A dynamic video flow optimization and protection method for an endogenous security switch

Abstract

The application discloses a dynamic video optimization and protection method for an endogenous security switch, which is used for deduplication optimization and privacy protection of video traffic based on HTTP transmission, intercepts and proxies the same video request received on the endogenous security switch, and performs dynamic shaping processing on the video traffic obtained from the server side according to the network state and the video content by the endogenous security device, so that the video content is secondarily distributed after differential privacy protection processing of the user request data, the same video traffic load of the network is reduced under the premise of protecting the user privacy, and the video traffic optimization function under high privacy protection is realized.

Description

Technical Field

[0001] This invention belongs to the interdisciplinary field of network security and network management, and in particular relates to a method for optimizing and protecting dynamic video traffic on an intrinsically secure switch. Background Technology

[0002] Video traffic optimization is a network management technique that reduces the number of times video content is repeatedly transmitted across the network and improves video content distribution efficiency by deduplicating identical video traffic requests and caching video traffic on proxy devices, thus saving network resources and costs while ensuring user experience. Large amounts of high-resolution video data put immense pressure on network links and infrastructure during transmission. When many users access video content simultaneously, network bandwidth demand increases rapidly, exceeding the network's capacity and causing severe network paralysis. Deploying video traffic optimization proxies on switches has the advantage of reducing the number of identical video requests received, offloading some traffic caching and distribution functions to routing devices, alleviating pressure on CDNs and streaming media servers, and reducing network bandwidth load. However, when multiple users request the same video traffic through a proxy, only one request is sent, creating significant security risks. While end-to-end encrypted HTTPS transmission protects the video content, it still leaks side-channel information such as packet transmission direction, packet length, and transmission time intervals. Attackers can observe the side-channel data characteristics of encrypted traffic, build a video fingerprint database, and steal encrypted video traffic content information within minutes. Malicious encrypted traffic analysis poses a more serious threat in the context of video traffic optimization proxies. Attackers only need to analyze a single data stream to steal the privacy of multiple users in a region watching the same video. Therefore, video traffic proxies need a secure and efficient optimization technology.

[0003] Intrinsic security technology refers to incorporating security functions into the design and development of systems or software, embedding them to enable security detection, defense, and response. Unlike traditional precision defense based on threat signature awareness, intrinsic security technology does not require prior knowledge of the attack source, characteristics, or specific behaviors. Instead, it improves the system's defense capabilities from within itself, making it an efficient measure to address the issue of attack-defense imbalance. By deploying intrinsic security technology within network infrastructure, switching devices gain self-detection and defense capabilities. However, most existing security functions on network switches currently target specific attacks and cannot protect against specific business operations, resulting in poor flexibility and high defense costs.

[0004] Traffic shaping is a network management technique designed to control network traffic transmission rates to ensure the rational allocation and utilization of network resources and improve service quality. Differential privacy protection technology is a method for protecting personal privacy during data publishing and analysis. It involves adding perturbations to the data to protect private data privacy without affecting the data analysis results. Summary of the Invention

[0005] Objective: To address the above-mentioned problems, this invention proposes a dynamic video traffic optimization and protection method for intrinsically secure switches. This method achieves efficient and secure video traffic optimization while protecting user privacy. Intrinsically secure switch devices are deployed on both the client and server sides. The client-side device is responsible for video traffic proxying and privacy protection processing. After intercepting identical video requests, only one request is sent to the server. The video traffic is then retrieved and distributed to the user for viewing. User video request duration and preference data are processed with differential privacy and used for statistical analysis by the device proxy to protect personal data privacy. The server-side device deploys a dynamic traffic shaping function based on network environment status indicators, which counteracts malicious encrypted traffic attacks by padding data packets with null bytes and changing packet intervals.

