Parallel active communication interception system and method applied to mobile internet

Abstract

The invention discloses a parallel active communication interception system and method applied to a mobile internet, and the system achieves a distributed architecture through a cloud computing platform, and supports the efficient processing and analysis of large-scale data. Comprising a communication interception module used for capturing network communication data of a mobile terminal device and carrying out preliminary data cleaning and formatting processing; the threat analysis module is used for analyzing the captured network communication data in real time by adopting a pre-trained machine learning or deep learning model and identifying potential threats; and the interception decision module is used for determining whether to intercept according to the potential threat analysis result output by the threat analysis module in combination with a preset security policy. According to the system, active and real-time interception of mobile internet communication is realized, and the timeliness and effectiveness of safety protection are remarkably improved.

Description

Technical Field

[0001] The present invention relates to the technical fields of mobile Internet communication security, network communication interception technology and information security protection, and more specifically to a parallel active communication interception system and method applied to mobile Internet. Background Art

[0002] With the rapid development of mobile Internet, mobile terminal devices are increasingly used in daily life and work. However, the accompanying network communication security issues are also becoming increasingly prominent. Existing communication interception technologies are mainly based on passive defense, that is, interception after abnormal communication is detected. This passive protection method has the problem of delayed response, and has poor defense effect against new and unknown attack methods, which is difficult to meet the increasingly complex security needs.

[0003] The main communication security protection methods on the market include firewalls, intrusion detection systems (IDS), etc. These systems mostly use signature detection or rule-based analysis methods to intercept known malicious communications. However, with the continuous evolution of attack technology, new and unknown threats continue to emerge, and traditional passive protection methods seem to be unable to cope with these new threats.

[0004] Therefore, the passive protection means in the prior art have the following main defects:

[0005] Slow response speed: interception can only be performed after abnormal communication is detected, and there is a certain delay.

[0006] Poor ability to defend against new threats: There is a lack of effective defense mechanisms for new and unknown attack methods.

[0007] False positive and false negative issues: It is difficult to accurately distinguish between normal and malicious communications, which easily leads to false positives and false negatives, affecting system reliability and user experience.

[0008] Therefore, how to solve the defects of passive protection in the prior art is an urgent problem that technical personnel in this field need to solve. Summary of the invention

[0009] In view of this, the present invention provides a parallel active communication interception system and method applied to mobile Internet, aiming to overcome the defects of passive protection means in the prior art, such as delayed response and insufficient ability to defend against new threats, and realize active, real-time and intelligent interception and protection of mobile Internet communications.

[0010] In order to achieve the above object, the present invention adopts the following technical solution:

[0011] In a first aspect, an embodiment of the present invention provides a parallel active communication interception system applied to the mobile Internet, wherein the system implements a distributed architecture through a cloud computing platform and supports efficient processing and analysis of large-scale data; the system comprises:

[0012] The communication interception module is used to capture the network communication data of the mobile terminal device and perform preliminary data cleaning and formatting;

[0013] Threat analysis module, which uses pre-trained machine learning or deep learning models to analyze captured network communication data in real time to identify potential threats;

[0014] The interception decision module is used to determine whether to intercept based on the potential threat analysis results output by the threat analysis module and the preset security policy.

[0015] Furthermore, it also includes:

[0016] The database module is used to store historical communication data, threat signature database, and security policy information to support continuous learning and optimization of the system.

[0017] Furthermore, the communication interception module includes:

[0018] The data acquisition unit uses network card monitoring and data stream replication to obtain network communication data of mobile terminal devices in real time;

[0019] The data cleaning unit performs noise filtering and abnormal data removal on the acquired network communication data;

[0020] The data formatting unit converts the cleaned data into a unified analysis format.

[0021] Furthermore, the threat analysis module includes:

[0022] A feature extraction unit, used to extract multi-dimensional features from the processed communication data, including: communication frequency, data packet size, communication protocol type, source address, destination address, payload content and flow information;

[0023] The first analysis unit extracts multi-dimensional features and inputs them into a machine learning model to achieve classification and anomaly detection; the machine learning model trains a support vector machine or a random forest classification model based on historical communication data and annotated threat data to achieve threat identification;

[0024] The second analysis unit will extract multi-dimensional features and input them into a deep learning model to achieve threat score detection; the deep learning model is based on historical communication data and annotated threat data, and trains a hybrid model of an improved convolutional neural network combined with an attention mechanism to achieve threat identification.

