A network and information security defense method and system based on multi-dimensional threat perception

Abstract

This invention discloses a network and information security defense method and system based on multi-dimensional threat perception, relating to the field of network and information security technology. This invention obtains mirrored traffic data from key network nodes, separates transport layer security protocol handshake messages and application data messages, extracts unencrypted handshake metadata from client and server greeting messages using a first perception channel, generates a multi-dimensional static fingerprint vector, extracts the application layer payload length sequence using a second perception channel, calculates the packet length state transition probability distribution as a dynamic behavior feature vector, and jointly encodes the static fingerprint vector and dynamic behavior feature vector, inputting it into a shallow graph convolutional network to output a malicious confidence score. When the score exceeds a threshold, session-level blocking is executed. This achieves high-precision detection of encrypted malicious traffic without decrypting the traffic, and is suitable for encrypted traffic security protection scenarios at enterprise network boundaries, cloud data centers, and critical information infrastructure.

Description

Technical Field

[0001] This invention relates to the field of network and information security technology, specifically to a network and information security defense method and system based on multi-dimensional threat perception. Background Technology

[0002] With the rapid development of information technology, cyberattacks are becoming increasingly complex and covert. Transport layer security protocols, as core technologies for ensuring the confidentiality and integrity of network communications, have been widely applied in various internet services such as e-commerce, online finance, and remote enterprise operations. However, while encryption technology protects user privacy, it also provides malicious attackers with a convenient channel to conceal their actions.

[0003] Advanced persistent threats (APS), ransomware, and remote access Trojans commonly utilize transport layer security (TLS) protocols to construct encrypted command and control channels, bypassing traditional firewalls and intrusion detection systems. Attackers configure custom TLS fingerprint parameters to make malicious traffic exhibit characteristics highly similar to mainstream browsers or legitimate applications during the protocol handshake phase, thus circumventing fingerprint-based security detection mechanisms. Simultaneously, attackers further obscure the statistical characteristics of encrypted traffic by randomizing behavioral parameters such as heartbeat intervals and data fragment sizes, posing a significant challenge to detection methods relying solely on traffic behavior analysis. Existing threat detection technologies targeting encrypted traffic have limitations. Traditional deep packet inspection techniques require decryption of encrypted traffic before the payload content can be analyzed. This process not only introduces significant performance overhead and latency, but also is not feasible in many application scenarios due to user privacy and compliance risks. Detection methods based on transport layer security protocol fingerprints rely solely on a limited number of unencrypted fields in client or server greeting messages for single-dimensional judgment. Attackers can easily make their malicious traffic fingerprints highly overlap with known legitimate fingerprints by modifying the order of cipher suite lists or replacing extended field combinations, resulting in a large number of false negatives. Although detection methods based on statistical characteristics such as long-term distribution of traffic packets and connection duration do not require decryption, they have a high false alarm rate when used alone. The heartbeat keep-alive mechanism of enterprise applications and the dynamic routing adjustment of content delivery networks also exhibit statistical patterns similar to those of malicious beacons, which makes security operations and maintenance personnel face a lot of invalid alarms.

[0004] In summary, existing technologies urgently need a method and system that can organically integrate the static configuration features of the protocol handshake phase with the dynamic behavior features of the encrypted payload transmission phase without decrypting the transport layer security protocol traffic, thereby significantly improving the accuracy of blind detection of encrypted malicious traffic. Summary of the Invention

[0005] The purpose of this invention is to overcome the shortcomings of existing technologies and provide a network and information security defense method and system based on multi-dimensional threat perception. This method obtains mirrored traffic data from key network nodes, separates transport layer security protocol handshake messages and application data messages, and extracts unencrypted handshake metadata from client and server greeting messages via a first perception channel. This generates a multi-dimensional static fingerprint vector containing cipher suite order, extended field combination identifiers, certificate chain length, and issuer geographic attributes. A second perception channel extracts the application layer payload length sequence and calculates the packet length state transition probability distribution as a dynamic behavior feature vector. The static fingerprint vector and dynamic behavior feature vector are jointly encoded, and a session feature graph is constructed with the current session as the central node and historically similar sessions as adjacent nodes. This graph is input into a shallow graph convolutional network to output a malicious confidence score. When the score exceeds a threshold, session-level blocking is executed. Through the fusion of two-stage perception and graph convolutional decision-making, high-precision detection of encrypted malicious traffic is achieved without decrypting the traffic. This method combines low false alarm rate with high concealed threat detection capability, making it suitable for encrypted traffic security protection scenarios at enterprise network boundaries, cloud data centers, and critical information infrastructure.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution: On one hand, a network and information security defense method based on multi-dimensional threat perception, the specific steps of which are as follows: S100. Obtain mirrored traffic data from key network nodes, and based on the port number and the content type field in the transport layer security protocol header, separate the transport layer security protocol traffic in the mirrored traffic data into transport layer security protocol handshake messages and transport layer security protocol application data messages, and establish a bidirectional flow session table. S200: The first sensing channel module parses the client greeting message and server greeting message in the transport layer security protocol handshake message, extracts the unencrypted handshake metadata, and generates a multi-dimensional static fingerprint vector based on the extracted handshake metadata. S300: The second sensing channel module extracts the application layer payload length sequence (after removing interference from Transmission Control Protocol retransmission packets and pure acknowledgment packets) from the application data packets of the Transport Layer Security Protocol (TLS) and calculates the packet length state transition probability distribution of the current TLS session based on the application layer payload length sequence. The packet length state transition probability distribution is then used as the dynamic behavior feature vector of the current TLS session. S400. Jointly encode the multidimensional static fingerprint vector and the dynamic behavior feature vector to construct a session feature map. Input the session feature map into a pre-trained shallow graph convolutional network. The shallow graph convolutional network outputs the malicious confidence score of the current transport layer security protocol session to be detected. S500. When the malicious confidence score exceeds a preset threshold, a blocking policy is generated and the blocking policy is sent to the firewall device to perform session-level blocking operations on the current transport layer security protocol session to be detected.