[0006] To achieve the objectives of this invention, the technical solution adopted is a dynamic video traffic optimization and protection method for intrinsically secure switches. This method intercepts and proxies video requests passing through the switch, and dynamically shapes the retrieved video traffic based on network environment conditions to ensure security during traffic transmission. Differential privacy protection processing is applied to the statistical information of user request data in the proxy device to ensure security during traffic caching. This method includes the following steps:

[0007] (1) After the intrinsic security switch enables the video traffic optimization proxy function, it continuously monitors and intercepts user video requests based on HTTP passing through the switch and uploads traffic deduplication module.

[0008] (2) The client-side intrinsic security switch constructs a user information table. The table records the user request data 5-tuple, URL, and timestamp, etc. The user information table with the same URL constitutes the video channel table. Records channel traffic caching, distribution, and user viewing time and frequency, etc., for a fixed duration. Update the user information table and video channel table to serve as the basis for subsequent video traffic proxy distribution and content analysis.

[0009] (3) The server-side intrinsic security switch pulls video traffic, adjusts the shaping method and specific frequency parameters based on the current network status indicators, and performs data packet filling and changes the packet interval time on video traffic with the goal of maximizing traffic shaping efficiency and minimizing resource consumption, so that the video traffic can improve the anti-encryption analysis function while ensuring service quality.

[0010] (4) The client-side intrinsic security switch device performs differential privacy processing based on the video channel table and the number of users. For user data of channels that require privacy protection, noise following a Laplace distribution is added, and noise is added at fixed intervals. The user data was then updated, and differential privacy processing was performed again.

[0011] (5) Repeat steps (1) to (4) until three consecutive steps are completed. After the specified time elapsed and no video update requests were made, the proxy process ended once both sides of the intrinsically secure switch devices had no pending traffic.

[0012] As an improvement to the present invention, the specific method for intercepting video request data packets in step (1) is as follows:

[0013] Intercept HTTP requests passing through the intrinsically secure switch, based on the URL. The system checks for the existence of 'mp4', '.avi', and '.mov' fields, and whether the HTTP request header's Accept field contains the video media type 'video / mp4', to determine if it's a request for video content. If so, the request is sent to the traffic deduplication module for further processing. If it's determined to be another type of HTTP request, the request data packet is passed through without going through the traffic deduplication module.

[0014] As an improvement of the present invention, the method for storing user information in step (2) is as follows:

[0015] (2.1) HTTP requests uploaded to the traffic deduplication module Create a user information table to store quintuple information { }, Video request URL timestamp In addition, for each Set two boolean variables, is_master and is_active, to indicate whether to establish a connection to the master session to pull traffic and whether the user remains active, respectively.

[0016] (2.2) Merge user information tables with the same URL And establish a video channel list, the first Each channel is represented as ,Depend on It consists of user requests with the same URL, used for unified management of video traffic requests and subsequent distribution within the switch.

[0017] (2.3) Set up a video traffic buffer for each channel This is used to cache parsed video traffic. Additionally, it sets the distribution time interval. The primary user session serves as the initial video distribution point, with fixed distribution intervals. It sends video traffic to users, and for new users added during the interval, it performs delayed distribution based on the time slice.

[0018] (2.4) Records The duration of each user session request With video request frequency In addition, a timed update schedule is set for the basic data used for statistics within the channel. Regularly update the relevant data in the channel table and user table, and delete... A user information table with a value of 0. Ensure consistency. There is only one user session. The attribute value is 1; if not, an active user is randomly selected as the main user to request user data within the same channel from the video server.

[0019] As an improvement of the present invention, the specific method for dynamic shaping of video traffic in step (3) is as follows:

[0020] (3.1) Define each flow This represents the length of a data packet and its timestamp within a flow. It sets the flow shaping method. These represent packet stuffing, inter-packet delay, and a hybrid method, respectively; the shaping frequency is defined as... Once the data stream enters the intrinsically secure switch, it is shaped using a defined processing method and frequency.

[0021] (3.2) Monitor the resource usage of the intrinsically secure switch equipment. This indicates CPU and memory utilization; it also monitors network link status metrics. , representing link latency, packet loss rate, and bandwidth utilization, respectively.