[0025] Furthermore, in the first analysis unit, training a support vector machine or a random forest classification model includes:

[0026] A normalization unit extracts multi-dimensional features from the formatted communication data and performs normalization and dimensionality reduction processing;

[0027] Training classification units uses an improved random forest algorithm or support vector machine combined with ensemble learning, using normalized and dimensionally reduced annotated threat data for training, and optimizing hyperparameters through grid search or random search.

[0028] Furthermore, in the second analysis unit, training a hybrid model of an improved convolutional neural network combined with an attention mechanism includes:

[0029] The embedding unit is used to represent the payload content by word embedding to capture the semantic information in the content; the communication traffic is represented as a graph structure, and the graph embedding features are extracted through the graph neural network;

[0030] The training unit uses the embedded communication data feature vector as the input of the hybrid model of the improved convolutional neural network combined with the attention mechanism, performs iterative training, and uses the cross entropy loss function to optimize the model parameters;

[0031] The cross entropy loss function is as follows:

[0032]

[0033] Where N is the number of samples, y i is the true label, Predict probabilities for the model.

[0034] Furthermore, the interception decision module includes:

[0035] The policy engine unit is used to define and manage multi-level security policies, including whitelists, blacklists, and dynamic rules;

[0036] The decision logic unit is used to comprehensively consider the threat level and communication context factors and use a decision tree or Bayesian network algorithm to determine whether to intercept;

[0037] The execution unit sends the interception instruction to the communication interception module to realize the immediate interception of malicious communications.

[0038] Furthermore, it also includes: an adaptive learning and optimization module, which is used for the system to continuously collect and analyze communication data through the database module, and dynamically update the threat feature library and security policies.

[0039] Furthermore, the adaptive learning and optimization module specifically includes:

[0040] Model update unit, which is used to regularly retrain machine learning and deep learning models using the latest communication data to improve the accuracy of threat identification;

[0041] The policy adjustment unit is used to dynamically adjust security policies based on threat analysis results and interception effects, and optimize the accuracy and timeliness of interception decisions;

[0042] The feedback mechanism unit is used to establish a user feedback mechanism, collect false positive and false negative information, and improve the system's protection capabilities.

[0043] In a second aspect, an embodiment of the present invention further provides a method for parallel active communication interception applied to the mobile Internet, using the parallel active communication interception system applied to the mobile Internet as described in any one of the first aspects to implement parallel active communication interception of potential threats, the method comprising the following steps:

[0044] S10, connecting to the mobile network communication path and capturing the network communication data of the mobile terminal device in real time;

[0045] S20, performing preliminary data cleaning and formatting processing on the captured communication data;

[0046] S30. Use pre-trained machine learning or deep learning models to analyze the cleaned communication data in real time to identify potential threats;

[0047] S40, based on threat analysis results and preset security policies, quickly make decisions on whether to intercept;

[0048] S50: Send the interception instruction to the communication interception module to implement real-time interception of malicious communications.

[0049] It can be seen from the above technical solution that compared with the prior art, the present invention has the following advantages:

[0050] Active real-time interception: It realizes active and real-time interception of mobile Internet communications, significantly improving the timeliness and effectiveness of security protection.

[0051] Intelligent threat identification: Through advanced technologies such as machine learning and deep learning, it can identify and intercept new and unknown threats, enhancing the system's adaptability and intelligence level.

[0052] Efficient distributed processing: The distributed architecture based on cloud computing improves the scalability and processing power of the system, supports communication data processing of large-scale mobile terminal devices, and reduces operating costs.

[0053] Accurate decision-making mechanism: Combining multi-level security strategies and advanced decision-making algorithms, it ensures the accuracy and timeliness of interception decisions and reduces false positives and missed positives.

[0054] It is suitable for communication security protection of mobile terminal devices such as smartphones and tablets in the mobile Internet environment, especially in high-risk communication scenarios such as financial transactions, enterprise sensitive data transmission, and personal privacy protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0056] Figure 1 This is a structural diagram of the parallel active communication interception system applied to the mobile Internet provided by the present invention.

[0057] Figure 2 This is a structural diagram of the communication interception module provided by the present invention.