[0007] Furthermore, the multidimensional static fingerprint vector includes: the sequential feature vector of the cipher suite list, the unique identifier of the extended field combination, the certificate chain length value, and the geographic attribute label of the certificate issuer.

[0008] Furthermore, the method for extracting the sequential feature vector of the cipher suite list is as follows: Extract the 16-bit encoded sequence of the cipher suite field from the client greeting message, and completely preserve the order of appearance of the 16-bit encoded sequence in the original message. Use the 16-bit encoded sequence arranged in the original order of appearance as the order feature vector of the cipher suite list.

[0009] Furthermore, the unique identifier of the extended field combination is generated as follows: Extract the type identifier of each extended type from the extended fields in the client greeting message, combine all the extended type type identifiers into an extended type sequence according to their order of appearance in the original message, perform a hash operation on the extended type sequence, and use the hash value obtained by the hash operation as the unique identifier of the extended field combination.

[0010] Furthermore, the extraction methods for the certificate chain length value and the geographic attribute tag of the certificate issuer are as follows: The digital certificate is extracted from the server greeting message and subsequent certificate messages. The certificate chain depth of the digital certificate is parsed and used as the certificate chain length value. At the same time, the name attribute and organization name attribute in the issuer field of the digital certificate are parsed. The name attribute and organization name attribute are combined and encoded, and the combined encoding result is used as the geographic attribute label of the certificate issuer.

[0011] Furthermore, in S300, the packet length state transition probability distribution is calculated as follows: Based on packet length state space The range of payload length values ​​in the application layer payload length sequence is discretized into multiple packet length interval states, i.e. ,in The total number of packet length interval states is defined as follows: the application layer payload length is divided into multiple continuous and non-overlapping numerical intervals within the range of zero bytes to the maximum segment size of the transmission control protocol, based on a preset length interval. Each numerical interval corresponds to a unique packet length interval state identifier. Calculate the one-step transition probability matrix The one-step transition probability matrix elements in This indicates that the current application layer payload length is within the packet length range. Under these conditions, the effective payload length of the next application layer is transferred to the packet length interval state. The probability of; The element ,in, Indicates the timing position Observed application layer payload length, Indicates the timing position Observed application layer payload length, Indicates the first The state of each packet's length interval. Indicates the first The state of each packet's length interval. This indicates the state within the packet length range of the entire application data stream in the current transport layer security protocol session. Transition to packet length interval state Total number of observations This indicates that within the entire application data stream of the current transport layer security protocol session, the application layer payload length is within the packet length range. Total number of observations; The first-step transition probability matrix The values ​​of all elements in the vector are expanded into a one-dimensional vector, and the one-dimensional vector is used as the dynamic behavior feature vector of the current transport layer security protocol session.

[0012] Furthermore, in S400, the process of constructing the session feature map is as follows: The current transport layer security protocol session to be detected is used as the central node of the session feature map. ; Within the traffic collection time window, retrieve all historical Transport Layer Security (TLS) sessions that have the same server name indication field or the same destination Internet Protocol (IP) address as the current TLS session to be detected, and use these all historical TLS sessions as the set of adjacent nodes in the session feature graph. ; At the central node An undirected edge is established between the central node and each of the adjacent nodes. The cosine similarity between the multidimensional static fingerprint vectors of the central node and the adjacent nodes is calculated. The cosine similarity value is normalized and used as the initial weight of the undirected edge.

[0013] Furthermore, in S400, the shallow graph convolutional network performs feature aggregation and updating operations on each node as follows: The adjacency matrix of the session feature map is: The degree matrix is The adjacency matrix The matrix obtained after adding self-loops is ,in, The degree matrix is ​​the identity matrix. diagonal elements The shallow graph convolutional network in the first layer layer to the first The node features of the layer are propagated as follows: ,in, Indicates the first The node feature matrix of the layer graph convolutional layer, The initial feature matrix is ​​formed by concatenating the joint feature vector corresponding to the central node with the joint feature vectors corresponding to each neighboring node in the set of neighboring nodes. Indicates the first The trainable weight matrix of a layered graph convolutional layer For matrix The corresponding degree matrix, Represents the degree matrix The matrix obtained after raising the product to the power of -1 / 2. Represents a nonlinear activation function; In the process of aggregating neighboring node information, when the shallow graph convolutional network detects that the similarity between the multidimensional static fingerprint vector of the neighboring node and the multidimensional static fingerprint vector of the center node is higher than the similarity threshold, and the distribution difference between the dynamic behavior feature vector of the neighboring node and the dynamic behavior feature vector of the center node is greater than the difference threshold, the shallow graph convolutional network amplifies the feature difference between the center node and the neighboring node into higher-order semantic features through the attention weight decay mechanism of the edges in the graph convolutional layer. After a preset number of graph convolution operations, the final feature vector corresponding to the center node is input into the fully connected classification layer, which then outputs the malicious confidence score of the current transport layer security protocol session to be detected.

