Cross-border data dynamic management and control method and system based on flow analysis

Abstract

The invention discloses a cross-border data dynamic management and control method and system based on flow analysis, and relates to the technical field of data transmission, and the method comprises the following steps: encrypting a data stream image according to a Hadamard product matrix and a diagonal algorithm of a matrix vector product, carrying out the first verification of a new data stream according to an encryption verification method, and carrying out the second verification of the new data stream; and performing second verification on the new data stream according to the decryption verification method, and judging whether the new data stream is compliant or not based on the first verification result and the second verification result. According to the method, PPMI weighted co-occurrence and sliding step length minimum Hash position are used, a globally unique and sequenced natural number sequence number is generated for each byte graph, a data stream image and a random Hadamard matrix are subjected to Hadamard product, then diagonalization product is carried out, matrix vector diagonal coefficients are written in an encryption process, secondary confirmation independent of a rule base is provided, and an encryption result is obtained. The sequence number sorting space and the encryption matrix are both updated online along with flow distribution, and the corresponding encryption graph template can be quickly issued to the edge node.

Description

Technical Field

[0001] This invention relates to the field of data transmission technology, and in particular to a method and system for dynamic management and control of cross-border data based on traffic analysis. Background Technology

[0002] In recent years, with the continuous development of network technology and the increasing network bandwidth, more and more people are paying attention to network security and network service quality. Network traffic classification and identification technology, as the foundation of network management and network analysis, is one of the important areas of computer network research. Network traffic involves multiple closely related entities such as hosts, networks, applications, and users, and is a complex system concept involving multiple factors. Each network application has its own corresponding traffic behavior characteristics. With the continuous emergence of various new network applications and network application layer protocols, the complexity of network traffic is increasing, and its variable, dynamic, and heterogeneous characteristics are becoming more pronounced. In order to analyze network traffic more comprehensively and accurately, many researchers have introduced machine learning models into network traffic analysis. Among them, group size and statistical features have been proven to be effective features and have been widely used in traffic classification and identification tasks, achieving significant results.

[0003] Currently, Chinese invention patent CN119011705A discloses a cross-border data transmission system, method, and device. This method verifies the received data by setting different data compliance requirements for management devices in different locations, ensuring that the data transmitted by the device complies with the data compliance requirements of its own location, and ensuring the security and compliance of the network data environment. However, the related technology verifies the data flow characteristics by setting compliance rules, which is essentially based on feature extraction methods to judge the security of the data flow. Although it focuses on the data flow itself, making it adaptable to different types of data flows, this method requires a lot of time and is not conducive to the rapid response of cross-border data security judgment. Configuring multiple distributed audit devices and rules for different specifications, although adaptable to cross-border needs, increases the workload of equipment operation and maintenance, security monitoring, etc., which is not conducive to the efficiency of cross-border data security control and is also not conducive to the economic benefits of cross-border data management, thus having certain limitations. Summary of the Invention

[0004] The technical problem solved by this invention is that: in related technologies, data flow characteristics are verified by pre-setting compliance rules, which is essentially based on feature extraction methods to judge the security of data flows. Although this method focuses on the data flow itself and makes it applicable to different types of data flows, it is time-consuming and not conducive to rapid response to cross-border data security judgments. Configuring multiple distributed audit devices and rules for different specifications, while adaptable to cross-border needs, increases the workload of device operation and maintenance, security monitoring, etc., which is not conducive to the efficiency of cross-border data security control and also not conducive to the economic benefits of cross-border data management, thus having certain limitations.

[0005] To solve the above technical problems, the present invention provides the following technical solution. In the first aspect, a method for dynamic management and control of cross-border data based on traffic analysis includes the following steps: Step S100, constructing a byte graph based on the preprocessed data packets, converting the byte graph into a matrix, and converting the matrix into an image according to preset rules; Step S200: Based on the PPMI algorithm and the sliding step algorithm, set the sequence number of the byte graph, construct a data stream image based on the sequence number of the byte graph, encrypt the data stream image according to the Hadamard product matrix and the diagonal algorithm of matrix-vector product, decrypt the encrypted stream based on the inverse operation of the encryption process, set the encryption verification method according to the encryption process, and set the decryption verification method according to the decryption process. Step S300: Perform a first verification on the new data stream according to the encryption verification method, perform a second verification on the new data stream according to the decryption verification method, and determine whether the new data stream is compliant based on the first verification result and the second verification result.

[0006] As a preferred embodiment of the cross-border data dynamic management and control method based on traffic analysis described in this invention, step S100 includes the following sub-steps: step S101, obtaining any bidirectional data stream. Step S102: Extract the session spatiotemporal features of the bidirectional data stream. The session spatiotemporal features include session time features and session space features. Step S103: Based on the session spatiotemporal characteristics, all data packets are classified to obtain the first data packet; Step S104: Preprocess the first data packet and construct a byte graph based on the number of header bytes and payload bytes of the preprocessed first data packet; Step S105: Set color conversion rules. Based on the matrix and color conversion rules corresponding to each node of the byte graph, convert the byte graph into an image.

[0007] As a preferred embodiment of the cross-border data dynamic management and control method based on traffic analysis described in this invention, the session time feature is represented as the average interval duration of data packet transmission in any session that satisfies the first condition, and the spatial feature is the transmission path of data packet transmission in any session that satisfies the first condition. The byte diagram includes a first byte diagram and a second byte diagram. The first byte diagram includes a first-level node and a first edge. The second byte diagram includes a second-level node and a second edge. The second-level node is a child node expanded from the first-level node. The first data class is set as the first-level node, and the first data packet corresponding to the first data class is set as the second-level node corresponding to the first-level node. The image includes a first image and a second image. The first image is composed of a first byte image, and the second image is composed of a second byte image. The method for converting the byte image into an image includes a first conversion method and a second conversion method, which correspond to the first image and the second image, respectively.

[0008] As a preferred embodiment of the cross-border data dynamic management and control method based on traffic analysis described in this invention, a calculation method is configured for the session time characteristics. The calculation method includes selecting any session, calculating the time interval between adjacent data packets in chronological order, and recording it as the second duration, wherein the second duration is less than or equal to the first duration, traversing the second duration corresponding to each group of adjacent data packets in the session, calculating the average value of the second duration, and setting the average value of the second duration as the session time characteristic.

[0009] As a preferred embodiment of the cross-border data dynamic management and control method based on traffic analysis described in this invention, a setting method is configured for session space characteristics. The setting method includes: selecting any session, obtaining the source address and destination address corresponding to the session, obtaining the first address translation timestamp in the source address server log for the session time period, and extracting the second address translation timestamp in the destination address server log. The first address translation timestamp represents the timestamp corresponding to the conversion of a private IP to a public IP, and the second address translation timestamp represents the timestamp corresponding to the conversion of a public IP to a private IP. Based on the upper and lower limits of the session time, a time interval is constructed. The first and second timestamps belonging to the time interval are sorted in chronological order. The private IPs corresponding to the sorted timestamps are extracted. The position of the center point of the spatial coverage of the private IP is set as the representative position. According to the chronological order, the representative positions are connected by a directed arrow and a smooth curve to obtain a curve segment. The curve segment is set as the session space characteristic.