[0022] (3.3) Calculate based on switch resources and network link status indicators Network state parameters at any time ,

[0023] in The weight parameters for each indicator range from 0 to 1. Update network environment parameters once a day Set threshold .when When adopted Hybrid shaping; when Choose either packet padding or delayed transmission for processing; when This indicates a poor network environment; traffic will not be shaped to ensure normal service forwarding.

[0024] (3.4) For the input raw stream Perform flow shaping , indicating the first Types of plastic surgery Frequency processing. Processed traffic. .

[0025] (3.5) The server-side intrinsic security switch sends shaped video traffic. .

[0026] As an improvement to the present invention, the specific method of the overlapping path elimination algorithm in step (4) is as follows:

[0027] (4.1) The client-side intrinsic security switch distributes cached video traffic according to the channel table and user information table, and records the duration of each user receiving video traffic and the frequency data of requesting video. Time-based statistical analysis data is defined as

[0028] (4.2) Definition For the dataset without added noise The original query result then satisfies -Differential privacy requirements:

[0029]

[0030]

[0031] in Represents the dataset The nearest dataset is only one message away from the original data. Indicates privacy protection budget, The smaller the value, the higher the reliability of privacy protection, but the greater the noise introduced. If... This indicates that the video traffic dataset... With neighboring datasets The query results yielded the exact same output, meaning no user privacy was compromised. yes The function failed to limit privacy. The probability of. ,express Global sensitivity. Let Laplace distribution function and probability density function be used. The formula for noise that conforms to the Laplace distribution is as follows:

[0032]

[0033]

[0034] in It is a sign function, taking the value 1 for positive numbers and -1 for negative numbers. These are random numbers that follow a uniform distribution within the interval (-0.5, 0.5). By adding Laplace-distributed noise data to the user statistics data within the channel using the above method, the processed data is uploaded as the basis for statistical analysis of the switch's video proxy statistics.

[0035] This step ensures that the generated user video statistics protect personal data privacy without affecting the accuracy of channel analysis results, and does not expose data such as the duration and frequency of privately requested videos.

[0036] Beneficial effects: Compared with the prior art, the technical solution of the present invention has the following beneficial technical effects:

[0037] (1) This invention proposes a dynamic video traffic optimization and protection method for intrinsically secure switches. This invention is for video traffic optimization functions deployed in intrinsically secure switches. It can proxy the same video traffic requests passing through the switch and transfer the task of video traffic caching and distribution to the switch device. It effectively reduces link load and bandwidth pressure during periods of high traffic. It is of great significance for enriching network infrastructure functions and improving network management and optimization levels.

[0038] (2) In the context of traffic optimization proxy, this invention combines traffic shaping technology to dynamically adjust the shaping method of data flow by periodically monitoring the network environment status, thereby enhancing the ability to resist malicious traffic analysis attacks during traffic transmission without affecting the normal forwarding function.

[0039] (3) In the context of traffic optimization proxy, this invention combines differential privacy protection technology. On the client-side intrinsic security switch device, noise and interference are added to the private information of user request data. The specific statistical information and analysis of the proxy are not affected by individual private data, effectively protecting the security of personal privacy data. Attached Figure Description

[0040] Figure 1 A schematic diagram illustrating the dynamic video traffic optimization and protection functions for intrinsically secure switches;

[0041] Figure 2 A system architecture diagram for dynamic video traffic optimization and protection for intrinsically secure switches;

[0042] Figure 3 A schematic diagram illustrating the optimization strategy for client-side intrinsic security switches;

[0043] Figure 4 This is a schematic diagram of the server-side intrinsic security switch shaping strategy. Detailed Implementation

[0044] To enhance understanding of the present invention, a detailed description of the invention is provided below in conjunction with the accompanying drawings.

[0045] Example 1: A functional system for a dynamic video traffic optimization and protection method for intrinsically secure switches, such as... Figure 2 As shown, the overall structure is divided into two parts: a client-side traffic proxy optimization mechanism and a server-side status monitoring and traffic shaping protection mechanism.