[0014] On the other hand, a network and information security defense system based on multi-dimensional threat perception includes: The traffic acquisition module obtains mirrored traffic data from key network nodes, separates the transport layer security protocol traffic in the mirrored traffic data into transport layer security protocol handshake messages and transport layer security protocol application data messages, and establishes a bidirectional flow session table. The first sensing channel module parses the client greeting message and server greeting message in the transport layer security protocol handshake message, extracts the unencrypted handshake metadata, and generates a multi-dimensional static fingerprint vector based on the extracted handshake metadata. The second sensing channel module extracts a continuous application layer payload length sequence from the application data packets of the transport layer security protocol, calculates the packet length state transition probability distribution of the current transport layer security protocol session based on the application layer payload length sequence, and uses the packet length state transition probability distribution as the dynamic behavior feature vector of the current transport layer security protocol session. The graph convolutional fusion decision module has a built-in pre-trained shallow graph convolutional network model. It jointly encodes the multi-dimensional static fingerprint vector and the dynamic behavior feature vector to form a joint feature vector. It constructs a session feature map with the current transport layer security protocol session to be detected as the central node and historical transport layer security protocol sessions with the same server name indication or the same destination Internet Protocol address as the adjacent nodes. The session feature map is then input into the shallow graph convolutional network, which outputs the malicious confidence score of the current transport layer security protocol session to be detected. The policy execution module generates a blocking policy when the malicious confidence score exceeds a preset threshold, and sends the blocking policy to the firewall device to perform session-level blocking operations on the current transport layer security protocol session to be detected.

[0015] Furthermore, in the policy execution module, the session-level blocking operation is executed as follows: The policy execution module receives the blocking decision for the current Transport Layer Security Protocol (TLS) session to be detected from the graph convolutional fusion decision module, and extracts the five-tuple information of the current TLS session to be detected. The five-tuple information includes the source Internet Protocol address, source port, destination Internet Protocol address, destination port, and TLS protocol type. The policy enforcement module issues access control list rules through the application programming interface of the border firewall device. The access control list rules only perform reset packet blocking operations on the Transport Layer Security Protocol Session Identifier uniquely identified by the five-tuple information, without affecting other normal Transport Layer Security Protocol sessions corresponding to the destination Internet Protocol address.

[0016] Compared with existing technologies, this network and information security defense method based on multi-dimensional threat perception has the following advantages: I. This invention constructs a two-stage perception channel to extract static configuration features from the handshake phase of the transport layer security protocol and dynamic behavioral features from the data transmission phase of encrypted applications. The two types of features are then input into a shallow graph convolutional network for fusion and judgment. Even if an attacker forges the fingerprint features of the handshake phase to make them consistent with the browser, it is difficult to simultaneously forge the packet length state transition rules generated by the execution of underlying malicious code. The joint analysis of static and dynamic features effectively makes up for the inherent defects of single-dimensional detection and improves the detection rate of covert encrypted commands and control channels.

[0017] Second, this invention introduces a graph convolutional fusion decision mechanism based on session feature graphs, which performs correlation analysis between the current session to be detected and historical sessions with the same server name indication or the same destination address. When the static fingerprint of a session is highly similar to that of a historical session, but the dynamic behavior characteristics are significantly different, the graph convolutional network amplifies such features through the edge attention weight decay mechanism, thereby accurately distinguishing the heartbeat traffic of normal enterprise applications from the beacon traffic of malicious software, and significantly reducing invalid alarms caused by normal business fluctuations.

[0018] Third, this invention relies solely on the unencrypted metadata disclosed during the handshake phase of the transport layer security protocol and the packet length side channel information of the encrypted application data packets, without requiring decryption of the encrypted payload. This feature enables this invention to maintain effective detection of encryption threats while satisfying data privacy protection.

[0019] Fourth, this invention does not rely on the pre-entry of known malware signatures, but rather identifies abnormal encrypted sessions that deviate from normal business patterns by modeling the inherent logical consistency between static configuration features and dynamic behavior features. When a new malware family adopts an unseen transport layer security protocol configuration, as long as its underlying communication behavior differs from that of legitimate applications in terms of statistical distribution, this invention can still effectively detect and issue an early warning.

[0020] Other advantages, objectives and features of the invention will be set forth in part in the description which follows, and in part will be apparent to those skilled in the art from the following examination or study, or may be learned from the practice of the invention. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are merely some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without any creative effort.

[0022] Figure 1 A flowchart illustrating the steps of a network and information security defense method based on multi-dimensional threat perception; Figure 2 This is a block diagram of the module composition of a network and information security defense system based on multi-dimensional threat perception in an embodiment of the present invention; Figure 3 This is a flowchart illustrating the process of constructing a session feature map in an embodiment of the present invention. Detailed Implementation

[0023] To better understand the above technical solutions, a detailed description of the solutions will be provided below in conjunction with the accompanying drawings and specific embodiments. Obviously, the described embodiments are merely some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0024] To address the shortcomings of existing network and information security defense technologies, such as low accuracy in detecting encrypted malicious traffic, susceptibility to bypassing single-dimensional detection, and privacy compliance risks associated with decryption analysis, this invention provides a network and information security defense method and system based on multi-dimensional threat perception. This method constructs a dual-level perception channel, extracting static configuration features from the transport layer security protocol handshake phase and dynamic behavioral features from the encrypted application data transmission phase. These two types of features are then input into a shallow graph convolutional network for fusion and decision-making, achieving high-precision blind detection of encrypted malicious traffic. This invention is applicable to various application scenarios requiring threat perception without cracking encrypted traffic, including enterprise network boundaries, cloud data centers, financial transaction systems, and critical information infrastructure.

[0025] The present invention will now be described in further detail with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the scope of protection of the invention.

[0026] like Figure 1 As shown in the figure, this embodiment provides a network and information security defense method based on multi-dimensional threat perception. The specific steps of this method are as follows: S100. Obtain mirrored traffic data from key network nodes. Based on the port number and the content type field in the transport layer security protocol header, separate the transport layer security protocol traffic in the mirrored traffic data into transport layer security protocol handshake messages and transport layer security protocol application data messages, and establish a bidirectional flow session table.

[0027] S200: The first sensing channel module parses the client greeting message and server greeting message in the transport layer security protocol handshake message, extracts the unencrypted handshake metadata, and generates a multi-dimensional static fingerprint vector based on the extracted handshake metadata.