[0010] As a preferred embodiment of the cross-border data dynamic management and control method based on traffic analysis described in this invention, step S104 includes the following steps, including step S1041, obtaining any first data packet; Step S1042: Determine whether the first data packet has a valid payload. If a valid payload exists, proceed to step S1043. If no valid payload exists, delete the first data packet and return to step S1041 to obtain the next first data packet that is different from the original first data packet. Step S1043: Delete the Ethernet header of the first data packet and anonymize the source address, destination address, source port, and destination port. Step S1044: Traverse each first data packet and repeat steps S1041 to S1043 to complete the preprocessing of each first data packet.

[0011] As a preferred embodiment of the cross-border data dynamic management and control method based on traffic analysis described in this invention, step S105 includes the following steps: step S1051, select any node and obtain the binary code of any byte of the node. Step S1052: Count the number of characters in the binary code and compare the number of characters with 8. If the number of characters is less than 8, proceed to step S1053. If the number of characters is equal to 8, proceed to step S1054. Step S1053: Pad the binary code with 0s until the number of characters after padding is equal to 8, then stop padding and output the new binary code; Step S1054: Set the color conversion rule between color value and binary code value. The color value is distributed from 0 to 255. The color conversion rule is expressed as f(code) = a + 1, where code represents the decimal value corresponding to the binary code, a represents the color value, and f represents the color conversion rule that maps the color value to the color value. After the color conversion rule is set, jump to step S1055. Step S1055: Obtain the binary code value of any binary code, and obtain the color value corresponding to the binary code value according to the color conversion rules; Step S1056: Traverse each binary code of the node to obtain the color value corresponding to each binary code. Arrange the color values ​​in order according to the order in which the binary codes appear to form a first vector, where the first vector is represented as a vector with one row and multiple columns.

[0012] As a preferred embodiment of the cross-border data dynamic management and control method based on traffic analysis described in this invention, step S200 includes the following steps: step S201, based on the PPMI algorithm, the co-occurrence characteristics of bytes are obtained, and the co-occurrence characteristics of bytes include data packet self-characteristics and data packet association characteristics. Step S202: Based on the characteristics of the data packet itself, obtain any data packet and determine whether the data packet meets the second condition. If the data packet meets the second condition, proceed to step S203; if the data packet does not meet the second condition, proceed to step S204. Step S203: Obtain another data packet, obtain the data packet association characteristics between the data packets, and determine whether the two data packets meet the third condition. If the two data packets meet the third condition, proceed to step S205; if the two data packets do not meet the third condition, proceed to step S206. Step S204: Mark the data packet with a first mark, perform a first operation on the first-marked data packet, trace the return link of the data packet after the first operation, generate first link information, and determine whether the first mark is removed based on the first link information. If the first mark is removed, proceed to step S203. If the first mark is not removed, block the target IP address of the first-marked data packet. Step S205: Set the sequence number of the byte diagram; Step S206: Mark another data packet with a second mark, perform a second operation on the second-marked data packet, trace the return link of the data packet after the second operation, generate second link information, determine whether to add a second mark based on the second link information, and jump to step S205 when the second mark is removed; when the second mark is not removed, block the target IP address of the other data packet besides the second-marked data packet.

[0013] As a preferred embodiment of the cross-border data dynamic management and control method based on traffic analysis described in this invention, the data stream image is encrypted according to the diagonal algorithm of the Hadamard product matrix and the matrix-vector product to obtain an encrypted stream; The decryption process is the reverse of the encryption process, and the fourth timestamp is extracted from the data stream after the encryption operation for decryption. The encryption verification method is set according to the encryption process, and the decryption verification method is set according to the decryption process. The encryption verification method and the decryption verification method are verified based on the corresponding timestamp. The encryption verification method is implemented using the Lorenz chaotic equation in differential form, and the second verification is implemented based on the time interval between the decryption time point and the encryption time point; When the first verification result is "pass" and the second verification result is "pass", the new data flow is set to compliant. When the first verification result is "fail" or the second verification result is "fail", the new data flow is set to non-compliant.

[0014] Secondly, a cross-border data dynamic management and control system based on traffic analysis includes a conversion module, a calculation module, and a verification module; The conversion module constructs a byte graph based on the preprocessed data packet, converts the byte graph into a matrix, and converts the matrix into an image according to preset rules; The computation module is based on the PPMI algorithm and the sliding step algorithm. It sets the sequence number of the byte graph, constructs a data stream image based on the sequence number of the byte graph, encrypts the data stream image according to the Hadamard product matrix and the diagonal algorithm of matrix-vector multiplication, decrypts the encrypted stream based on the inverse operation of the encryption process, sets the encryption verification method according to the encryption process, and sets the decryption verification method according to the decryption process. The verification module performs a first verification on the new data stream using an encryption verification method, and a second verification on the new data stream using a decryption verification method. Based on the first verification result and the second verification result, it determines whether the new data stream is compliant.

[0015] The beneficial effects of this invention are as follows: It unifies arbitrary length and protocol payloads into fixed-size images, preserving local byte patterns while allowing direct input into models such as CNNs, enabling cross-border data classification and anomaly detection with zero manual features. Utilizing PPMI weighted co-occurrence and the minimum hash position of the sliding step, it generates globally unique and sortable natural number sequences for each byte image. The data stream image is multiplied by a random Hadamard matrix, and then the product is diagonalized. The encryption process is written into the diagonal coefficients of the matrix vector, naturally forming a publicly transmittable first verification token. No additional fields are required; only those holding the original sequence number can accurately reproduce the diagonal coefficient matrix and complete the inverse operation for decryption. The decryption failure rate directly quantifies the degree of content tampering or protocol spoofing, providing secondary confirmation independent of the rule base. The sequence number sorting space and encryption matrix are updated online according to traffic distribution. When new data leakage patterns emerge, the corresponding encrypted image template can be quickly distributed to edge nodes. Attached Figure Description

[0016] Figure 1 This is a basic flowchart illustrating a cross-border data dynamic management and control method based on traffic analysis, provided as an embodiment of the present invention. Detailed Implementation

[0017] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0018] It should be understood that the step numbers used herein are for ease of description only and are not intended to limit the order in which the steps are performed. It should also be understood that the terminology used in this specification is for the purpose of describing specific embodiments only and is not intended to limit the invention.

[0019] As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0020] The terms "comprising" and "including" indicate the presence of the described feature, whole, step, operation, element, and / or component, but do not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components, and / or collections thereof. The term “and / or” refers to any combination of one or more of the associated listed items, as well as all possible combinations, and includes these combinations.

[0021] With the development of technology, the flow of people, goods, capital, and information is moving on a large scale around the world. International cooperation in many fields such as cross-border trade, cross-border finance, and cross-border transportation is highly dependent on the cross-border flow of data. The cross-border data governance system is characterized by diversified governance objectives, multidimensional cross-border data flow, and the parallel competition of multiple governance models under the dual poles of freedom and prohibition.

[0022] Based on this, embodiments of this application provide a method and system for dynamic management and control of cross-border data based on traffic analysis, which can adapt to rapidly changing dynamic environments and improve the stability and security of task execution.

[0023] The method and system for dynamic management and control of cross-border data based on traffic analysis provided in this application are specifically described through the following embodiments. First, the method for dynamic management and control of cross-border data based on traffic analysis in this application is described.