[0058] Figure 3 This is a structural diagram of the threat analysis module provided by the present invention.

[0059] Figure 4 This is a structural diagram of the interception decision module provided by the present invention.

[0060] Figure 5 This is a structural diagram of the adaptive learning and optimization module provided by the present invention. DETAILED DESCRIPTION

[0061] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0062] Embodiment 1:

[0063] The embodiment of the present invention discloses a parallel active communication interception system applied to mobile Internet, the system architecture is designed as a distributed structure and supported by a cloud computing platform; Figure 1 As shown, the system comprises:

[0064] The communication interception module is used to capture the network communication data of the mobile terminal device and perform preliminary data cleaning and formatting;

[0065] Threat analysis module, which uses pre-trained machine learning or deep learning models to analyze captured network communication data in real time to identify potential threats;

[0066] The interception decision module is used to determine whether to intercept based on the potential threat analysis results output by the threat analysis module and the preset security policy;

[0067] Database module, used to store historical communication data, threat signature database, and security policy information, supporting continuous learning and optimization of the system;

[0068] The adaptive learning and optimization module is used to dynamically update the threat signature library and security policies by continuously collecting and analyzing communication data.

[0069] In this embodiment, the system captures the communication data of the mobile terminal device in real time by connecting the communication interception module to the mobile network communication path. After the captured data is initially processed, it is transmitted to the threat analysis module for real-time analysis. The threat analysis results will be passed to the interception decision module, which will make a decision on whether to intercept based on the preset security policy. Finally, the interception instruction is sent to the communication interception module to complete the interception of malicious communications. The database module stores the historical data and threat feature library required by the system, and supports the continuous learning and optimization of the system. In addition, the system dynamically updates the threat feature library and security policy through the continuous collection and analysis of communication data by the database module. Active interception of mobile Internet communications is achieved, the defense capability against new and unknown threats is improved, and security vulnerabilities and response time are reduced.

[0070] The following is a detailed description of each of the above modules:

[0071] 1. Reference Figure 2 As shown, the communication interception module includes:

[0072] The data acquisition unit acquires the network communication data of the mobile terminal device in real time by using the network card monitoring and data stream replication.

[0073] The data cleaning unit performs noise filtering and abnormal data removal on the acquired network communication data;

[0074] The data formatting unit converts the cleaned data into a unified analysis format.

[0075] The communication interception module captures the network communication data of mobile terminal devices in real time by connecting to the mobile network communication path. The data acquisition unit uses efficient data packet capture technology to ensure the integrity and real-time nature of data capture; the data cleaning unit performs noise filtering and abnormal data removal on the captured data; the data formatting unit converts the data into a unified analysis format, such as JSON, XML, etc., to facilitate the processing of the threat analysis module.

[0076] Among them, the data acquisition unit, for example, uses an efficient packet capture tool library (such as libpcap, WinPcap) to capture network data packets. By deploying a network interface card (NIC) on the mobile network communication path or using network mirroring technology, all passing communication data is copied to the data acquisition unit for processing. In addition, multi-threading technology is used to process multiple data streams in parallel to improve the throughput and real-time performance of data capture. Each thread is responsible for processing a specific type of communication protocol (such as HTTP, HTTPS, TCP / IP, etc.) to ensure that data of different protocols can be efficiently captured and processed. Then, data stream replication technology (such as SPAN, PORT mirroring) is used to copy the communication data of the mobile terminal device to the data acquisition unit in real time to avoid data loss and capture delays.

[0077] The data cleaning unit removes noise and abnormal data to improve the accuracy of subsequent analysis. For example, noise filtering: By setting filtering rules, irrelevant or redundant data packets are removed. For example, communications related to system management (such as ARP requests, DHCP traffic, etc.) are filtered out, and only application layer data is retained. This also includes removing duplicate data.

[0078] In addition, statistical methods or machine learning algorithms are used to identify and remove abnormal data. For example, the Z-score method is used to detect abnormal values ​​of packet size:

[0079]

[0080] If |Z|>θ, the data packet is considered abnormal and needs to be removed. Here, X is the size of the data packet, μ is the mean, σ is the standard deviation, and θ is the threshold.

