampling adopts a sliding window algorithm: assuming the time window length is T, data packets are collected at intervals Δt to form a set.

[0018]

[0019] W(t): Represents the set of data packets within the current time window.

[0020] P i : Represents the i-th collected data packet,

[0021] t i : Represents the capture timestamp of the i-th data packet.

[0022] T: Represents the length of the sliding window and the sampling time interval.

[0023] t: Current system clock time

[0024] The system continuously samples data to ensure data continuity and time-series consistency. In addition, the module uses multi-threaded capture and load-balanced queue distribution to achieve real-time monitoring of 10Gb-level data streams per second.

[0025] As a further preferred embodiment of the present invention, in step S2, multidimensional features of the communication packet are extracted using a hierarchical parsing unit, employing a three-layer fusion strategy of statistical features, temporal features, and spatial features:

[0026] Statistical characteristics: Calculate the mean packet length μ, variance σ², and expected packet interval E(Δt);

[0027] Time-domain characteristics: using the autocorrelation function

[0028] Identify communication rhythm and periodicity.

[0029] R(r): Represents the autocorrelation value with lag r, used to reflect the time correlation of the signal.

[0030] N: Represents the total number of samples, i.e., the number of packets within the time window.

[0031] x i : Represents the packet length or rate at the i-th time sampling point.

[0032] : Represents the mean of all x_i, used for centering.

[0033] r: represents the time delay (lag), with the unit being the sampling period.

[0034] Spatial features: A hash signature is constructed based on the bit statistics of the header field, and the resulting feature vector is input into the feature encoding unit for normalization and dimensionality reduction.

[0035] As a further preferred embodiment of the present invention, in step S3, a combination of pre-trained model and online learning is adopted. The training process includes: supervised training on a known protocol sample set; updating the model using a pseudo-label generation algorithm on an unknown sample set; using the SACNN model for the network structure, where convolutional layers capture local features, attention layers calculate global correlations, and the output is a multi-class probability distribution; and using the Adam optimizer for training optimization, with adaptive adjustment of the learning rate.

[0036] As a further preferred embodiment of the present invention, in step S4, during the identification stage, the real-time communication stream is input into the model, and the system calculates the classification probability vector P = [p1, p2, ..., p...]. n ],

[0037] Where P is the probability distribution vector output by the model.

[0038] p i: is the predicted probability that the input communication stream belongs to the i-th protocol class.

[0039] n: The total number of all protocol categories. When the maximum probability is less than the set threshold θ, it is determined to be an unknown or mixed protocol. For encrypted or obfuscated traffic, the system further calls entropy analysis and packet sequence anomaly detection algorithms.

[0040]

[0041] The "score" refers to the implicit overall traffic score, which measures the degree of communication anomalies.

[0042] α: Entropy weighting coefficient, used to control the influence of encryption features.

[0043] β: Time fluctuation weighting coefficient, used to measure the contribution of time series anomalies to the results.

[0044] H: Load entropy value.

[0045] Δt: Variance of the time interval between private rooms.

[0046] When the score exceeds the threshold, it is marked as implicit traffic.

[0047] As a further preferred embodiment of the present invention, in step S5, the communication flow results are input into the GNN model to construct a communication graph, where each node represents a communication entity, each edge represents a session, and the node embedding vector is updated through a message passing mechanism.

[0048]

[0049] h v (k) : The feature vector of node v in the k-th layer of the network.

[0050] N(v): The set of neighboring nodes of node v.

[0051] W (k) The weight matrix of the k-th layer.

[0052] b (k) Bias term,

[0053] σ(): Non-linear activation function

[0054] The system determines the main communication path and abnormal nodes by calculating node centrality and edge weights, thereby enabling behavior reconstruction and source tracing.

[0055] As a further preferred embodiment of the present invention, in step S6, the system uses an online reinforcement learning algorithm to optimize the model parameters based on the real-time recognition accuracy.

[0056] The reward function is defined as:

[0057] Where R: immediate reward value, used to measure the benefit of optimizing the action.

[0058] γ: Precision enhancement weighting coefficient, used to amplify positive changes in recognition rate.

[0059] Acc: The recognition accuracy of the current model.

[0060] Acc prev The recognition accuracy of the previous iteration.

[0061] λ: Loss penalty factor, used to balance accuracy and stability.

[0062] Loss: The loss function value of the current model. The system adjusts the network parameters based on the R value to achieve self-learning and dynamic adaptation.