[0024] The cross-border data dynamic management and control method based on traffic analysis provided in this application relates to the field of data transmission. This method can be applied to a terminal, a server, or software running on either a terminal or a server. In some embodiments, the terminal can be a smartphone, tablet, laptop, desktop computer, etc.; the server can be configured as an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms; the software can be an application implementing the cross-border data dynamic management and control method based on traffic analysis, but is not limited to the above forms.

[0025] This application can also be used in numerous general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics devices, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices. This application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0026] Example 1, referring to Figure 1 As an embodiment of the present invention, a method for dynamic management and control of cross-border data based on traffic analysis is provided, including the following steps: Step S100, constructing a byte graph based on the preprocessed data packets, converting the byte graph into a matrix, and converting the matrix into an image according to preset rules; Step S200: Based on the PPMI algorithm and the sliding step algorithm, set the sequence number of the byte graph, construct a data stream image based on the sequence number of the byte graph, encrypt the data stream image according to the Hadamard product matrix and the diagonal algorithm of matrix-vector product, decrypt the encrypted stream based on the inverse operation of the encryption process, set the encryption verification method according to the encryption process, and set the decryption verification method according to the decryption process. Step S300: Perform a first verification on the new data stream according to the encryption verification method, perform a second verification on the new data stream according to the decryption verification method, and determine whether the new data stream is compliant based on the first verification result and the second verification result.

[0027] More preferably, the application scenario of this application is cross-border traffic transmission, which is characterized by continuity, unclear patterns, large data base, and vulnerability to attacks. Directly extracting flow features would consume a lot of time, and the control of flow features is not precise enough, which can easily lead to handshakes being confused by malicious data. Therefore, this application eliminates the step-by-step feature construction process from data packets to sessions to data streams. It can quickly map the features of data streams based on data packets from which features are easy to extract. While reducing feature extraction time, it significantly improves the accuracy of control over flow features. At the same time, it also greatly reduces the probability of handshakes by malicious data, and improves the speed, security, and accuracy of data stream management. Compared with the prior art, it has significant progress.

[0028] More preferably, arbitrary length and protocol payloads are unified into fixed-size images, preserving local byte patterns while allowing direct input into models such as CNNs. This enables cross-border data classification and anomaly detection with zero manual features. Utilizing PPMI weighted co-occurrence and sliding step minimum hash position, a globally unique and sortable natural number sequence number is generated for each byte image. The data stream image is multiplied by a random Hadamard matrix, and then the product is diagonalized. The encryption process is written into the diagonal coefficients of the matrix vector, naturally forming a publicly transmittable first verification token. No additional fields are required; only those holding the original sequence number can accurately reproduce the diagonal coefficient matrix and complete the inverse operation for decryption. The decryption failure rate directly quantifies the degree of content tampering or protocol spoofing, providing a secondary confirmation independent of the rule base. Both the sequence number sorting space and the encryption matrix are updated online according to traffic distribution. When a new data leakage mode appears, the corresponding encrypted image template can be quickly distributed to edge nodes.

[0029] Step S100 includes the following sub-steps: Step S101, obtain any bidirectional data stream; Step S102: Extract the session spatiotemporal features of the bidirectional data stream. The session spatiotemporal features include session time features and session space features. Step S103: Based on the session spatiotemporal characteristics, all data packets are classified to obtain the first data packet; Step S104: Preprocess the first data packet and construct a byte graph based on the number of header bytes and payload bytes of the preprocessed first data packet; Step S105: Set color conversion rules. Based on the matrix and color conversion rules corresponding to each node of the byte graph, convert the byte graph into an image.

[0030] More preferably, this application only mentions bidirectional data streams, but it is also applicable to unidirectional data streams, by setting all elements of the matrix corresponding to the data stream returned by the receiving end to 0.

[0031] More preferably, for step S102, the first condition means that the time interval between adjacent data packets is less than or equal to a first duration, and all parameters of the data packets are the same. The parameters of the data packets include source address, source port, destination address, transport layer protocol, and destination port. The port that sends the data packet is the source port, and the port that receives the data packet is the receiving port. It does not specifically distinguish whether the data packet is transmitted out or transmitted back, which simplifies the analysis steps of bidirectional data flow. There may be multiple forwarding steps between the source port and the destination port, that is, through multiple intermediate ports. When there are forwarding steps, the port that sends each time is called the source port, and the corresponding receiving port is called the destination port.

[0032] The session time feature is represented by the average interval duration of data packet transmission in any session that satisfies the first condition, and the spatial feature is the transmission path of data packet transmission in any session that satisfies the first condition.

[0033] More preferably, according to the time sequence, the set of data packets that meet the first condition is classified into sessions, and the time interval between data packets at each adjacent time is traversed to complete the session division process. A session is represented as a combination of data packets that are sent irregularly and continuously in time sequence.

[0034] More preferably, sessions with identical data packet parameters are categorized into data streams according to their chronological order.

[0035] More preferably, a calculation method is configured for the session time feature. The calculation method includes selecting any session, calculating the time interval between adjacent data packets in chronological order, and recording it as the second duration, wherein the second duration is less than or equal to the first duration, traversing the second duration corresponding to each group of adjacent data packets in the session, calculating the average value of the second duration, and setting the average value of the second duration as the session time feature.

[0036] Further preferably, a setting method is configured for the session space characteristics. The setting method includes: selecting any session, obtaining the source address and destination address corresponding to the session, obtaining the first address translation timestamp in the source address server log for the session time period, and extracting the second address translation timestamp in the destination address server log. The first address translation timestamp represents the timestamp corresponding to the conversion of the private IP to the public IP, and the second address translation timestamp represents the timestamp corresponding to the conversion of the public IP to the private IP. Based on the upper and lower limits of the session time, a time interval is constructed. The first and second timestamps belonging to the time interval are sorted in chronological order. The private IPs corresponding to the sorted timestamps are extracted. The position of the center point of the spatial coverage of the private IP is set as the representative position. According to the chronological order, the representative positions are connected by a directed arrow and a smooth curve to obtain a curve segment. The curve segment is set as the session space characteristic.

[0037] More preferably, the location is represented as the center point of the geographic space covered by the private IP, based on the longitude and latitude coordinates of GPS, and the center point is represented as the geometric center point; Smoothness is defined as the constructed curve being continuous and differentiable at any point. For smooth curves, a drawing method is configured. The drawing method includes interpolating between adjacent positions according to the least squares method to obtain each filling position, which is the interpolation point. The filling positions are then connected. During the connection process, if a point that is not on the smooth curve appears, the corresponding point is deleted to obtain the smooth curve.

[0038] More preferably, for the first data packet, a classification method is configured, including: obtaining any two data packets and recording them as the first control group; obtaining the session time feature and session space feature corresponding to the first control group; calculating the first difference of the session time feature and taking the absolute value of the first difference; and calculating the cosine similarity of the session space feature using the cosine similarity formula according to the same data packet operation order. Set the first value as the difference threshold, set the second value as the similarity threshold, compare the absolute value of the first difference with the first value, and compare the cosine similarity with the second value; When the absolute value of the first difference is greater than or equal to the first value, and the cosine similarity is greater than or equal to the second value, the first control group is classified as the first data packet; When the absolute value of the first difference is less than the first value, or the cosine similarity is less than the second value, the process will jump to the next first control group and repeat the comparison process until all data packets are divided, each first data packet is obtained, and the classification process of the first data packets is completed.