[0081] The data formatting unit converts the cleaned communication data into a unified analysis format to facilitate the processing and analysis of the threat analysis module. Define a unified data structure (such as JSON, XML) to represent the various attributes of the communication data. For example, the JSON format is used to represent the information of each data packet:

[0082] {"timestamp":"2024-04-27T10:15:30Z","sourceip":"192.168.1.2","destinatio nip":"192.168.1.10","sourceport":54321,"destinationport":80,"protocol":"HTTP","payload":"Base64EncodedData"}\{"timestamp":"2024-04-27T10:15:30Z"," source_ip":"192.168.1.2","destination_ip":"192.168.1.10","source_port":54321,"destination_port":80,"protocol":"HTTP","payload":"Base64EncodedData"

[0083] \}{"timestamp":"2024-04-27T10:15:30Z","sourceip":"192.168.1.2","destinatio ni p":"192.168.1.10","sourceport":54321,"destinationport":80,"protocol":"HTTP","payload":"Base64EncodedData"}

[0084] In addition, you can also use efficient serialization tools (such as JSON library, Protocol Buffers) to serialize data structures into a standard format for easy storage and transmission. Use timestamps for standardization, and convert the timestamps of all data packets to Coordinated Universal Time (UTC) to ensure time consistency and facilitate subsequent timing analysis.

[0085] This communication interception module can not only efficiently capture the network communication data of mobile terminal devices, but also ensure the high quality and consistency of the data through multi-level data preprocessing and formatting, providing a solid data foundation for the subsequent threat analysis module.

[0086] 2. The threat analysis module uses advanced machine learning and deep learning algorithms to perform real-time analysis on the cleaned communication data. It is the core part of the system and uses multi-level machine learning and deep learning algorithms for threat identification. Specifically, first, through data mining technology, multi-dimensional features are extracted from the communication data, including but not limited to communication frequency, data packet size, protocol type, source address, destination address, etc. Secondly, using historical communication data and threat feature libraries, a variety of classification models (such as support vector machines, random forests) and deep learning models (such as convolutional neural networks, recurrent neural networks) are trained to improve the accuracy and generalization ability of threat identification. Finally, the real-time communication data is input into the trained model for classification and anomaly detection to identify potential malicious communication behaviors in real time.

[0087] This module uses two main methods to achieve threat identification: Method 1 is threat analysis based on traditional machine learning, and Method 2 is threat analysis based on deep learning. In order to improve the recognition accuracy and system robustness, the present invention also improves the existing network model and adopts an unconventional model structure to adapt to the complex and changeable threat scenarios in the mobile Internet environment.

[0088] Reference Figure 3 As shown, the threat analysis module includes:

[0089] A feature extraction unit, used to extract multi-dimensional features from the processed communication data, including: communication frequency, data packet size, communication protocol type, source address, destination address, payload content and flow information;

[0090] The first analysis unit extracts multi-dimensional features and inputs them into a machine learning model to achieve classification and anomaly detection; the machine learning model trains a support vector machine or a random forest classification model based on historical communication data and annotated threat data to achieve threat identification;

[0091] The second analysis unit will extract multi-dimensional features and input them into a deep learning model to achieve threat score detection; the deep learning model is based on historical communication data and annotated threat data, and trains a hybrid model of an improved convolutional neural network combined with an attention mechanism to achieve threat identification.

[0092] (1) Method 1: Threat analysis based on traditional machine learning:

[0093] Using traditional machine learning algorithms, communication data is classified and anomaly detected to identify known and unknown malicious communication behaviors.

[0094] Implementation steps:

[0095] 1) Feature extraction: Extract multi-dimensional features from the formatted communication data, including but not limited to:

[0096] Traffic characteristics: such as communication frequency, packet size, communication duration, connection duration, etc.

[0097] Protocol characteristics: such as the type of communication protocol used (HTTP, HTTPS, TCP / IP, etc.).

[0098] Behavioral characteristics: such as the geographical distribution of source IP and target IP, port number usage patterns, etc.

[0099] Content characteristics: such as keyword matching of payload content, encryption level, etc.

[0100] The formula means:

[0101] F = {f1, f2, ..., f n}

[0102] Among them, F represents the extracted feature vector, f i is the ith feature.

[0103] 2) Data preprocessing:

[0104] Normalization: Normalize the feature values ​​to ensure that the weights of different features are balanced.

[0105] Dimensionality reduction: Use methods such as principal component analysis (PCA) or linear discriminant analysis (LDA) to reduce the dimension of the feature space and reduce computational complexity.