[0028] S300: The second sensing channel module extracts the application layer payload length sequence (after removing interference from Transmission Control Protocol retransmission packets and pure acknowledgment packets) from the application data packets of the Transport Layer Security Protocol (TLS) and calculates the packet length state transition probability distribution of the current TLS session based on the application layer payload length sequence. The packet length state transition probability distribution is then used as the dynamic behavior feature vector of the current TLS session.

[0029] S400. Jointly encode the multidimensional static fingerprint vector and the dynamic behavior feature vector to construct a session feature map. Input the session feature map into a pre-trained shallow graph convolutional network, and output the malicious confidence score of the current transport layer security protocol session to be detected by the shallow graph convolutional network.

[0030] S500. When the malicious confidence score exceeds a preset threshold, a blocking policy is generated and the blocking policy is sent to the firewall device to perform session-level blocking operations on the current transport layer security protocol session to be detected.

[0031] like Figure 2 As shown, this embodiment also provides a network and information security defense system based on multi-dimensional threat perception, which includes: The traffic acquisition module obtains mirrored traffic data from key network nodes, separates the transport layer security protocol traffic in the mirrored traffic data into transport layer security protocol handshake messages and transport layer security protocol application data messages, and establishes a bidirectional flow session table. The first sensing channel module parses the client greeting message and server greeting message in the transport layer security protocol handshake message, extracts the unencrypted handshake metadata, and generates a multi-dimensional static fingerprint vector based on the extracted handshake metadata. The second sensing channel module extracts a continuous application layer payload length sequence from the application data packets of the transport layer security protocol, calculates the packet length state transition probability distribution of the current transport layer security protocol session based on the application layer payload length sequence, and uses the packet length state transition probability distribution as the dynamic behavior feature vector of the current transport layer security protocol session. The graph convolutional fusion decision module has a built-in pre-trained shallow graph convolutional network model. It jointly encodes the multi-dimensional static fingerprint vector and the dynamic behavior feature vector to form a joint feature vector. It constructs a session feature map with the current transport layer security protocol session to be detected as the central node and historical transport layer security protocol sessions with the same server name indication or the same destination Internet Protocol address as the adjacent nodes. The session feature map is then input into the shallow graph convolutional network, which outputs the malicious confidence score of the current transport layer security protocol session to be detected. The policy execution module generates a blocking policy when the malicious confidence score exceeds a preset threshold, and sends the blocking policy to the firewall device to perform session-level blocking operations on the current transport layer security protocol session to be detected.

[0032] In practical implementation, the defense system is first deployed in a bypass position on the core switch at the enterprise network boundary. For example, in this embodiment, the enterprise network adopts a backbone-branch architecture, with the core switch connecting the internal office network, the data center server cluster, and the external Internet egress. The defense system server is connected to the mirror port of the core switch via fiber optic cable. The core switch is configured with a port mirroring policy, which copies all inbound and outbound traffic flowing through the Internet egress port and sends it to the mirror port. The defense system server is equipped with a high-performance network interface card and a data processing unit to ensure real-time processing of mirrored traffic data.

[0033] After receiving mirrored traffic data, the traffic acquisition module first performs protocol identification and filtering. Since the detection target of this invention is Transport Layer Security (TLS) encrypted traffic, the traffic acquisition module performs preliminary filtering based on the Transmission Control Protocol (TCP) port number, extracting TCP streams by default. For encrypted traffic from non-standard ports, the traffic acquisition module identifies characteristic bytes of the TCP handshake message using deep packet inspection (DCI) technology, specifically the content type field in the TCP record layer header. The content type value for the handshake message is hexadecimal 0x16, and the content type value for the application data message is 0x17. The traffic acquisition module establishes a bidirectional flow session table using the five-tuple information of source Internet Protocol (IP) address, source port, destination IP address, destination port, and transport layer protocol type as keys. Each session entry records the state information of the Transport Layer Security Protocol (TLS) session, including handshake status, certificate information, sequence number range, and message arrival timestamp. When the handshake phase of a session is detected as complete, that is, when the complete interaction sequence of client greeting message, server greeting message, certificate message, and handshake completion message is observed simultaneously, the traffic acquisition module marks the session as handshake complete and pushes the cached TLS handshake message and the subsequently arriving TLS application data message to the first sensing channel module and the second sensing channel module, respectively.

[0034] After receiving the Transport Layer Security Protocol (TLS) handshake message, the first sensing channel module begins deep parsing of static configuration features. The first sensing channel module first locates the start position of the client greeting message, skips the TLS record layer header and the handshake protocol header, and enters the client greeting message payload.

[0035] The first perception channel module extracts the sequential feature vector of the cipher suite list. The specific process is as follows: read the length value of the cipher suite field in the client greeting message, and then read the sixteen-bit encoded value of each cipher suite in sequence. The first perception channel module completely preserves the order of appearance of the extracted sixteen-bit encoded sequence in the original message, and uses the sixteen-bit encoded sequence arranged in the original order of appearance as the sequential feature vector of the cipher suite list. The dimension of this sequential feature vector depends on the actual number of cipher suites extracted.

[0036] The first perception channel module generates a unique identifier for the extended field combination. The specific process is as follows: Iterate through the list of extended fields in the client greeting message, and read the type identifier of each extended field one by one. The extended field type identifier is a 16-bit value, uniformly assigned by the Internet Corporation for Assigned Numbers (ICANN). For example, the type value of the server name indication extended is 0x0000, the type value of the application layer protocol negotiation extended is 0x0010, and the type value of the supported group extended is 0x000A. The first perception channel module combines all the type identifiers of the extended types into an extended type sequence according to the order of their appearance in the original message. A secure hash algorithm is performed on the extended type sequence, and the first 64 bits of the 160-bit hash value obtained after the hash operation are taken as the unique identifier of the extended field combination. This identifier can effectively distinguish the extended field configuration combinations used by different software implementations.