[0039] More preferably, step S104 includes the following steps: step S1041, obtaining any first data packet; Step S1042: Determine whether the first data packet has a valid payload. If a valid payload exists, proceed to step S1043. If no valid payload exists, delete the first data packet and return to step S1041 to obtain the next first data packet that is different from the original first data packet. Step S1043: Delete the Ethernet header of the first data packet and anonymize the source address, destination address, source port, and destination port. Step S1044: Traverse each first data packet and repeat steps S1041 to S1043 to complete the preprocessing of each first data packet.

[0040] More preferably, for the payload, an identification method is configured, including: opening network analysis software (Wireshark), capturing network data packets, selecting any first data packet, double-clicking the first data packet, opening a details window, expanding the protocol layer structure in the details window, and finding the payload part of the first data packet. When the payload part shows the contents of the payload, the identification result is set to the presence of a payload; when the payload part does not show the contents of the payload, the identification result is set to the absence of a payload.

[0041] More preferably, anonymization processing is performed on the source address, destination address, source port, and destination port. The technical means to achieve this include, but are not limited to, existing technical means such as hash algorithms (SHA-256), prefix-keeping hash (Crypto-PAn), symmetric encryption (AES), random mapping tables, truncation or generalization (24 subnet mask), etc., which will not be elaborated here.

[0042] The byte diagram includes a first byte diagram and a second byte diagram. The first byte diagram includes a first-level node and a first edge. The second byte diagram includes a second-level node and a second edge. The second-level node is a child node expanded from the first-level node. The first data class is set as the first-level node, and the first data packet corresponding to the first data class is set as the second-level node corresponding to the first-level node.

[0043] More preferably, the first sum of the header bytes and payload bytes is calculated, the first sum corresponding to each first data packet is traversed, and the first sums with the same value are set as the first data class. The first data classes are numbered in ascending order of the first sum, and the number of the first data class is represented as X. i Where i is a natural number, jump to any first data class, obtain the first timestamp or second timestamp corresponding to the first data packet in the first data class, and number the first data packets in the first data class according to the time order. The number of the first data packet is X. ij , where j is a natural number.

[0044] More preferably, the first-level nodes are connected by straight line segments in the order of i, wherein the straight line segment connecting any two first-level nodes is named the first side, and the first side is numbered based on the first-level nodes at its endpoints, and the first side is numbered as X. i-1 X i , where i is greater than or equal to 2.

[0045] More preferably, the secondary nodes are connected by straight line segments in the order of j. The straight line segment connecting any two secondary nodes is named the second side. The second side is numbered based on the secondary nodes at its endpoints, and the second side is numbered as X. ij-1 X ij , where j is greater than or equal to 2.

[0046] More preferably, a first-byte graph is constructed based on first-level nodes and first edges, and a second-byte graph is constructed based on second-level nodes and second edges, wherein the first-byte graph and the second-byte graph are both represented as corresponding nodes, corresponding edges, and connections between corresponding nodes.

[0047] More preferably, since 1 byte equals 8 bits, one byte contains 2... 8There are 256 different ways to represent values, that is, the distribution of binary encoded values ​​from 1 to 256.

[0048] More preferably, step S105 includes the following steps: step S1051, select any node and obtain the binary code of any byte of the node; Step S1052: Count the number of characters in the binary code and compare the number of characters with 8. If the number of characters is less than 8, proceed to step S1053. If the number of characters is equal to 8, proceed to step S1054. Step S1053: Pad the binary code with 0s until the number of characters after padding is equal to 8, then stop padding and output the new binary code; Step S1054: Set the color conversion rule between color value and binary code value. The color value is distributed from 0 to 255. The color conversion rule is expressed as f(code) = a + 1, where code represents the decimal value corresponding to the binary code, a represents the color value, and f represents the color conversion rule that maps the color value to the color value. After the color conversion rule is set, jump to step S1055. Step S1055: Obtain the binary code value of any binary code, and obtain the color value corresponding to the binary code value according to the color conversion rules; Step S1056: Traverse each binary code of the node to obtain the color value corresponding to each binary code. Arrange the color values ​​in order according to the order in which the binary codes appear to form a first vector, where the first vector is represented as a vector with one row and multiple columns.

[0049] More preferably, the node is represented as a first-level node or a second-level node. When the node is represented as a first-level node, the order in which the binary codes appear is represented by the order of the i values ​​of the corresponding nodes. When the node is a second-level node, the order in which the binary codes appear is represented by the order of the j values ​​of the binary codes.

[0050] The image includes a first image and a second image. The first image is composed of a first byte image, and the second image is composed of a second byte image. The method for converting the byte image into an image includes a first conversion method and a second conversion method, which correspond to the first image and the second image, respectively.

[0051] More preferably, the conversion methods for the first image and the second image are logically the same, including: superimposing each first vector in the byte image according to the numbering order of the byte image; standardizing the superposition result to obtain a matrix; the matrix and pixels have a representation relationship; and converting the matrix into an image according to the representation relationship between the matrix and pixels. Here, superimposing the first vectors of the byte image means superimposing the first vectors corresponding to the first-level nodes, or superimposing the first vectors corresponding to the second-level nodes, but does not mean superimposing the first vectors corresponding to the first-level nodes and the first vectors corresponding to the second-level nodes.

[0052] More preferably, the representation of the relationship includes that the position of each element in the matrix is ​​represented as a pixel position, and the color value of each element in the matrix is ​​represented as a pixel color value.

[0053] More preferably, the superposition of the first vectors is represented by unifying each first vector to the same length, and using the first vectors of the same length as each row.

[0054] More preferably, the method for unifying each first vector to the same length includes: selecting any first vector, counting the number of columns of the first vector, traversing the number of columns of each first vector, sorting the number of columns of the first vector in descending order, selecting the column with the largest value, and setting the column with the largest value as the reference column. Compare the number of columns of any first vector with the number of columns of a reference vector. If the number of columns of the first vector is less than the number of columns of the reference vector, pad the end of the first vector with zeros. Stop padding the end of the first vector with zeros when the number of columns of the first vector equals the number of columns of the reference vector, and jump to the next first vector. Repeat the process of comparing the number of columns of the first vector with the number of columns of the reference vector. When the number of columns in the first vector equals the number of columns in the reference vector, jump to the next first vector and repeat the comparison process between the number of columns in the first vector and the number of columns in the reference vector until all the first vectors have been traversed, thus completing the superposition process.