[0106] Normalization formula:

[0107]

[0108] Among them, f′ i is the normalized i-th feature, μ i and σ i are the mean and standard deviation of the ith feature, respectively.

[0109] 3) Model training:

[0110] Selection algorithm: Use the improved Random Forest algorithm combined with the ensemble learning method to improve classification performance.

[0111] Training process: Use historical communication data and annotated threat data to train the random forest model.

[0112] Random Forest Formula:

[0113]

[0114] in, is the prediction result, T is the number of trees, h t(F) is the prediction result of the tth decision tree.

[0115] 4) Real-time analysis:

[0116] Classification and detection: The features of real-time communication data are input into the trained random forest model for classification and anomaly detection.

[0117] Threat identification: Determine whether there is a potential threat based on the category label or anomaly score output by the model.

[0118] Classification decision formula:

[0119]

[0120] Use methods such as recursive feature elimination (RFE) to select the most discriminative features for threat identification to further improve model performance. Optimize the hyperparameters of random forests, such as the number of trees and maximum depth, through grid search or random search to improve classification accuracy.

[0121] Example description:

[0122] Assume that the system captures a set of HTTP communication data, extracts features such as communication frequency, data packet size, and communication duration through the feature extraction unit, and performs normalization and dimensionality reduction. The processed feature vector is input into the trained random forest model, and the model outputs the category label as "malicious". The system determines that the communication is a potential threat and marks it as an object that needs to be intercepted.

[0123] (2) Method 2: Threat analysis based on deep learning

[0124] Utilize deep learning algorithms to perform more complex and advanced feature extraction and pattern recognition on communication data, improving the ability to detect new and complex threats.

[0125] 1) Implementation steps:

[0126] Use embedding techniques to convert communication data into high-dimensional vector representations, including but not limited to:

[0127] Word embedding: The payload content is represented by word embedding (such as Word2Vec, GloVe) to capture the semantic information in the content. Graph embedding: The communication traffic is represented as a graph structure, and the graph embedding features are extracted through the graph neural network (GNN).

[0128] Embedding formula:

[0129] E=Embedding(C)

[0130] Among them, E is the embedded feature vector, and C is the communication data content.

[0131] 2) Deep Neural Network Model:

[0132] A hybrid model combining an improved convolutional neural network (CNN) and an attention mechanism is used to improve feature extraction capabilities and model interpretability.

[0133] Model structure:

[0134] Input layer: accepts the embedded communication data feature vector.

[0135] Convolutional layer: extracts local features through multiple convolution kernels to capture spatial patterns in the data.

[0136] Attention layer: The self-attention mechanism is introduced to enhance the weight of important features and improve the model's sensitivity to key threat features.

[0137] Fully connected layer: Integrate the extracted features and output the final classification results.

[0138] Convolutional layer formula:

[0139] C = Conv(E, W)

[0140] Among them, C is the feature map after convolution, and W is the convolution kernel weight.

[0141] Attention mechanism formula:

[0142]

[0143] Among them, d k is the dimension of the key, and the Softmax function is used to calculate the attention weight.

[0144] 3) Model training:

[0145] Data enhancement: Increase the diversity of training data and improve the generalization ability of the model through data enhancement techniques (such as noise injection and data perturbation). Use the cross-entropy loss function to optimize model parameters and ensure classification accuracy.

[0146] Cross entropy loss formula:

[0147]

[0148] Where N is the number of samples, y i is the true label, Predict probabilities for the model.

[0149] 4) Real-time analysis:

[0150] Forward propagation: Input the real-time communication data into the trained deep neural network model for forward propagation to obtain the threat score.

[0151] Threat determination: Determine whether there is a potential threat based on the threat score and preset threshold.

[0152] Threat score formula:

[0153] Score = σ(W o H+b o )

[0154] Among them, σ is the activation function (such as Sigmoid), H is the output of the fully connected layer, and w o and b o are the output layer weights and biases.

[0155] Technologies such as residual connections and batch normalization can be used to improve the training efficiency and stability of deep neural networks. Secondly, hyperparameters of deep neural networks, such as learning rate, batch size, network depth, etc., can be optimized through Bayesian optimization or genetic algorithms. Finally, model pruning and quantization technologies can be used to reduce model size, increase inference speed, and adapt to real-time analysis needs in the mobile Internet environment.