[0046] like Figure 3 As shown, the client-side intrinsic security switch traffic proxy optimization mechanism matches HTTP video requests with the same URL, establishes a channel user table to record user five-tuple information, and deduplicates identical requests, proxying only one request to establish a connection and pull traffic. The cached video traffic is then redistributed according to the constructed user information table, and statistical information within the same channel is recorded. Differential privacy protection processing is applied to the obtained statistical information, adding a certain amount of noise to protect sensitive information such as individual video viewing time and request connection frequency.

[0047] The server-side intrinsic security switch traffic shaping protection mechanism dynamically adjusts traffic shaping measures by calculating network environment state parameters, thereby protecting channel information on the traffic side and possessing resistance to traffic analysis. For example... Figure 4 As shown, the switch device calculates network environment status indicators based on monitoring data and determines whether traffic shaping is required through threshold control. Data streams requiring shaping are modified by methods such as virtual packet filling and changing packet intervals to alter the statistical characteristics of the original data stream, thereby achieving security protection during traffic transmission.

[0048] Example 2: A method for dynamic video traffic optimization and protection for intrinsically secure switches. This method intercepts and proxies video requests passing through the switch, dynamically shapes the retrieved video traffic based on network conditions, and ensures security during traffic transmission. Differential privacy protection processing is applied to the statistical information of user request data in the proxy device to ensure security during traffic caching. This method includes the following steps:

[0049] (1) After the intrinsic security switch enables the video traffic optimization proxy function, it continuously monitors and intercepts user video requests based on HTTP passing through the switch and uploads traffic deduplication module.

[0050] (2) The client-side intrinsic security switch constructs a user information table. The table records the user request data 5-tuple, URL, and timestamp, etc. The user information table with the same URL constitutes the video channel table. Records channel traffic caching, distribution, and user viewing time and frequency, etc., for a fixed duration. Update the user information table and video channel table to serve as the basis for subsequent video traffic proxy distribution and content analysis.

[0051] (3) The server-side intrinsic security switch pulls video traffic, adjusts the shaping method and specific frequency parameters based on the current network status indicators, and performs data packet filling and changes the packet interval time on video traffic with the goal of maximizing traffic shaping efficiency and minimizing resource consumption, so that the video traffic can improve the anti-encryption analysis function while ensuring service quality.

[0052] (4) The client-side intrinsic security switch device performs differential privacy processing based on the video channel table and the number of users. For user data of channels that require privacy protection, noise following a Laplace distribution is added, and noise is added at fixed intervals. The user data was then updated, and differential privacy processing was performed again.

[0053] (5) Repeat steps (1) to (4) until three consecutive steps are completed. After the specified time elapsed and no video update requests were made, the proxy process ended once both sides of the intrinsically secure switch devices had no pending traffic.

[0054] The specific method for step (1) is as follows:

[0055] As an improvement to the present invention, the specific method for intercepting video request data packets in step (1) is as follows:

[0056] Intercept HTTP requests passing through the intrinsically secure switch, based on the URL. The system checks for the existence of 'mp4', '.avi', and '.mov' fields, and whether the HTTP request header's Accept field contains the video media type 'video / mp4', to determine if it's a request for video content. If so, the request is sent to the traffic deduplication module for further processing. If it's determined to be another type of HTTP request, the request data packet is passed through without going through the traffic deduplication module.

[0057] The method for storing user information in step (2) is as follows:

[0058] (2.1) HTTP requests uploaded to the traffic deduplication module Create a user information table to store quintuple information { }, Video request URL timestamp In addition, for each Set two boolean variables, is_master and is_active, to indicate whether to establish a connection to the master session to pull traffic and whether the user remains active, respectively.

[0059] (2.2) Merge user information tables with the same URL And establish a video channel list, the first Each channel is represented as ,Depend on It consists of user requests with the same URL, used for unified management of video traffic requests and subsequent distribution within the switch.