[0055] Step S200 includes the following steps: Step S201, based on the PPMI algorithm, obtain the co-occurrence features of bytes, including the data packet's own features and the data packet's association features; Step S202: Based on the characteristics of the data packet itself, obtain any data packet and determine whether the data packet meets the second condition. If the data packet meets the second condition, proceed to step S203; if the data packet does not meet the second condition, proceed to step S204. Step S203: Obtain another data packet, obtain the data packet association characteristics between the data packets, and determine whether the two data packets meet the third condition. If the two data packets meet the third condition, proceed to step S205; if the two data packets do not meet the third condition, proceed to step S206. Step S204: Mark the data packet with a first mark, perform a first operation on the first-marked data packet, trace the return link of the data packet after the first operation, generate first link information, and determine whether the first mark is removed based on the first link information. If the first mark is removed, proceed to step S203. If the first mark is not removed, block the target IP address of the first-marked data packet. Step S205: Set the sequence number of the byte diagram; Step S206: Mark another data packet with a second mark, perform a second operation on the second-marked data packet, trace the return link of the data packet after the second operation, generate second link information, determine whether to add a second mark based on the second link information, and jump to step S205 when the second mark is removed; when the second mark is not removed, block the target IP address of the other data packet besides the second-marked data packet.

[0056] More preferably, since the byte graphs corresponding to each data packet are numbered according to the number of bytes or the order in which the bytes appear, the byte graphs are essentially unordered graphs. Therefore, introducing the PPMI algorithm can effectively preserve the co-occurrence characteristics of bytes.

[0057] The method for obtaining the data packet's own characteristics includes obtaining the checksum, Euclidean distance between the mobile link and the byte center, and transmission speed of any data packet; obtaining the content deviation of the data packet based on the checksum; obtaining the distance deviation of the data packet based on the Euclidean distance between the mobile link and the byte center; obtaining the speed deviation of the data packet based on the transmission speed; and obtaining the data packet's own anomaly degree based on the content deviation, distance deviation, and speed deviation. The self-anomaly degree is the data packet's own characteristic.

[0058] More preferably, the mobile link is represented as the movement trajectory of the data packet from the source node to the current time point. The movement trajectory is obtained based on the session space characteristics of the session to which the data packet belongs. The session space characteristics of the session to which the data packet belongs are obtained, and the curvature center position of the session space characteristics is obtained. The curvature center position is calculated by the curvature center coordinate formula.

[0059] More preferably, the formula for the center of curvature coordinates includes, m = n= , where m and n are the x and y coordinates of the curvature center position, respectively; y' is the value of the expression obtained by taking the first derivative of the conversation space feature at the curvature center position; c1 and c2 are the x and y coordinates of any point selected on the conversation space feature, i.e., c1 and c2 are known constants; and y'' is the value of the expression obtained by taking the second derivative of the conversation space feature at the curvature center position.

[0060] More preferably, the position of the center of curvature is represented by coordinates in the WEB Mercator coordinate system. Before calculating the formula for the coordinates of the center of curvature, the latitude and longitude position expression is converted into the WEB Mercator coordinate expression based on Excel VBA programming.

[0061] More preferably, the method for converting the location representation of latitude and longitude into the representation of Web Mercator coordinates includes setting latitude and longitude as input values, setting Web Mercator coordinates as output values, calling a VBA function, inputting the conversion code between latitude and longitude and Web Mercator coordinates into the input of the VBA function, wherein the conversion code is existing technology and will not be described in detail here, and obtaining the x-axis coordinates and y-axis coordinates of any location represented by latitude and longitude in Web Mercator coordinates.

[0062] A calculation method is configured for the Euclidean distance between the mobile link and the byte center. Since the Euclidean distance between the mobile link and the byte center is also a sub-step of step S202, it includes step S2021, obtaining the curvature center position. Step S2022: Set the curvature center position as the representative coordinates corresponding to the mobile link, obtain the session where the data packet is located, obtain the curvature center position corresponding to each data packet in the session, and record it as the first position; Step S2023: Select any two first positions, and select the midpoint of the two first positions according to the midpoint selection method; Step S2024: Delete the two first positions and insert the midpoint of the first position into the sequence of the curvature center positions corresponding to the remaining data packets to obtain the first sequence. The positions of the elements in the first sequence can be arbitrarily interchanged and there is no order. After the first sequence is constructed, jump to step S2023. Step S2025: Repeat steps S2023 to S2024 until only one value remains in the first sequence. Set the remaining value as the Euclidean distance between the mobile link and the byte center.

[0063] More preferably, when the original number of data packets is even, the number of original data packets is represented as 2k. After one midpoint calculation, a midpoint is inserted and two original data packets are deleted. The number of data in the first sequence is represented as (2k-2)+1. After t calculations, t midpoints are inserted and 2t original data packets are deleted. The number of data in the first sequence is represented as (2k-2t)+t. Since k and t are both integers, when t=2k-1, there is a case where the number of data in the first sequence is 1. When the original number of data packets is odd, the number of original data packets is set to 2k-1. After one midpoint calculation, a midpoint is inserted and two original data packets are deleted. The number of data in the first sequence is represented as (2k-1-2)+1. After t calculations, t midpoints are inserted and 2t original data packets are deleted. The number of data in the first sequence is represented as (2k-1-2t)+t. Since k and t are both integers, when t=2k-2, there is a case where the number of data in the first sequence is 1.

[0064] More preferably, the Euclidean distance is calculated using the Euclidean distance formula.

[0065] More preferably, the method for calculating the content deviation includes setting the third value as the checksum threshold, obtaining the checksum, calculating the ratio of the checksum to the checksum threshold, and setting the ratio of the checksum to the checksum threshold as the content deviation. Since the checksum is less than or equal to the third value, the ratio of the checksum to the checksum threshold is distributed in the first closed and second open interval between 0 and 1. The larger the content deviation value, the greater the verification accuracy.

[0066] More preferably, the method for calculating the distance deviation includes setting a fourth value as a distance threshold, obtaining the Euclidean distance between the mobile link and the byte center, calculating the difference between the Euclidean distance between the mobile link and the byte center and the fourth value, selecting the absolute value of the difference between the Euclidean distance between the mobile link and the byte center and the fourth value, and recording it as the first absolute value, calculating the ratio of the first absolute value to the Euclidean distance between the mobile link and the byte center, and setting the ratio of the first absolute value to the Euclidean distance between the mobile link and the byte center as the distance deviation. The distance deviation is distributed in a double-closed interval from 0 to 1. The larger the distance deviation value, the smaller the distance accuracy.

[0067] More preferably, the method for calculating the speed deviation includes setting the fifth value as the speed threshold, obtaining the transmission speed, calculating the difference between the transmission speed and the fifth value, selecting the absolute value of the difference between the transmission speed and the fifth value as the second absolute value, calculating the ratio of the second absolute value to the fifth value, and setting the ratio of the second absolute value to the fifth value as the speed deviation. The speed deviation is distributed in a double-closed interval from 0 to 1. The larger the speed deviation value, the smaller the transmission speed accuracy.

[0068] More preferably, the method for calculating the self-abnormality includes selecting a negative number of the content deviation, calculating the sum of the negative number of the content deviation, the speed deviation, and the distance deviation, and recording it as the self-abnormality.