[0063] (III) Beneficial Effects

[0064] This invention provides a communication monitoring method and a communication system. It has the following beneficial effects:

[0065] This invention constructs a multi-dimensional communication fingerprint by combining layered parsing, frequency domain analysis, and encrypted feature extraction, enabling full-feature monitoring of complex protocols. The system improves identification accuracy by approximately 12%–18% in multi-protocol mixed environments and can effectively detect obfuscated or encrypted implicit communications.

[0066] Introducing a self-attention convolutional neural network to achieve intelligent protocol recognition

[0067] The dynamic recognition module employs an improved SACNN structure, combining local convolutional features with global attention weights to automatically learn protocol features without requiring a rule base, enabling the identification of unknown protocol types. Experiments show that this model outperforms the traditional DPI method in generalization accuracy under unknown traffic scenarios.

[0068] Behavior reconstruction and anomaly tracing based on graph neural networks. The behavior analysis module maps communication sessions as a graph structure and uses the GNN algorithm to calculate node centrality and correlation, achieving a visual reconstruction of communication relationships. This technology can quickly locate source nodes in network attacks, covert channels, or abnormal traffic, enabling path-level tracing.

[0069] The adaptive parameter and strategy adjustment mechanism allows the system to automatically update the identification threshold, feature weights, and sampling frequency using Bayesian optimization and gradient adjustment strategies, thereby achieving online parameter optimization and effectively reducing monitoring latency and false alarm rate.

[0070] The visualization analysis is user-friendly and the human-computer interaction is excellent. The visualization interface module provides multi-dimensional graphical displays, including traffic trends, anomaly distribution, and communication topology, enabling operators to intuitively analyze monitoring results and issue graded warnings based on risk indices.

[0071] With strong scalability and compatibility, the system of this invention adopts a modular architecture and standardized interface design for each module, making it suitable for various network environments, including SDN, virtualized networks and multi-domain communication systems, and easy to expand and deploy.

[0072] This invention constructs an intelligent closed-loop system of "listening—identification—analysis—optimization," achieving high-precision monitoring and behavior tracking in complex communication environments. The system possesses high adaptability, strong generalization, and real-time stability, making it suitable for scenarios such as network security protection, abnormal traffic detection, military communication monitoring, and data auditing. Attached Figure Description

[0073] Figure 1 This is a schematic diagram of the system principle framework of the present invention.

[0074] Figure 2 This is a schematic diagram of the method flow of the present invention. Detailed Implementation

[0075] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0076] Please see Figure 1-2 This invention provides a technical solution: a communication monitoring system, wherein the monitoring module is used for non-intrusive data acquisition and mirror stream reconstruction of the communication network, and includes the following sub-units:

[0077] Link Access Unit: Connects to physical or virtual communication links via bypass mirroring or TAP ports to enable simultaneous sampling by multiple nodes. Supports data capture in gigabit, 10-gigabit, and virtual switching environments (such as vSwitch, SDN).

[0078] Data caching unit: A circular buffer mechanism is used to temporarily store high-throughput data streams, and a sliding window technique is used to divide data packets by time slice to ensure the continuity of subsequent feature extraction.

[0079] Packet reassembly unit: Performs TCP stream reassembly and sequence verification on fragmented data packets to restore complete session data and form a parsable stream record.

[0080] Time synchronization unit: Global clock synchronization is performed based on the high-precision network time protocol (PTP) to ensure the timing alignment of cross-node monitoring data.

[0081] This module can process multiple monitoring sources in parallel, enabling unified data acquisition across domains and multiple links.

[0082] The feature extraction module performs multi-level feature analysis on the acquired communication stream and outputs multi-dimensional feature vectors. It includes:

[0083] Layered parsing unit: Employs a deep packet parsing engine to perform layered analysis of data at the link layer, transport layer, and application layer, extracting basic information such as packet header fields, protocol fields, and port sequences.

[0084] Temporal feature analysis unit: Extracts time-frequency domain features based on short-time Fourier transform (STFT), calculates packet interval distribution and burst index, and is used to identify traffic patterns.

[0085] Encryption identification unit: Identifies the type of encrypted communication by statistically analyzing packet payload entropy values ​​and TLS handshake characteristics.

[0086] Feature encoding unit: Principal component analysis (PCA) and t-SNE dimensionality reduction techniques are used to map high-dimensional features to fixed-length vectors to achieve compact feature representation.

[0087] Protocol fingerprint generation unit: Calculates indicators such as packet sequence length, packet direction ratio, time deviation, and header feature hash to generate an independent communication fingerprint.