[0156] Example description:

[0157] Assume that the system captures a set of HTTPS communication data and converts the payload content into a high-dimensional vector representation through word embedding technology. The embedded feature vector is input into the improved CNN-attention hybrid model. The model extracts local features through the convolution layer and enhances the weight of key features through the attention layer. Finally, the model outputs a threat score of 0.85 (assuming the threshold is 0.7). The system determines that the communication is a high-risk threat and marks it as an object that needs to be intercepted.

[0158] In this embodiment, the threat analysis module is tightly integrated with other modules in the system and works together to achieve efficient threat detection and protection.

[0159] Integration with communication interception module:

[0160] The communication interception module transmits the formatted communication data to the threat analysis module in real time to ensure timely data processing. After completing the analysis, the threat analysis module passes the threat identification results to the interception decision module to guide whether to intercept the communication.

[0161] Collaboration with database module:

[0162] The threat analysis module obtains historical communication data and threat signature library from the database module to support model training and optimization. During the analysis process, the module stores new threat signatures and communication data in the database module to enrich the threat signature library and improve the system's long-term protection capabilities.

[0163] Integration with Adaptive Learning and Optimization Module:

[0164] The threat analysis module continuously improves models and strategies through adaptive learning and optimization mechanisms, thereby enhancing the accuracy of threat identification and the adaptive capabilities of the system. User feedback information is fed back to the threat analysis module through an adaptive mechanism to adjust and optimize the analysis model.

[0165] 3. Reference Figure 4 As shown, the interception decision module includes:

[0166] The policy engine unit is used to define and manage multi-level security policies, including whitelists, blacklists, and dynamic rules;

[0167] The decision logic unit is used to comprehensively consider the threat level and communication context factors and use a decision tree or Bayesian network algorithm to determine whether to intercept;

[0168] The execution unit sends the interception instruction to the communication interception module to realize the instant interception of malicious communications and ensure the efficiency and reliability of the system.

[0169] Among them, a whitelist is a security policy that refers to a list of behaviors, communications, or applications that are allowed to pass. Only items explicitly listed in the whitelist are allowed to be accessed or executed, and all other unlisted behaviors or communications are blocked. Whitelists are often used in highly secure environments, such as in financial institutions or corporate intranets, to allow only specific applications and devices to access sensitive resources.

[0170] A blacklist is the opposite of a whitelist and contains a list of behaviors, communications, or applications that are explicitly denied. Items on a blacklist are prohibited from access, while items not on a blacklist are allowed by default. Blacklists are often used to block known malicious behavior or untrusted traffic, such as known malicious IP addresses, malware, or spammers.

[0171] Dynamic rules are a more intelligent security strategy. Unlike static whitelists and blacklists, dynamic rules can be adaptively adjusted according to real-time network conditions, behavior patterns, and threat analysis results. These rules are not pre-fixed, but dynamically generated or modified according to the environment and threat situation when the system is running. Dynamic rules are widely used in advanced network security systems, such as intrusion detection systems (IDS) or next-generation firewalls (NGFW), which generate security policies by analyzing network traffic in real time. They have adaptive capabilities and can quickly respond to new threats and unknown attacks. They reduce the possibility of false positives and false negatives and improve the overall intelligence level of the system.

[0172] In actual network protection, whitelists, blacklists, and dynamic rules are used in combination to provide comprehensive security protection that can both defend against known threats and quickly respond to new, unknown attacks.

[0173] 4. The database module adopts a distributed database architecture (such as Hadoop, NoSQL database) to support high-concurrency data read and write operations. It stores a large amount of historical communication data, threat signature library and security policy information. This module supports high-concurrency data read and write operations to ensure the high availability and scalability of the system. At the same time, the database module works together with the threat analysis module and the adaptive learning and optimization module to achieve continuous training and optimization of the model and improve the system's adaptive ability.

[0174] The module mainly stores the following information:

[0175] Historical communication data: records the historical communication behavior of mobile terminal devices for threat analysis modules to train and optimize models.

[0176] Threat signature library: Stores identified threat signatures, including characteristics and behavior patterns of known malicious communications.

[0177] Security policy: Save the system's multi-level security policy and support dynamic updating and management of the policy.