[0069] The method for obtaining data packet association features includes obtaining the Euclidean distance between the mobile link and the byte center, the transmission speed, and the source IP address of two data packets; calculating the second difference between the Euclidean distance between the mobile link and the byte center and the distance threshold, and taking the absolute value of the second difference; calculating the third difference between the data packet transmission speed and the speed threshold, and taking the absolute value of the third difference; and calculating the fourth difference between the source IP address and the reference IP address of the data packet, and taking the absolute value of the fourth difference. Calculate the first ratio of the absolute value of the second difference to the absolute value of the third difference, and calculate the second ratio of the absolute value of the fourth difference to the absolute value of the third difference. Calculate the third ratio of the second ratio to the first ratio, and set the third ratio as the calculation parameter for the corresponding data packet. Retrieve the formula for calculating the mutual information of the data packet, substitute the calculation parameters of the data packet into the formula to obtain the formula result, and set the formula result as the data packet association feature.

[0070] More preferably, the formula for calculating the point mutual information is PPMI(b1, b2) = MAX( ), where b1 represents the calculation parameter of one data packet, b2 represents the calculation parameter of another data packet, P(b1) represents the marginal probability of b1, P(b2) represents the marginal probability of b2, and P(b1, b2) represents the joint probability of b1 and b2.

[0071] More preferably, when P(b1, b2) is 0, the PPMI result is 0.

[0072] More preferably, since the calculation method of the calculation parameters in this application takes the absolute value for the numerical results, when calculating the data packet and distance threshold, or the data packet and speed threshold, or the data packet and reference standard IP address, the order of the subtrahend and minuend is not required.

[0073] More preferably, the calculation method for the fourth difference between the source IP address and the reference IP address of the data packet includes converting both the source IP address and the reference IP address into binary codes, converting both binary codes into decimal codes, calculating the difference between the decimal code corresponding to the source IP address and the decimal code corresponding to the reference IP address, and recording it as the fourth difference.

[0074] More preferably, the second condition is expressed as follows: its own anomaly degree is less than or equal to the first anomaly degree, where the first anomaly degree is a preset constant.

[0075] More preferably, the third condition is expressed as the data packet association feature being greater than or equal to the first relevance, where the first relevance is a preset constant.

[0076] More preferably, the first marker indicates that a custom HTTP header is inserted into the header of the data packet. The custom HTTP header includes the word "High", indicating that the data packet belongs to a high-risk data packet. The first operation indicates that the hash value corresponding to the data packet is changed continuously to obtain multiple new data packets. The multiple new data packets are sent to the target IP address, and the original data packet is sent to the virtual IP address.

[0077] More preferably, the backhaul link is represented as a mobile link through which multiple new data packets are transmitted in reverse, denoted as the first link information.

[0078] More preferably, the method for determining whether the first mark is eliminated includes: obtaining the target IP address of the first link information, converting each target IP address into binary code, setting the binary code to decimal code, calculating the difference between any two decimal codes, traversing the differences of each group of decimal codes, calculating the first average value of the differences of the decimal codes, setting the sixth value as the first average value threshold, comparing the first average value with the sixth value, and eliminating the first mark when the first average value is less than or equal to the sixth value, and not eliminating the first mark when the first average value is greater than the sixth value.

[0079] More preferably, the second marker indicates that a custom HTTP header is inserted into the packet header. The custom HTTP header includes the word NOT, indicating that the packet belongs to a high-risk packet. Since packets in the same session are consistent in at least some characteristics, however, the packets marked with the second marker are not related, so one of the two packets belongs to a high-risk packet.

[0080] More preferably, the second operation is to continuously change the hash value corresponding to the data packet to obtain multiple new data packets, send the multiple new data packets to the target IP address, and send the original data packet to the virtual IP address. Here, the data packet can be either of the two data packets, and performing the second operation on the two data packets is a synchronous parallel relationship.

[0081] More preferably, the second link information includes the mobile links corresponding to the two data packets, so the second link information is essentially the superposition of the two first link information.

[0082] More preferably, the method for determining whether the second mark has been added includes: obtaining the data packet that performs its own anomaly degree calculation first, denoted as the front data packet, setting another data packet as the back data packet, and first judging the back data packet according to the method for whether the first mark has been eliminated; When the first tag corresponding to the subsequent data packet is removed, the first tag is added to the previous data packet, and the first tag of the previous data packet is set to the second tag; If the first tag corresponding to a subsequent data packet is not eliminated, the first tag of the subsequent data packet is renamed to the second tag.

[0083] Delete the data packets with the first tag and delete the data packets with the second tag, and represent the remaining data packets as the data packets to be encrypted.

[0084] Select any data packet to be encrypted, and calculate the payload sliding step size of the data packet based on the sliding step algorithm. The calculation expression for the sliding step algorithm is as follows: ; Among them, W p Let p be the size of the payload sliding window for the p-th data packet to be encrypted. Given a constant, distributed within a double-open interval from 0 to 1, MAX represents selecting the maximum of the two values, Len... payload Expressed as payload bytes, Len header Represented as the number of bytes in the packet header, W h The expected value of the header bytes is a constant.

[0085] The sequence number of the byte graph is set based on the sliding step algorithm.

[0086] Based on the load sliding step size, the sequence number of the byte graph is set. This includes sliding the load of the data packets according to the load sliding step size, calculating the position of the first hash value in all sliding windows in the load, and the position of the first hash value is represented by the position of the corresponding sliding window in the load. Since the data packets have been standardized before constructing the image, the positions of the first hash values ​​of each data packet can be compared horizontally.

[0087] More preferably, the positions of the first hash value are sorted in order from front to back, the node number corresponding to the sorted data packet is obtained, and the label of the node number is set. The label of the node number is the sequence number of the positions of the first hash value in order from front to back, which is a natural number. The label of the node number is the sequence number of the byte graph.

[0088] More preferably, the expression for the first hash value is Hash=m1 key L +m2 (m1 and m2 are constants), where Hash is the first hash value, and key L This represents the access dynamic value of the corresponding load portion during the Lth slide. The access dynamic value is represented as a random value sent via the access permission terminal. The random value dynamically generated by the access permission terminal ensures that the key is used in each communication. LThe uniqueness of the hash value is enhanced, thus increasing its unpredictability. Therefore, when constructing the byte graph, the position of the first hash value in each sliding window is mapped to the connection relationship of the graph nodes, forming a directed graph structure with temporal characteristics.

[0089] Construct a data flow image based on the byte graph sequence number and the corresponding image; More preferably, at the first moment, each image corresponding to the sequence number of the byte diagram in the session is retrieved, and the data stream images are horizontally stitched together according to the byte sequence number to obtain the session image at the first moment; At the second moment, retrieve the images corresponding to the sequence numbers of the byte diagram in the session, and stitch the data stream images horizontally according to the byte sequence numbers to obtain the session image at the second moment; Repeat the above process until all time points within the entire data stream cycle are covered to obtain a data stream image; The conversation image at time S and the conversation image at time S are respectively represented as matrix S, where S is a natural number and the elements of matrix S are the color values ​​of pixels. The data stream image is encrypted using the diagonal algorithm of the Hadamard product matrix and matrix-vector product to obtain an encrypted stream.

[0090] More preferably, the S-th matrix and the (S+1)-th matrix are set to have the same number of rows, and the S-th matrix and the (S+1)-th matrix are set to have the same number of columns. The setting method includes filling any missing rows or columns with 0.

[0091] More preferably, the calculation of the Hadamard product is expressed as follows: ,in, Let a be the Hadamard product of the S-th matrix and the (S+1)-th matrix. mn Let b be the element in the m-th row and n-th column of the S-th matrix. mn Let be the element in the m-th row and n-th column of the (S+1)-th matrix.