[0088] The dynamic recognition module is the core intelligent recognition unit of the system, primarily responsible for the automatic identification and classification of unknown communication types. It includes:

[0089] Model training subunit: The model is trained using an improved self-attention convolutional neural network (SACNN) structure. The network consists of feature convolutional layers, attention weighted layers, and fully connected classification layers.

[0090] Semi-supervised self-learning unit: For unknown communication samples, pseudo-label generation and consistency regularization algorithms are used for adaptive learning, enabling the model to have scalability.

[0091] Protocol clustering identification unit: The DBSCAN clustering algorithm is used to cluster unknown traffic in the feature space, and potential protocol families are discovered through similarity measurement.

[0092] The behavior analysis module enables the reconstruction of communication behavior, anomaly identification, and path tracing, including:

[0093] Session reconstruction unit: Reconstructs the communication session sequence based on timestamp, source and destination IP, port, and direction characteristics.

[0094] Relationship graph construction unit: Using the graph neural network (GNN) algorithm, communication entities and data flows are mapped to nodes and edges, node centrality and association weights are calculated, and a communication relationship graph is generated.

[0095] Anomaly Detection Unit: Using an unsupervised anomaly detection model based on Isolation Forest, deviations in communication behavior patterns are determined, enabling the identification of potential attacks or covert communications.

[0096] Adaptive optimization module

[0097] This module continuously improves system performance through a feedback mechanism:

[0098] Accuracy assessment subunit: The matching rate between the recognition confidence score output by the statistical model and the actual protocol tag is used to generate a dynamic accuracy report.

[0099] Parameter tuning unit: Based on gradient descent and Bayesian optimization methods, it automatically adjusts the SACNN model parameters and feature weights.

[0100] Policy update unit: Retrains the model and updates the policy library based on the detected new protocol features to achieve continuous learning.

[0101] Visual Interface Module

[0102] This module is used for result display and interactive operations:

[0103] Traffic monitoring interface: Displays the distribution, fluctuations, and anomalies of various types of communication traffic in real time.

[0104] Behavior graph interface: Displays communication relationships and attack paths in the form of a visual node graph, supporting dynamic filtering and timeline playback.

[0105] Model management interface: Displays the training status, accuracy curve and parameter configuration of the recognition model, facilitating system maintenance.

[0106] The communication monitoring method using the above-mentioned communication system specifically includes:

[0107] S1. Data Acquisition: Acquire communication data streams through the bypass mirroring interface without interfering with normal network communication;

[0108] S2. Feature Extraction: Extract multi-dimensional features from communication data, including packet length mean, delay variance, spectral energy density, and encryption identifier bits;

[0109] S3. Model Recognition: The trained SACNN model is used to classify the input features and automatically identify the communication protocol type and communication direction;

[0110] S4, Implicit Traffic Detection;

[0111] S5. Behavior Analysis: Construct a session association graph and perform cluster analysis and path tracing on the behavior of target communication nodes;

[0112] S6. Self-learning optimization: The system adjusts model parameters based on the feedback of recognition results to achieve continuous optimization and accuracy improvement.

[0113] In step S1, after the monitoring is started, the real-time communication stream is obtained through the link access unit. The sampling adopts the sliding window algorithm: let the time window length be T, and data packets are collected at intervals Δt to form a set.

[0114]

[0115] W(t): Represents the set of data packets within the current time window.

[0116] P i : Represents the i-th collected data packet,

[0117] t i : Represents the capture timestamp of the i-th data packet.

[0118] T: Represents the length of the sliding window and the sampling time interval.

[0119] t: Current system clock time

[0120] The system continuously samples data to ensure data continuity and time-series consistency. In addition, the module uses multi-threaded capture and load-balanced queue distribution to achieve real-time monitoring of 10Gb-level data streams per second.

[0121] In step S2, multidimensional features of the communication packet are extracted using a hierarchical parsing unit, employing a three-layer fusion strategy of statistical features, temporal features, and spatial features:

[0122] Statistical characteristics: Calculate the mean packet length μ, variance σ², and expected packet interval E(Δt);

[0123] Time-domain characteristics: using the autocorrelation function

[0124] Identify communication rhythm and periodicity.

[0125] R(r): Represents the autocorrelation value with lag r, used to reflect the time correlation of the signal.

[0126] N: Represents the total number of samples, i.e., the number of packets within the time window.

[0127] x i : Represents the packet length or rate at the i-th time sampling point.