[0037] The first perception channel module extracts the certificate chain length and the geographic attribute tag of the certificate issuer. The specific process is as follows: the digital certificate is extracted from the certificate message after the server greeting message. The certificate message in the handshake phase of the transport layer security protocol carries the X.509 format digital certificate chain for server identity authentication, which contains a complete trust chain from the server certificate to the root certificate. The first perception channel module parses each certificate in the digital certificate chain in turn, counts the number of certificates in the certificate chain, and uses the number of certificates as the certificate chain length. At the same time, the first perception channel module parses the name attribute and organization name attribute in the issuer field of the digital certificate, combines and encodes the name attribute and organization name attribute, and uses the combined encoding result as the geographic attribute tag of the certificate issuer.

[0038] The first perception channel module combines the sequential feature vector of the cipher suite list, the unique identifier of the extended field combination, the certificate chain length value, and the geographical attribute label of the certificate issuer into a fixed-length multidimensional static fingerprint vector.

[0039] After receiving the Transport Layer Security Protocol (TLS) application data packets, the second sensing channel module extracts dynamic behavioral characteristics. Since the payload content of the TLS application data packets is fully encrypted, the second sensing channel module only focuses on the external morphological characteristics of the packets, namely the length of the application layer payload.

[0040] The second sensing channel module first preprocesses the received message sequence to eliminate interference from transport layer retransmission and acknowledgment mechanisms on packet length statistics. When a data packet is lost in the Transmission Control Protocol (TCP), the sender retransmits the lost data packet. The payload length of the retransmitted packet is exactly the same as the original packet. If it were directly included in the statistics, the same data would be counted repeatedly. The second sensing channel module identifies and discards retransmitted data packets with duplicate sequence numbers by detecting the sequence number field in the TCP header. At the same time, the pure acknowledgment packets in the TCP do not carry any application layer data, and their effective payload length is zero. The second sensing channel module also filters out such zero-payload-length messages.

[0041] After preprocessing, the second sensing channel module extracts a continuous sequence of application layer payload lengths in chronological order. Based on the payload length sequence, the second sensing channel module calculates the packet length state transition probability distribution. Define the packet length state space The range of payload length values ​​in the application layer payload length sequence is discretized into multiple packet length interval states, i.e. ,in The total number of packet length interval states is defined as follows: the application layer payload length is divided into multiple continuous and non-overlapping numerical intervals within the range of zero bytes to the maximum segment size of the transmission control protocol, based on a preset length interval. Each numerical interval corresponds to a unique packet length interval state identifier. Calculate the one-step transition probability matrix The one-step transition probability matrix elements in This indicates that the current application layer payload length is within the packet length range. Under these conditions, the effective payload length of the next application layer is transferred to the packet length interval state. The probability of; The element ,in, Indicates the timing position Observed application layer payload length, Indicates the timing position Observed application layer payload length, Indicates the first The state of each packet's length interval. Indicates the first The state of each packet's length interval. This indicates the state within the packet length range of the entire application data stream in the current transport layer security protocol session. Transition to packet length interval state Total number of observations This indicates that within the entire application data stream of the current transport layer security protocol session, the application layer payload length is within the packet length range. Total number of observations; The first-step transition probability matrix The values ​​of all elements in the vector are expanded into a one-dimensional vector, and the one-dimensional vector is used as the dynamic behavior feature vector of the current transport layer security protocol session.

[0042] After completing the feature extraction of the first-order and second-order perception, the graph convolutional fusion decision module receives the multi-dimensional static fingerprint vector and the dynamic behavior feature vector, and performs fusion decision. The graph convolutional fusion decision module jointly encodes the multi-dimensional static fingerprint vector and the dynamic behavior feature vector. The multi-dimensional static fingerprint vector includes the cryptographic suite order vector, the extended field unique identifier, the certificate chain length value, and the certificate issuer's geographic attribute label. The joint encoding process concatenates the beginning and end of the vector to form a joint feature vector.

[0043] The graph convolutional fusion decision module constructs a session feature map, such as... Figure 3 As shown, the process of constructing a session feature map is as follows: The current transport layer security protocol session to be detected is used as the central node of the session feature map. ; Within the traffic collection time window, retrieve all historical Transport Layer Security (TLS) sessions that have the same server name indication field or the same destination Internet Protocol (IP) address as the current TLS session to be detected, and use these all historical TLS sessions as the set of adjacent nodes in the session feature graph. ; At the central node An undirected edge is established between the central node and each of the adjacent nodes. The cosine similarity between the multidimensional static fingerprint vectors of the central node and the adjacent nodes is calculated. The cosine similarity value is normalized and used as the initial weight of the undirected edge.

[0044] After the session feature map is constructed, the graph convolutional fusion decision module inputs the session feature map into a pre-trained shallow graph convolutional network. This shallow graph convolutional network consists of two graph convolutional layers and a fully connected classification layer, and has been trained offline using labeled normal encrypted traffic samples and malicious encrypted traffic samples.

[0045] The specific process of feature aggregation and updating for each node in a shallow graph convolutional network is as follows: Let the adjacency matrix of the session feature map be... The degree matrix is Adjacency matrix The matrix obtained after adding self-loops is ,in To ensure that each node retains its own feature information during feature aggregation, a self-loop is added to the identity matrix D, avoiding information loss due to the sparsity of adjacent nodes. The diagonal elements of the degree matrix D... , which represents the sum of the weights of the connected edges, including self-loops, at each node.

[0046] The first layer of shallow graph convolutional networks layer to the first The formula for the propagation of node features in a layer is: ,in, Indicates the first The node feature matrix of the layer graph convolutional layer, The initial feature matrix is ​​formed by concatenating the joint feature vector corresponding to the central node with the joint feature vectors corresponding to each neighboring node in the set of neighboring nodes. Indicates the first The trainable weight matrix of a layered graph convolutional layer For matrix The corresponding degree matrix, Represents the degree matrix The matrix obtained after raising the product to the power of -1 / 2. The term represents a nonlinear activation function. In this embodiment, the first convolutional layer uses a linear rectified function as the activation function, while the second convolutional layer does not have an activation function.