[0092] Methods for obtaining the encrypted stream include invoking the diagonal algorithm for matrix-vector multiplication, expressed as w=A. n×n ν, where A n×n It is an n×n matrix, vector v is an n×1 vector, w is the output result, w is also a vector, and matrix A is an n×n matrix. n×n The diagonal elements are defined as d i =a 0,i ,a 0,i+1 , ,a n-1,i-1 In this context, i is greater than or equal to 0 and less than n. In diagonal calculation, i is the representation of the element index, which can be replaced by any other letter and is different from i in the node number.

[0093] w= d i × (v << i); Where, v << i represents rotating the vector v by i positions; Obtain the S matrix. When the number of rows of the S matrix is less than or equal to the number of columns, fill the S matrix with zeros to expand it into a square matrix A' with the maximum number of rows or the maximum number of columns. Among them, selecting the maximum number of rows or the maximum number of columns follows the expression max(m, n); According to the diagonal algorithm of matrix-vector multiplication, decompose the square matrix A' into diagonal single-dimensional vectors. The diagonal single-dimensional vectors are respectively multiplied with v T << i to obtain the Hadamard product, T is the transpose symbol, and accumulate to get w T , transpose w T to calculate, get w, and remove the elements in the max(m, n)-th column; When the number of rows of the S matrix is greater than the number of columns, fill the S matrix with zeros to expand it into a square matrix A' with the maximum number of rows or the maximum number of columns. Among them, selecting the maximum number of rows or the maximum number of columns follows the expression max(m, n); According to the diagonal algorithm of matrix-vector multiplication, decompose the square matrix A' into diagonal single-dimensional vectors. Expand the vector v T in a value-looping manner to a vector with the number of rows equal to the maximum value max(m, n). The diagonal single-dimensional vectors are respectively multiplied with v T << i to obtain the Hadamard product, T is the transpose symbol, and accumulate to get w T , transpose w T to calculate, get w, and remove the elements in the max(m, n)-th column.

[0094] Recalculate the Hadamard product of the transformed S matrix and the transformed S + 1 matrix, and set the Hadamard product as the key of the S matrix; Traverse the keys of each matrix, arrange and combine the keys according to the A permutation group to obtain each combination result. Randomly send one result as the key of the current data stream, and remove the key in the permutation and combination, and extract the third timestamp of the key sent for the current data stream.

[0095] Further preferably, name the encrypted data stream as the encrypted stream.

[0096] The decryption process is the reverse process of the encryption process, and extract the fourth timestamp for decrypting the data stream after the encryption operation.

[0097] Set the encryption verification method according to the encryption process, set the decryption verification method according to the decryption process, and the encryption verification method and the decryption verification method are verified based on the corresponding timestamps.

[0098] Further preferably, the encryption verification method includes: calculating the amplitude of the time interval between the fourth timestamps, setting the amplitude of the time interval between the fourth timestamps as an x-axis parameter, calculating the variance of the time interval between the fourth timestamps, setting the variance of the time interval between the fourth timestamps as a y-axis parameter, setting the standard deviation of the time interval between the fourth timestamps as a z-axis parameter, and setting the x-axis parameter, y-axis parameter, and z-axis parameter as variables, wherein the amplitude of the time interval between the fourth timestamps, the variance of the time interval between the fourth timestamps, and the time interval between the fourth timestamps are fitted to a nonlinear space curve equation; Construct the Lorenz chaotic equation to obtain the differential form of the Lorenz chaotic equation; Set initial constant parameters and initial coordinates, obtain the phase space diagram corresponding to the Lorenz chaotic equation, and the Lipnoff exponent of the phase space diagram corresponding to the Lorenz chaotic equation. With the goal of maximizing the Lipnoff exponent value, adjust the initial constant parameters to obtain the optimal constant. Based on the optimal constant, obtain the final differential form of the Lorenz chaotic equation. The x-axis, y-axis, and z-axis parameters corresponding to the new data stream are substituted into the Lorenz chaotic equation to determine whether the new data stream is distributed in the phase space graph corresponding to the Lorenz chaotic equation. If the new data stream is distributed in the phase space graph corresponding to the Lorenz chaotic equation, the first verification result is set as the first pass; if the new data stream is not distributed in the phase space graph corresponding to the Lorenz chaotic equation, the first verification result is set as the first fail.

[0099] More preferably, the decryption verification method includes: calculating the interval between the fourth timestamp and the third timestamp; setting the third time as a time threshold; comparing the interval with the third time; setting the second verification result as second pass when the interval is less than or equal to the third time; and setting the second verification result as second fail when the interval is greater than the third time.

[0100] When the first verification result is "pass" and the second verification result is "pass", the new data flow is set to compliant. When the first verification result is "fail" or the second verification result is "fail", the new data flow is set to non-compliant.

[0101] More preferably, arbitrary length and protocol payloads are unified into fixed-size images, preserving local byte patterns while allowing direct input into models such as CNNs. This enables cross-border data classification and anomaly detection with zero manual features. Utilizing PPMI weighted co-occurrence and sliding step minimum hash position, a globally unique and sortable natural number sequence number is generated for each byte image. The data stream image is multiplied by a random Hadamard matrix, and then the product is diagonalized. The encryption process is written into the diagonal coefficients of the matrix vector, naturally forming a publicly transmittable first verification token. No additional fields are required; only those holding the original sequence number can accurately reproduce the diagonal coefficient matrix and complete the inverse operation for decryption. The decryption failure rate directly quantifies the degree of content tampering or protocol spoofing, providing a secondary confirmation independent of the rule base. Both the sequence number sorting space and the encryption matrix are updated online according to traffic distribution. When a new data leakage mode appears, the corresponding encrypted image template can be quickly distributed to edge nodes.

[0102] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product implemented on one or more computer-usable storage media containing computer-usable program code. The storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read-Only Memory (EPROM), Programmable Red-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0103] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for dynamic management and control of cross-border data based on traffic analysis, characterized in that, The steps include: Step S100, constructing a byte graph based on the preprocessed data packet, converting the byte graph into a matrix, and converting the matrix into an image according to preset rules; Step S200: Based on the PPMI algorithm and the sliding step algorithm, set the sequence number of the byte graph, construct a data stream image based on the sequence number of the byte graph, encrypt the data stream image according to the Hadamard product matrix and the diagonal algorithm of matrix-vector product, decrypt the encrypted stream based on the inverse operation of the encryption process, set the encryption verification method according to the encryption process, and set the decryption verification method according to the decryption process. Step S300: Perform a first verification on the new data stream according to the encryption verification method, perform a second verification on the new data stream according to the decryption verification method, and determine whether the new data stream is compliant based on the first verification result and the second verification result.

2. The method for dynamic management and control of cross-border data based on flow analysis as described in claim 1, characterized in that, Step S100 includes the following sub-steps: Step S101, obtain any bidirectional data stream; Step S102: Extract the session spatiotemporal features of the bidirectional data stream. The session spatiotemporal features include session time features and session space features. Step S103: Based on the session spatiotemporal characteristics, all data packets are classified to obtain the first data packet; Step S104: Preprocess the first data packet and construct a byte graph based on the number of header bytes and payload bytes of the preprocessed first data packet; Step S105: Set color conversion rules. Based on the matrix and color conversion rules corresponding to each node of the byte graph, convert the byte graph into an image.