[0128] : Represents the mean of all x_i, used for centering.

[0129] r: represents the time delay (lag), with the unit being the sampling period.

[0130] Spatial features: A hash signature is constructed based on the bit statistics of the header field, and the resulting feature vector is input into the feature encoding unit for normalization and dimensionality reduction.

[0131] In step S3, a combination of pre-trained model and online learning is adopted. The training process includes: supervised training on a known protocol sample set; updating the model using a pseudo-label generation algorithm on an unknown sample set; using the SACNN model for network structure, with convolutional layers capturing local features and attention layers calculating global correlations, and the output being a multi-class probability distribution; training optimization uses the Adam optimizer, with adaptive adjustment of the learning rate.

[0132] In step S4, during the recognition phase, the real-time communication stream is input into the model, and the system calculates the classification probability vector P = [p1, p2, ..., p...]. n ],

[0133] Where P is the probability distribution vector output by the model.

[0134] p i : is the predicted probability that the input communication stream belongs to the i-th protocol class.

[0135] n: The total number of all protocol categories. When the maximum probability is less than the set threshold θ, it is determined to be an unknown or mixed protocol. For encrypted or obfuscated traffic, the system further calls entropy analysis and packet sequence anomaly detection algorithms.

[0136]

[0137] The "score" refers to the implicit overall traffic score, which measures the degree of communication anomalies.

[0138] α: Entropy weighting coefficient, used to control the influence of encryption features.

[0139] β: Time fluctuation weighting coefficient, used to measure the contribution of time series anomalies to the results.

[0140] H: Load entropy value.

[0141] Δt: Variance of the time interval between private rooms.

[0142] When the score exceeds the threshold, it is marked as implicit traffic.

[0143] In step S5, the communication flow results are input into the GNN model to construct a communication graph, where each node represents a communication entity, each edge represents a session, and the node embedding vectors are updated through a message passing mechanism.

[0144]

[0145] h v (k) : The feature vector of node v in the k-th layer of the network.

[0146] N(v): The set of neighboring nodes of node v.

[0147] W (k) The weight matrix of the k-th layer.

[0148] b (k) Bias term,

[0149] σ(): Non-linear activation function

[0150] The system determines the main communication path and abnormal nodes by calculating node centrality and edge weights, thereby enabling behavior reconstruction and source tracing.

[0151] In step S6, based on the real-time recognition accuracy, the system uses an online reinforcement learning algorithm to optimize the model parameters.

[0152] The reward function is defined as:

[0153] Where R: immediate reward value, used to measure the benefit of optimizing the action.

[0154] γ: Precision enhancement weighting coefficient, used to amplify positive changes in recognition rate.

[0155] Acc: The recognition accuracy of the current model.

[0156] Acc prev The recognition accuracy of the previous iteration.

[0157] λ: Loss penalty factor, used to balance accuracy and stability.

[0158] Loss: The loss function value of the current model. The system adjusts the network parameters based on the R value to achieve self-learning and dynamic adaptation.

[0159] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or essential characteristics. Therefore, the embodiments should be considered illustrative and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the present invention. No reference numerals in the claims should be construed as limiting the scope of the claims.

[0160] Furthermore, it should be understood that although this specification describes embodiments, not every embodiment contains only one independent technical solution. This narrative style is merely for clarity. Those skilled in the art should consider the specification as a whole, and the technical solutions in each embodiment can also be appropriately combined to form other embodiments that can be understood by those skilled in the art.

Claims

1. A communication monitoring system, characterized in that: It includes a monitoring module, a feature extraction module, a dynamic recognition module, a behavior analysis module, an adaptive optimization module, and a visualization interface module; The monitoring module collects network communication data packets via mirrored ports; the feature extraction module performs layered parsing of the data packets to extract packet length, time interval, direction sequence, and encryption fingerprint features; the dynamic recognition module performs deep learning inference on the feature vectors and outputs communication type labels; the behavior analysis module constructs a communication entity relationship graph to identify and trace abnormal communication. The adaptive optimization module adjusts network parameters based on the model's accuracy feedback to achieve continuous learning.

2. A communication monitoring method, characterized in that, Specifically, it includes: S1. Data Acquisition: Acquire communication data streams through the bypass mirroring interface without interfering with normal network communication; S2. Feature Extraction: Extract multi-dimensional features from communication data, including packet length mean, delay variance, spectral energy density, and encryption identifier bits; S3. Model Recognition: The trained SACNN model is used to classify the input features and automatically identify the communication protocol type and communication direction; S4, Implicit Traffic Detection; S5. Behavior Analysis: Construct a session association graph and perform cluster analysis and path tracing on the behavior of target communication nodes; S6. Self-learning optimization: The system adjusts model parameters based on the feedback of recognition results to achieve continuous optimization and accuracy improvement.