[0060] (2.3) Set up a video traffic buffer for each channel This is used to cache parsed video traffic. Additionally, it sets the distribution time interval. The primary user session serves as the initial video distribution point, with fixed distribution intervals. It sends video traffic to users, and for new users added during the interval, it performs delayed distribution based on the time slice.

[0061] (2.4) Records The duration of each user session request With video request frequency In addition, a timed update schedule is set for the basic data used for statistics within the channel. Regularly update the relevant data in the channel table and user table, and delete... A user information table with a value of 0. Ensure consistency. There is only one user session. The attribute value is 1; if not, an active user is randomly selected as the main user to request user data within the same channel from the video server.

[0062] The specific method for dynamic shaping of video traffic in step (3) is as follows:

[0063] (3.1) Define each flow This represents the length of a data packet and its timestamp within a flow. It sets the flow shaping method. These represent packet stuffing, inter-packet delay, and a hybrid method, respectively; the shaping frequency is defined as... Once the data stream enters the intrinsically secure switch, it is shaped using a defined processing method and frequency.

[0064] (3.2) Monitor the resource usage of the intrinsically secure switch equipment. This indicates CPU and memory utilization; it also monitors network link status indicators. , representing link latency, packet loss rate, and bandwidth utilization, respectively.

[0065] (3.3) Calculate based on switch resources and network link status indicators Network state parameters at any time ,

[0066] in The weight parameters for each indicator range from 0 to 1. Update network environment parameters once a day Set threshold .when When adopted Hybrid shaping; when Choose either packet padding or delayed transmission for processing; when This indicates a poor network environment; traffic will not be shaped to ensure normal service forwarding.

[0067] (3.4) For the input raw stream Perform flow shaping , indicating the first Types of plastic surgery Frequency processing. Processed traffic. .

[0068] (3.5) The server-side intrinsic security switch sends shaped video traffic. .

[0069] The specific method of the overlapping path elimination algorithm in step (4) is as follows:

[0070] (4.1) The client-side intrinsic security switch distributes cached video traffic according to the channel table and user information table, and records the duration of each user receiving video traffic and the frequency data of requesting video. Time-based statistical analysis data is defined as

[0071] (4.2) Definition For the dataset without added noise The original query result then satisfies -Differential privacy requirements:

[0072]

[0073]

[0074] in Represents the dataset The nearest dataset is only one message away from the original data. Indicates privacy protection budget, The smaller the value, the higher the reliability of privacy protection, but the greater the noise introduced. If... This indicates that the video traffic dataset... With neighboring datasets The query results yielded the exact same output, meaning no user privacy was compromised. yes The function failed to limit privacy. The probability of. ,express Global sensitivity. Let Laplace distribution function and probability density function be used. The formula for noise that conforms to the Laplace distribution is as follows:

[0075]

[0076]

[0077] in It is a sign function, taking the value 1 for positive numbers and -1 for negative numbers. These are random numbers that follow a uniform distribution within the interval (-0.5, 0.5). By adding Laplace-distributed noise data to the user statistics data within the channel using the above method, the processed data is uploaded as the basis for statistical analysis of the switch's video proxy statistics.

[0078] This step ensures that the generated user video statistics protect personal data privacy without affecting the accuracy of channel analysis results, and does not expose data such as the duration and frequency of privately requested videos.

[0079] like Figure 1 The diagram shown is a flowchart of in-band telemetry path planning based on segment routing.

[0080] First, several network streams are input. The activity level of a particular stream is determined using the following formula:

[0081] exist Within the time period, calculations show that the total amount of data sent by this stream is [amount missing]. ,like:

[0082]

[0083] If the flow is deemed active, its flag is set to 1. The formula uses the flag... iThe value is used to filter out existing active flows. TH The threshold for determining whether the current stream is active is calculated using the formula shown below:

[0084]

[0085] As can be seen from the above formula, the threshold setting is significantly related to the flow velocity variance. When the variance is less than a certain range... When (user-defined parameter values), flow TH The value will tend to 0, meaning that when the amount of data sent by all streams in a certain time slice is relatively uniform, the judgment of active streams can be relaxed. When the variance is large, the threshold setting and rate deviation are related to the proportion of large streams to all active streams. That is, if the amount of data sent by the current stream in a certain time slice is much smaller than the average of the current active streams, then the stream is more likely to be judged as an inactive stream.