[0047] In the process of aggregating neighboring node information, shallow graph convolutional networks automatically reduce the aggregation weight of the corresponding edge of the neighboring node when the similarity between the multidimensional static fingerprint vector of a neighboring node and the multidimensional static fingerprint vector of the center node is higher than the similarity threshold, and the distribution difference between the dynamic behavior feature vector of the neighboring node and the dynamic behavior feature vector of the center node is greater than the difference threshold. If two sessions are highly similar in static fingerprints but have significantly different dynamic packet length transfer patterns, this contradiction of static similarity but dynamic difference is a typical feature of malicious spoofing traffic. By reducing the aggregation weight of such nodes, graph convolutional networks can amplify the feature differences between the center node and neighboring nodes into high-order semantic features, thereby enhancing the discriminative power of the decision boundary.

[0048] After two layers of graph convolution operations, each node obtains a high-dimensional feature representation that aggregates neighborhood information. The graph convolution fusion decision module extracts the final feature vector corresponding to the center node and inputs it into the fully connected classification layer. The fully connected classification layer consists of a fully connected network and a flexible maximum function, and outputs a malicious confidence score between 0 and 1. The higher the score, the greater the possibility that the current session to be detected belongs to malicious encrypted traffic.

[0049] The policy execution module continuously receives the malicious confidence score output by the graph convolutional fusion decision module and compares it with a preset threshold. When the malicious confidence score exceeds the preset threshold, the policy execution module determines that the current transport layer security protocol session to be detected is a malicious session and triggers the defense response process.

[0050] The policy execution module first generates a blocking policy, which includes blocking decisions for the current Transport Layer Security Protocol (TLS) session to be detected. The policy execution module extracts the five-tuple information of the current TLS session to be detected, which includes the source Internet Protocol address, source port, destination Internet Protocol address, destination port, and TLS protocol type.

[0051] The policy enforcement module issues access control list rules through the application programming interface (API) of the border firewall device. Taking the next-generation firewall deployed by the enterprise in this embodiment as an example, the policy enforcement module calls the firewall's expressive state transit API, uses the authentication token pre-configured by the security administrator for authentication, and constructs a blocking rule creation request. The message body of the request contains the five-tuple information of the session to be blocked and the blocking action type. After receiving the request, the firewall adds a dynamic rule to its access control list: matching the session with source address 192.168.1.105, source port 45678, destination address 203.0.113.45, destination port 443, and protocol Transmission Control Protocol (TCP), with the action of sending a reset message to block.

[0052] This access control list rule only performs a reset message blocking operation on the Transport Layer Security Protocol (TLS) session identifier uniquely identified by the five-tuple information, without affecting other normal TLS sessions corresponding to the destination Internet Protocol address. This fine-grained blocking capability avoids the collateral impact of large-scale address blocking on normal business operations.

[0053] In a preferred embodiment, the pre-trained shallow graph convolutional network is trained offline using a labeled dataset before deployment. The process of constructing the training dataset is as follows: Collect encrypted traffic data from transport layer security protocols in real network environments. The data sources include enterprise office network exits, data center boundaries, and publicly available malicious traffic analysis platforms. The data collection duration is no less than seven consecutive days of full mirror traffic, covering different business periods on weekdays and rest days to ensure the diversity and representativeness of the samples.

[0054] The collected raw traffic is reconstructed and labeled. Each transport layer security protocol session is labeled with a tag. The labeling categories include two types: the first type is "normal traffic", which includes encrypted communications such as employees browsing web pages, enterprise application programming interface calls, and cloud service synchronization; the second type is "malicious traffic", which includes known remote control Trojan beacons, advanced persistent threat command and control channels, encrypted protocol communications, and ransomware callback traffic. In this embodiment, the sample ratio of normal traffic to malicious traffic is approximately 6:1.

[0055] For each labeled session, perform S200 and S300 feature extraction operations to generate corresponding multidimensional static fingerprint vectors and dynamic behavior feature vectors. Concatenate these two vectors and save them as the original feature vector of the session. At the same time, record the quintuple information and server name indicator field of the session for subsequent construction of session feature maps.

[0056] The labeled dataset was randomly divided into training, validation, and test sets in an 8:1:1 ratio. The training set was used for learning and updating model parameters, the validation set was used for hyperparameter tuning and early stopping during training, and the test set was used for performance evaluation of the final model.

[0057] The shallow graph convolutional network described above employs a structure design of two graph convolutional layers plus a fully connected classification layer. This design ensures feature extraction capabilities while controlling the number of model parameters to meet the low-latency requirements of real-time bypass traffic detection. The specific structure is as follows: The first layer is a graph convolutional layer. The input dimension is the dimension of the joint feature vector, which is 255 dimensions in this embodiment. The output dimension is set to 128 dimensions. This layer maps the original heterogeneous features to a low-dimensional dense vector space and completes the first-order neighborhood information aggregation between nodes. The activation function is a linear rectified function.

[0058] The second layer is a graph convolutional layer with an input dimension of 128 and an output dimension of 64. This layer further propagates information based on the first-order neighborhood aggregation, realizing feature fusion within the second-order neighborhood and capturing more complex graph structure patterns. This layer does not use an activation function to preserve the linear representation of features for subsequent classification.

[0059] The third layer is a fully connected classification layer with a 64-dimensional input and a 2-dimensional output. This layer contains a fully connected linear transformation and a flexible maximum function, which outputs the probability distribution of the current session to be detected as belonging to two categories: "normal traffic" and "malicious traffic". The probability value corresponding to "malicious traffic" is taken as the final malicious confidence score.