3. The communication monitoring method and communication system according to claim 1, characterized in that: In step S1, after the monitoring is started, the real-time communication stream is obtained through the link access unit. The sampling adopts the sliding window algorithm: let the time window length be T, and data packets are collected at intervals Δt to form a set. ； W(t): Represents the set of data packets within the current time window. P i : Represents the i-th collected data packet, t i : Represents the capture timestamp of the i-th data packet, T: Represents the length of the sliding window and the sampling time interval. t: Current system clock time The system continuously samples data to ensure data continuity and time-series consistency. In addition, the module uses multi-threaded capture and load-balanced queue distribution to achieve real-time monitoring of 10Gb-level data streams per second.

4. The communication monitoring method and communication system according to claim 1, characterized in that: In step S2, multidimensional features of the communication packets are extracted using a hierarchical parsing unit, employing a three-layer fusion strategy of statistical features, temporal features, and spatial features. Statistical characteristics: Calculate the mean packet length μ, variance σ², and expected packet interval E(Δt); Time-domain characteristics: using the autocorrelation function Identify communication rhythm and periodicity. R(r): Represents the autocorrelation value with lag r, used to reflect the time correlation of the signal. N: Represents the total number of samples, i.e., the number of packets within the time window. x i : Represents the packet length or rate at the i-th time sampling point. : Represents the mean of all x_i, used for centering. r: represents the time delay (lag), with the unit being the sampling period. Spatial features: A hash signature is constructed based on the bit statistics of the header field, and the resulting feature vector is input into the feature encoding unit for normalization and dimensionality reduction.

5. The communication monitoring method and communication system according to claim 1, characterized in that: In step S3, a combination of pre-trained model and online learning is adopted. The training process includes: supervised training on a known protocol sample set; updating the model using a pseudo-label generation algorithm on an unknown sample set; using the SACNN model for network structure, with convolutional layers capturing local features and attention layers calculating global correlations, and the output being a multi-class probability distribution; training optimization uses the Adam optimizer, with adaptive adjustment of the learning rate.

6. The communication monitoring method and communication system according to claim 1, characterized in that: In step S4, during the recognition phase, the real-time communication stream is input into the model, and the system calculates the classification probability vector P = [p1, p2, ..., p...]. n ], Where P is the probability distribution vector output by the model. p i : is the predicted probability that the input communication stream belongs to the i-th protocol class. n: The total number of all protocol categories. When the maximum probability is less than the set threshold θ, it is determined to be an unknown or mixed protocol. For encrypted or obfuscated traffic, the system further calls entropy analysis and packet sequence anomaly detection algorithms. ； The "score" refers to the implicit overall traffic score, which measures the degree of communication anomalies. α: Entropy weighting coefficient, used to control the influence of encryption features. β: Time fluctuation weighting coefficient, used to measure the contribution of time series anomalies to the results. H: Load entropy value, Δt: Variance of the time interval between private rooms. When the score exceeds the threshold, it is marked as implicit traffic.

7. The communication monitoring method and communication system according to claim 1, characterized in that: In step S5, the communication flow results are input into the GNN model to construct a communication graph, where each node represents a communication entity, each edge represents a session, and the node embedding vectors are updated through a message passing mechanism. ； h v (k) : The feature vector of node v in the k-th layer of the network. N(v): The set of neighboring nodes of node v. W (k) The weight matrix of the k-th layer. b (k) Bias term, σ(): Non-linear activation function The system determines the main communication path and abnormal nodes by calculating node centrality and edge weights, thereby enabling behavior reconstruction and source tracing.

8. The communication monitoring method and communication system according to claim 1, characterized in that: In step S6, based on the real-time recognition accuracy, the system uses an online reinforcement learning algorithm to optimize the model parameters. The reward function is defined as: ; Where R: immediate reward value, used to measure the benefit of optimizing the action. γ: Precision enhancement weighting coefficient, used to amplify positive changes in recognition rate. Acc: The recognition accuracy of the current model. Acc prev The recognition accuracy of the previous iteration. λ: Loss penalty factor, used to balance accuracy and stability. Loss: The loss function value of the current model. The system adjusts the network parameters based on the R value to achieve self-learning and dynamic adaptation.

Images