[0086] To explain in detail the segment-based in-band telemetry path planning algorithm, the Euler path planning algorithm will be introduced. For example... Figure 2 The generated path diagram strictly satisfies the requirement that paths do not overlap. However, the starting and ending points of the generated paths may not meet the requirements of this study, and the requirement for the odd degree of the starting point is too strict. In a real-world environment, if node B can only serve as the endpoint of a flow, then some generated paths may be unusable.

[0087] Next, as Figure 3 and Figure 4 As shown, there are two main scenarios where a link in a network topology is repeatedly measured: one is due to path planning issues, causing the link to be traversed by two or more telemetry paths, i.e., multiple telemetry paths share a common edge; the second is due to certain requirements of the flow, causing the link to be traversed by the flow two or more times, i.e. So that, Regardless of the reason, every time the link is measured more than once, a node is added to the graph, leading to a new path. The idea of ​​adding auxiliary nodes is twofold: firstly, it eliminates overlapping paths and increases the telemetry range by adding new paths; secondly, it transforms nodes with even degrees into odd degrees, facilitating the execution of path planning algorithms.

[0088] To explain the segment-based in-band telemetry path planning algorithm in detail, the overlapping path elimination algorithm will then be introduced. In the generated path result set... If there are duplicate paths, then in Select adjacent nodes and introduce them. In addition to the paths mentioned above, overlapping paths should be eliminated as much as possible. When selecting nodes, due to the limitations of the actual problem, only nodes with adjacent links can be selected, and nodes cannot be fabricated out of thin air. For originally overlapping links, introducing new nodes and new paths can reduce redundancy and add new measurement paths.

[0089] The invention will now be described with reference to specific examples and the accompanying drawings. The invention comprises the following steps:

[0090] (1) Model the network topology and network flow. Model the network topology as an undirected connected graph. The flow is modeled as a six-tuple;

[0091] (2) Based on the existing and historical information of the flow in the network, determine whether the flow is active. Transform all original paths of flows that are determined to be active into connected subgraphs. ;

[0092] (3) Determine the connected graph Given the correspondence between the start and end points of each flow in the connected graph, the optimized Eulerian path algorithm is used to... Generate path result set Plan a network telemetry path scheme with fewer overlaps;

[0093] (4) Using the overlapping path elimination algorithm, the overlapping paths are migrated by adding auxiliary points, introducing new nodes and new links, reducing redundancy and generating the final path planning result.

[0094] To explain in detail the working steps of an in-band telemetry path planning algorithm based on segment routing, the following five use cases illustrate the working modes of the algorithm under different topology diagrams.

[0095] Experiment 1: Video Traffic Optimization Function Test

[0096] Experimental objective:

[0097] Test the data traffic saved before and after video optimization proxy to verify the optimization capability of video traffic deduplication.

[0098] Experimental steps:

[0099] 1. Deploy multiple clients, streaming media servers, and client-side built-in security switches in a Docker environment that request the same video content.

[0100] 2. If multiple clients request video content from the same URL, the request will be intercepted on the client-side device.

[0101] 3. Implement video traffic optimization proxy function according to the patent steps.

[0102] 4. Calculate successfully optimized video traffic data

[0103] Experiment 2: Test of the protective effect of dynamic video traffic shaping function

[0104] Experimental objective:

[0105] The test assesses the effectiveness of dynamic traffic shaping technology in defense, taking into account network environment conditions.

[0106] Experimental steps:

[0107] 1. Construct a malicious encrypted traffic analysis attacker-side client. Assuming the attacker has prior knowledge, they can steal video content information by establishing a video fingerprint database of the target server and based on traffic side-channel information.