[0060] Between the two graph convolutional layers, a dropout layer is placed with a dropout rate of 0.5. During the training phase, the dropout layer randomly discards some of the neuron outputs to prevent the model from overfitting to the training data and to improve the model's generalization ability.

[0061] The model training uses the following hyperparameter configuration: Optimization Algorithm: Adaptive Moment Estimation Optimizer. This optimizer combines the advantages of momentum method and adaptive learning rate, enabling efficient and stable convergence.

[0062] Initial learning rate: set to 0.001. The learning rate decay strategy adopts a step decay, with the learning rate multiplied by a decay factor of 0.5 every twenty rounds of traversal of the complete training set.

[0063] Batch size: set to 64 session feature maps. Since different session feature maps may contain different numbers of nodes, a zero-padding strategy is used within the batch to unify the adjacency matrix to the maximum number of nodes in the batch.

[0064] Training rounds: The maximum number of training rounds is set to 200 rounds. An early stopping mechanism is adopted. If the loss function value on the validation set does not decrease for 20 consecutive rounds, the training will be terminated early and the model parameters that performed best on the validation set will be restored.

[0065] Loss function: Weighted cross-entropy loss function is used.

[0066] Since each session in the training set requires the construction of its corresponding session feature map, and the session feature map depends on historical session retrieval within the traffic collection time window, this embodiment adopts the following dynamic construction strategy to improve training efficiency: Before each training round, an inverted index is pre-built for the server name indicator field and destination Internet Protocol address of all sessions in the training set. For each central node session to be trained, a candidate set of historical sessions with the same server name indicator or destination Internet Protocol address is quickly retrieved using the inverted index. No more than ten sessions are randomly selected from the candidate set as adjacent nodes to form the session feature map of that training sample. During each training iteration, the adjacent node set is dynamically resampled. This data augmentation strategy effectively increases the diversity of the training samples and suppresses overfitting of the model to specific combinations of adjacent nodes.

[0067] After training, the model performance is evaluated on the test set. The evaluation metrics used in this embodiment include accuracy, recall, precision, and F1 score, thus completing the training of the shallow graph convolutional network.

[0068] In summary, this invention constructs a complete system encompassing traffic collection and distribution, first-order static fingerprint perception, second-order dynamic packet length behavior perception, graph convolutional fusion decision-making, and defense response. This system achieves high-precision blind detection of encrypted malicious traffic without decrypting transport layer security protocol traffic. Deployed in a network bypass, it does not affect normal business traffic. It features a low false alarm rate, high concealed threat detection capability, and good engineering adaptability, effectively addressing the increasingly severe threat of encrypted traffic attacks.

[0069] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications or alterations to the above-disclosed technical content to create equivalent embodiments without departing from the scope of the present invention. Any simple modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the scope of the present invention.

Claims

1. A network and information security defense method based on multi-dimensional threat perception, characterized in that, The specific steps of this method are as follows: S100. Obtain mirrored traffic data from key network nodes, and based on the port number and the content type field in the transport layer security protocol header, separate the transport layer security protocol traffic in the mirrored traffic data into transport layer security protocol handshake messages and transport layer security protocol application data messages, and establish a bidirectional flow session table. S200: The first sensing channel module parses the client greeting message and server greeting message in the transport layer security protocol handshake message, extracts the unencrypted handshake metadata, and generates a multi-dimensional static fingerprint vector based on the extracted handshake metadata. S300: The second sensing channel module extracts the application layer payload length sequence (after removing interference from Transmission Control Protocol retransmission packets and pure acknowledgment packets) from the application data packets of the Transport Layer Security Protocol (TLS) and calculates the packet length state transition probability distribution of the current TLS session based on the application layer payload length sequence. The packet length state transition probability distribution is then used as the dynamic behavior feature vector of the current TLS session. S400. Jointly encode the multidimensional static fingerprint vector and the dynamic behavior feature vector to construct a session feature map. Input the session feature map into a pre-trained shallow graph convolutional network. The shallow graph convolutional network outputs the malicious confidence score of the current transport layer security protocol session to be detected. S500. When the malicious confidence score exceeds a preset threshold, a blocking policy is generated and the blocking policy is sent to the firewall device to perform session-level blocking operations on the current transport layer security protocol session to be detected.

2. The network and information security defense method based on multi-dimensional threat perception according to claim 1, characterized in that, The multidimensional static fingerprint vector includes: the sequential feature vector of the cipher suite list, the unique identifier of the extended field combination, the certificate chain length value, and the geographic attribute label of the certificate issuer.

3. The network and information security defense method based on multi-dimensional threat perception according to claim 2, characterized in that, The method for extracting the sequential feature vector of the cipher suite list is as follows: Extract the 16-bit encoded sequence of the cipher suite field from the client greeting message, and completely preserve the order of appearance of the 16-bit encoded sequence in the original message. Use the 16-bit encoded sequence arranged in the original order of appearance as the order feature vector of the cipher suite list.

4. A network and information security defense method based on multi-dimensional threat perception according to claim 2, characterized in that, The unique identifier of the extended field combination is generated as follows: Extract the type identifier of each extended type from the extended fields in the client greeting message, combine all the extended type type identifiers into an extended type sequence according to their order of appearance in the original message, perform a hash operation on the extended type sequence, and use the hash value obtained by the hash operation as the unique identifier of the extended field combination.

5. A network and information security defense method based on multi-dimensional threat perception according to claim 2, characterized in that, The method for extracting the certificate chain length value and the geographic attribute tag of the certificate issuer is as follows: The digital certificate is extracted from the server greeting message and subsequent certificate messages. The certificate chain depth of the digital certificate is parsed and used as the certificate chain length value. At the same time, the name attribute and organization name attribute in the issuer field of the digital certificate are parsed. The name attribute and organization name attribute are combined and encoded, and the combined encoding result is used as the geographic attribute label of the certificate issuer.