3. The method for dynamic management and control of cross-border data based on flow analysis as described in claim 2, characterized in that, The session time feature is represented by the average interval duration of data packet transmission in any session that satisfies the first condition, and the spatial feature is the transmission path of data packet transmission in any session that satisfies the first condition. The byte diagram includes a first byte diagram and a second byte diagram. The first byte diagram includes a first-level node and a first edge. The second byte diagram includes a second-level node and a second edge. The second-level node is a child node expanded from the first-level node. The first data class is set as the first-level node, and the first data packet corresponding to the first data class is set as the second-level node corresponding to the first-level node. The image includes a first image and a second image. The first image is composed of a first byte image, and the second image is composed of a second byte image. The method for converting the byte image into an image includes a first conversion method and a second conversion method, which correspond to the first image and the second image, respectively.

4. The method for dynamic management and control of cross-border data based on flow analysis as described in claim 3, characterized in that, A calculation method is configured for the session time feature. The calculation method includes selecting any session, calculating the time interval between adjacent data packets in chronological order, and recording it as the second duration. The second duration is less than or equal to the first duration. The second duration is traversed for each group of adjacent data packets in the session, and the average value of the second duration is calculated. The average value of the second duration is set as the session time feature.

5. The method for dynamic management and control of cross-border data based on flow analysis as described in claim 3, characterized in that, For session space characteristics, a configuration method is provided. The configuration method includes selecting any session, obtaining the source address and destination address corresponding to the session, obtaining the first address translation timestamp from the source address server log for the session time period, and extracting the second address translation timestamp from the destination address server log. The first address translation timestamp represents the timestamp corresponding to the conversion of a private IP to a public IP, and the second address translation timestamp represents the timestamp corresponding to the conversion of a public IP to a private IP. Based on the upper and lower limits of the session time, a time interval is constructed. The first and second timestamps belonging to the time interval are sorted in chronological order. The private IPs corresponding to the sorted timestamps are extracted. The position of the center point of the spatial coverage of the private IP is set as the representative position. According to the chronological order, the representative positions are connected by a directed arrow and a smooth curve to obtain a curve segment. The curve segment is set as the session space characteristic.

6. The method for dynamic management and control of cross-border data based on flow analysis as described in claim 1, characterized in that, Step S104 includes the following steps, including step S1041, obtaining any first data packet; Step S1042: Determine whether the first data packet has a valid payload. If a valid payload exists, proceed to step S1043. If no valid payload exists, delete the first data packet and return to step S1041 to obtain the next first data packet that is different from the original first data packet. Step S1043: Delete the Ethernet header of the first data packet and anonymize the source address, destination address, source port, and destination port. Step S1044: Traverse each first data packet and repeat steps S1041 to S1043 to complete the preprocessing of each first data packet.

7. The method for dynamic management and control of cross-border data based on flow analysis as described in claim 1, characterized in that, Step S105 includes the following steps: Step S1051, select any node and obtain the binary encoding of any byte of the node; Step S1052: Count the number of characters in the binary code and compare the number of characters with 8. If the number of characters is less than 8, proceed to step S1053. If the number of characters is equal to 8, proceed to step S1054. Step S1053: Pad the binary code with 0s until the number of characters after padding is equal to 8, then stop padding and output the new binary code; Step S1054: Set the color conversion rule between color value and binary code value. The color value is distributed from 0 to 255. The color conversion rule is expressed as f(code) = a + 1, where code represents the decimal value corresponding to the binary code, a represents the color value, and f represents the color conversion rule that maps the color value to the color value. After the color conversion rule is set, jump to step S1055. Step S1055: Obtain the binary code value of any binary code, and obtain the color value corresponding to the binary code value according to the color conversion rules; Step S1056: Traverse each binary code of the node to obtain the color value corresponding to each binary code. Arrange the color values ​​in order according to the order in which the binary codes appear to form a first vector, where the first vector is represented as a vector with one row and multiple columns.

8. The method for dynamic management and control of cross-border data based on flow analysis as described in claim 1, characterized in that, Step S200 includes the following steps: Step S201, based on the PPMI algorithm, obtain the co-occurrence features of bytes, including the data packet's own features and the data packet's association features; Step S202: Based on the characteristics of the data packet itself, obtain any data packet and determine whether the data packet meets the second condition. If the data packet meets the second condition, proceed to step S203; if the data packet does not meet the second condition, proceed to step S204. Step S203: Obtain another data packet, obtain the data packet association characteristics between the data packets, and determine whether the two data packets meet the third condition. If the two data packets meet the third condition, proceed to step S205; if the two data packets do not meet the third condition, proceed to step S206. Step S204: Mark the data packet with a first mark, perform a first operation on the first-marked data packet, trace the return link of the data packet after the first operation, generate first link information, and determine whether the first mark is removed based on the first link information. If the first mark is removed, proceed to step S203. If the first mark is not removed, block the target IP address of the first-marked data packet. Step S205: Set the sequence number of the byte diagram; Step S206: Mark another data packet with a second mark, perform a second operation on the second-marked data packet, trace the return link of the data packet after the second operation, generate second link information, determine whether to add a second mark based on the second link information, and jump to step S205 when the second mark is removed; when the second mark is not removed, block the target IP address of the other data packet besides the second-marked data packet.

9. The method for dynamic management and control of cross-border data based on flow analysis as described in claim 1, characterized in that, The data stream image is encrypted using the diagonal algorithm of the Hadamard product matrix and matrix-vector product to obtain an encrypted stream; The decryption process is the reverse of the encryption process, and the fourth timestamp is extracted from the data stream after the encryption operation for decryption. The encryption verification method is set according to the encryption process, and the decryption verification method is set according to the decryption process. The encryption verification method and the decryption verification method are verified based on the corresponding timestamp. The encryption verification method is implemented using the Lorenz chaotic equation in differential form, and the second verification is implemented based on the time interval between the decryption time point and the encryption time point; When the first verification result is "pass" and the second verification result is "pass", the new data flow is set to compliant. When the first verification result is "fail" or the second verification result is "fail", the new data flow is set to non-compliant.

10. A cross-border data dynamic management and control system based on flow analysis, the system being used to execute the cross-border data dynamic management and control method based on flow analysis as described in claim 1, characterized in that, It includes a conversion module, a calculation module, and a verification module; The conversion module constructs a byte graph based on the preprocessed data packet, converts the byte graph into a matrix, and converts the matrix into an image according to preset rules; The computation module is based on the PPMI algorithm and the sliding step algorithm. It sets the sequence number of the byte graph, constructs a data stream image based on the sequence number of the byte graph, encrypts the data stream image according to the Hadamard product matrix and the diagonal algorithm of matrix-vector multiplication, decrypts the encrypted stream based on the inverse operation of the encryption process, sets the encryption verification method according to the encryption process, and sets the decryption verification method according to the decryption process. The verification module performs a first verification on the new data stream using an encryption verification method, and a second verification on the new data stream using a decryption verification method. Based on the first verification result and the second verification result, it determines whether the new data stream is compliant.

Images