[0108] 2. Monitor and calculate network environment status indicators according to the patented steps;

[0109] 3. Perform dynamic shaping processing of the video data stream according to the patented steps;

[0110] 4. Verify whether the traffic transmitted after shaping in the same network environment renders malicious traffic analysis invalid;

[0111] 5. Verify whether dynamic traffic shaping methods still have the ability to resist malicious traffic analysis under different network environments.

[0112] It should be noted that the above embodiments are merely preferred embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Equivalent substitutions or alternatives made based on the above technical solutions shall all fall within the scope of protection of the present invention.

Claims

1. A method for dynamic video traffic optimization and protection for intrinsically secure switches, characterized in that, The overall structure consists of three parts: a user request proxy mechanism, a video traffic dynamic shaping mechanism, and a user data differential privacy protection mechanism. The user request proxy mechanism acts as a man-in-the-middle proxy for identical video requests within the domain on the client-side intrinsically secure switch device. It distinguishes different groups based on the URL and stores user 5-tuple information. After the proxy obtains the video traffic, it redistributes it according to the group information, thereby achieving the proxy function of deduplicating video traffic and reducing the link load caused by identical video requests. The video traffic dynamic shaping mechanism performs dynamic packet filling, randomization, and packet interval alteration on the server-side built-in security switch to shape the traffic pulled from the server. This alters the original statistical characteristics of sensitive data streams, combating malicious encrypted traffic analysis attacks. The dynamic traffic shaping strategy is affected by switch device resource consumption, network link load, and video sensitivity, and can adjust the balance between the resource consumption of traffic shaping and the anti-encryption analysis effect of the shaped video traffic. The user data differential privacy protection mechanism on the client-side intrinsic security switch device performs differential privacy processing on the video content watched by the user, the duration of the requested video traffic, and the user's video viewing preferences. It protects the viewing information of individual users by adding noise that follows a Laplace distribution to the original data. The intrinsically secure switch, in its optimization process for video traffic, considers user privacy protection and countermeasures against malicious encrypted traffic analysis attacks. Combining traffic shaping and differential privacy protection methods, it achieves a highly efficient video traffic optimization function with intrinsic security capabilities and privacy protection attributes. The method includes the following steps: (1) After the intrinsic security switch enables the video traffic optimization proxy function, it continuously monitors and intercepts user video requests based on HTTP passing through the switch, and uploads them to the traffic deduplication module. (2) The client-side intrinsic security switch constructs a user information table. The table records the user's requested data 5-tuple, URL, and timestamp. User information tables with the same URL constitute the video channel table. Records channel traffic caching, distribution, user viewing time, frequency statistics, and fixed duration. Update the user information table and video channel table to serve as the foundational data for subsequent video traffic proxy distribution and content analysis. (3) The server-side built-in security switch pulls video traffic and adjusts the shaping method and specific frequency parameters based on the current network status indicators. With the goal of maximizing traffic shaping efficiency and minimizing resource consumption, it performs packet stuffing and changes the packet interval time on the video traffic, thereby improving the anti-encryption analysis function of the video traffic while ensuring service quality. (4) The client-side intrinsic security switch device performs differential privacy processing based on the video channel table and the number of users. For user data of channels that require privacy protection, noise following a Laplace distribution is added, and noise is added at fixed intervals. After updating user data, differential privacy processing is performed again. (5) Repeat steps (1) to (4) until three consecutive steps are completed. After the specified time elapsed and no video update requests were made, the proxy process ended once both sides of the intrinsically secure switch devices had no pending traffic.

2. The method for dynamic video traffic optimization and protection for intrinsically secure switches according to claim 1, characterized in that, The specific method for intercepting video requests in step (1) is as follows: Intercept HTTP requests passing through the intrinsically secure switch, based on the URL. The system checks whether the request is for video content and whether the fields 'mp4', '.avi', and '.mov' exist, as well as whether the HTTP request header field Accept contains the video media type 'video / mp4'. If the request is determined to be for other types of HTTP requests, the request data packet is passed through without going through the deduplication module.