6. A network and information security defense method based on multi-dimensional threat perception according to claim 1, characterized in that, In S300, the packet length state transition probability distribution is calculated as follows: Based on packet length state space The range of payload length values ​​in the application layer payload length sequence is discretized into multiple packet length interval states, i.e. ,in This represents the total number of states within the packet length interval; Calculate the one-step transition probability matrix The one-step transition probability matrix elements in This indicates that the current application layer payload length is within the packet length range. Under these conditions, the effective payload length of the next application layer is transferred to the packet length interval state. The probability of; The element ,in, Indicates the timing position Observed application layer payload length, Indicates the timing position Observed application layer payload length, Indicates the first The state of each packet's length interval. Indicates the first The state of each packet's length interval. This indicates the state within the packet length range of the entire application data stream in the current transport layer security protocol session. Transition to packet length interval state Total number of observations This indicates that within the entire application data stream of the current transport layer security protocol session, the application layer payload length is within the packet length range. Total number of observations; The first-step transition probability matrix The values ​​of all elements in the vector are expanded into a one-dimensional vector, and the one-dimensional vector is used as the dynamic behavior feature vector of the current transport layer security protocol session.

7. A network and information security defense method based on multi-dimensional threat perception according to claim 1, characterized in that, In S400, the process of constructing the session feature map is as follows: The current transport layer security protocol session to be detected is used as the central node of the session feature map. ; Within the traffic collection time window, retrieve all historical Transport Layer Security (TLS) sessions that have the same server name indication field or the same destination Internet Protocol (IP) address as the current TLS session to be detected, and use these all historical TLS sessions as the set of adjacent nodes in the session feature graph. ; At the central node An undirected edge is established between the central node and each of the adjacent nodes. The cosine similarity between the multidimensional static fingerprint vectors of the central node and the adjacent nodes is calculated. The cosine similarity value is normalized and used as the initial weight of the undirected edge.

8. A network and information security defense method based on multi-dimensional threat perception according to claim 1, characterized in that, In S400, the shallow graph convolutional network performs feature aggregation and updating operations on each node as follows: The adjacency matrix of the session feature map is: The degree matrix is The adjacency matrix The matrix obtained after adding self-loops is ,in, The degree matrix is ​​the identity matrix. diagonal elements The shallow graph convolutional network in the first layer layer to the first The node features of the layer are propagated as follows: ,in, Indicates the first The node feature matrix of the layer graph convolutional layer, The initial feature matrix is ​​formed by concatenating the joint feature vector corresponding to the central node with the joint feature vectors corresponding to each neighboring node in the set of neighboring nodes. Indicates the first The trainable weight matrix of a layered graph convolutional layer For matrix The corresponding degree matrix, Represents the degree matrix The matrix obtained after raising the product to the power of -1 / 2. Represents a non-linear activation function; In the process of aggregating neighboring node information, when the shallow graph convolutional network detects that the similarity between the multidimensional static fingerprint vector of the neighboring node and the multidimensional static fingerprint vector of the center node is higher than the similarity threshold, and the distribution difference between the dynamic behavior feature vector of the neighboring node and the dynamic behavior feature vector of the center node is greater than the difference threshold, the shallow graph convolutional network amplifies the feature difference between the center node and the neighboring node into higher-order semantic features through the attention weight decay mechanism of the edges in the graph convolutional layer. After a preset number of graph convolution operations, the final feature vector corresponding to the center node is input into the fully connected classification layer, which then outputs the malicious confidence score of the current transport layer security protocol session to be detected.

9. A network and information security defense system based on multi-dimensional threat perception, applicable to the network and information security defense method based on multi-dimensional threat perception as described in any one of claims 1-8, characterized in that, The system includes: The traffic acquisition module obtains mirrored traffic data from key network nodes, separates the transport layer security protocol traffic in the mirrored traffic data into transport layer security protocol handshake messages and transport layer security protocol application data messages, and establishes a bidirectional flow session table. The first sensing channel module parses the client greeting message and server greeting message in the transport layer security protocol handshake message, extracts the unencrypted handshake metadata, and generates a multi-dimensional static fingerprint vector based on the extracted handshake metadata. The second sensing channel module extracts a continuous application layer payload length sequence from the application data packets of the transport layer security protocol, calculates the packet length state transition probability distribution of the current transport layer security protocol session based on the application layer payload length sequence, and uses the packet length state transition probability distribution as the dynamic behavior feature vector of the current transport layer security protocol session. The graph convolutional fusion decision module has a built-in pre-trained shallow graph convolutional network model. It jointly encodes the multi-dimensional static fingerprint vector and the dynamic behavior feature vector to form a joint feature vector. It constructs a session feature map with the current transport layer security protocol session to be detected as the central node and historical transport layer security protocol sessions with the same server name indication or the same destination Internet Protocol address as the adjacent nodes. The session feature map is then input into the shallow graph convolutional network, which outputs the malicious confidence score of the current transport layer security protocol session to be detected. The policy execution module generates a blocking policy when the malicious confidence score exceeds a preset threshold, and sends the blocking policy to the firewall device to perform session-level blocking operations on the current transport layer security protocol session to be detected.

10. A network and information security defense system based on multi-dimensional threat perception according to claim 9, characterized in that, In the policy execution module, the session-level blocking operation is executed as follows: The policy execution module receives the blocking decision for the current Transport Layer Security Protocol (TLS) session to be detected from the graph convolutional fusion decision module, and extracts the five-tuple information of the current TLS session to be detected. The five-tuple information includes the source Internet Protocol address, source port, destination Internet Protocol address, destination port, and TLS protocol type. The policy enforcement module issues access control list rules through the application programming interface of the border firewall device. The access control list rules only perform reset packet blocking operations on the Transport Layer Security Protocol Session Identifier uniquely identified by the five-tuple information, without affecting other normal Transport Layer Security Protocol sessions corresponding to the destination Internet Protocol address.

Images