3. The method for dynamic video traffic optimization and protection for intrinsically secure switches according to claim 2, characterized in that, The specific method for storing agent user information in step (2) is as follows: (2.1) HTTP requests uploaded to the traffic deduplication module Create a user information table to store quintuple information { }, respectively representing requests The source Source port, destination Destination port and protocol, video request URL timestamp In addition, for each set up and Two Boolean variables represent whether to establish a connection to the main session to pull traffic and whether the user remains active, respectively. (2.2) Merge user information tables with the same URL And establish a video channel list, the first Each channel is represented as ,Depend on This consists of user requests with the same URL, used for unified management of video traffic requests and subsequent distribution proxied within the switch. (2.3) Set up a video traffic buffer for each channel This is used to cache the parsed video traffic, and also sets the distribution time interval. The primary user session serves as the initial video distribution point, with fixed distribution intervals. To send video traffic to users, new users joining during the interval are processed with delayed distribution based on time slices. (2.4) Records The duration of each user session request With video request frequency In addition, a timed update schedule is set for the basic data used for statistics within the channel. Regularly update the relevant data in the channel table and user table, and delete... User information tables with a value of 0 are guaranteed to be identical. There is only one user session. The attribute value is 1; if not, an active user is randomly selected as the main user to request user data within the same channel from the video server.

4. The method for dynamic video traffic optimization and protection for intrinsically secure switches according to claim 2, characterized in that, The specific method for dynamic shaping of video traffic in step (3) is as follows: (3.1) Define each flow This indicates the length of data packets and their timestamps in a flow, and sets the flow shaping method. These represent packet stuffing, inter-packet delay, and a hybrid method, respectively; the shaping frequency is defined as... After the data stream enters the intrinsic security switch, it is processed using a defined method and frequency as a shaping mechanism. (3.2) Monitor the resource usage of the intrinsically secure switch equipment. This indicates CPU and memory utilization; it also monitors network link status indicators. , representing link latency, packet loss rate, and bandwidth utilization, respectively. (3.3) Calculate based on switch resources and network link status indicators Network state parameters at any time , in The weight parameters for each indicator range from 0 to 1. Update network status parameters once a day Set threshold ,when When adopted Hybrid shaping; when Choose either packet padding or delayed transmission for processing; when This indicates a poor network environment; traffic will not be shaped to ensure normal service forwarding. (3.4) For the input raw stream Perform flow shaping , indicating the first Types of plastic surgery Frequency processing, processed traffic ,in Indicates data packet The increased length after padding; Indicates data packet The increased latency after changing the private room delay time. (3.5) The server-side intrinsic security switch sends shaped video traffic. .

5. A method for dynamic video traffic optimization and protection for intrinsically secure switches according to claim 2, characterized in that, The specific method for step (4) is as follows: (4.1) The client-side intrinsic security switch distributes cached video traffic according to the channel table and user information table, and records the duration of each user receiving video traffic and the frequency data of requested video. Time-based statistical analysis data is defined as , (4.2) Definition For the dataset without added noise The original query result then satisfies -Differential privacy requirements: in Represents the dataset The nearest dataset is only one message away from the original dataset. Indicates privacy protection budget, The smaller the value, the higher the reliability of privacy protection, but the greater the noise introduced. This indicates a video traffic dataset. With neighboring datasets The query results yielded exactly the same output, meaning no user privacy was compromised. Indicates based on dataset The range of query results is The probability, Represent real numbers, yes The function failed to limit privacy. The probability, ,express global sensitivity, Let Laplace distribution function be used. These represent the location parameter and scale parameter of the distribution function, respectively. Representing the nearest dataset The query results after adding noise that follows a Laplace distribution. Represents noise data that follows a Laplace distribution, with probability density function The formula for noise that conforms to the Laplace distribution is as follows: in It is a sign function; it takes the value 1 for positive numbers and -1 for negative numbers. These are random numbers that follow a uniform distribution in the interval (-0.5, 0.5). Noise data following a Laplace distribution is added to the user statistics data within the channel using the above method. The processed data is then uploaded as the basis for statistical analysis of video agents by the switch.

Images