[0178] 5. The adaptive learning and optimization module includes: the adaptive learning and optimization module, which is used for the system to continuously collect and analyze communication data through the database module, and dynamically update the threat signature library and security policies.

[0179] Reference Figure 5 As shown, the adaptive learning and optimization module specifically includes:

[0180] Model update unit, which is used to regularly retrain machine learning and deep learning models using the latest communication data to improve the accuracy of threat identification;

[0181] The policy adjustment unit is used to dynamically adjust security policies based on threat analysis results and interception effects, and optimize the accuracy and timeliness of interception decisions;

[0182] The feedback mechanism unit is used to establish a user feedback mechanism, collect false positive and false negative information, and improve the system's protection capabilities.

[0183] The parallel active communication interception system applied to the mobile Internet provided by the present invention realizes active and real-time interception of mobile Internet communications, significantly improving the timeliness and effectiveness of security protection. It can identify and intercept new and unknown threats through advanced technologies such as machine learning and deep learning, enhancing the system's adaptability and intelligence level. In addition, the distributed architecture based on cloud computing improves the scalability and processing power of the system, supports communication data processing of large-scale mobile terminal devices, and reduces operating costs. It can be combined with multi-level security strategies and advanced decision-making algorithms to ensure the accuracy and timeliness of interception decisions and reduce false positives and missed reports.

[0184] Embodiment 2:

[0185] Based on the same inventive concept, the present invention also provides a parallel active communication interception method applied to the mobile Internet, using the parallel active communication interception system applied to the mobile Internet as in Example 1 to implement parallel active communication interception of potential threats, the method comprising the following steps:

[0186] S10, connecting to the mobile network communication path and capturing the network communication data of the mobile terminal device in real time;

[0187] S20, performing preliminary data cleaning and formatting processing on the captured communication data;

[0188] S30. Use pre-trained machine learning or deep learning models to analyze the cleaned communication data in real time to identify potential threats;

[0189] S40, based on threat analysis results and preset security policies, quickly make decisions on whether to intercept;

[0190] S50: Send the interception instruction to the communication interception module to implement real-time interception of malicious communications.

[0191] S60, storing communication data, threat characteristics and security policies in a database module to support continuous learning and optimization of the system;

[0192] S70. Through adaptive learning and optimization mechanisms, dynamically adjust threat analysis models and security strategies to enhance the system's protection capabilities.

[0193] The method of the present invention significantly improves the security protection capability of mobile Internet communications by combining real-time interception, intelligent threat analysis, adaptive learning and dynamic optimization, and has higher interception accuracy, real-time and system scalability. These technical effects are helpful in coping with the increasingly complex security challenges in the mobile Internet environment.

[0194] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0195] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A parallel active communication interception system applied to mobile Internet, It is characterized in that The system realizes a distributed architecture through a cloud computing platform, supporting efficient processing and analysis of large-scale data; the system includes: The communication interception module is used to capture the network communication data of the mobile terminal device and perform preliminary data cleaning and formatting; Threat analysis module, which uses pre-trained machine learning or deep learning models to analyze captured network communication data in real time to identify potential threats; The interception decision module is used to determine whether to intercept based on the potential threat analysis results output by the threat analysis module and the preset security policy.

2. According to claim 1, a parallel active communication interception system applied to mobile Internet, It is characterized in that Also includes: The database module is used to store historical communication data, threat signature database, and security policy information to support continuous learning and optimization of the system.

3. According to claim 1, a parallel active communication interception system applied to mobile Internet, It is characterized in that The communication interception module comprises: The data acquisition unit uses network card monitoring and data stream replication to obtain network communication data of mobile terminal devices in real time; The data cleaning unit performs noise filtering and abnormal data removal on the acquired network communication data; The data formatting unit converts the cleaned data into a unified analysis format.

4. According to claim 1, a parallel active communication interception system applied to mobile Internet, It is characterized in that The threat analysis module includes: A feature extraction unit, used to extract multi-dimensional features from the processed communication data, including: communication frequency, data packet size, communication protocol type, source address, destination address, payload content and flow information; The first analysis unit extracts multi-dimensional features and inputs them into a machine learning model to achieve classification and anomaly detection; the machine learning model trains a support vector machine or a random forest classification model based on historical communication data and annotated threat data to achieve threat identification; The second analysis unit will extract multi-dimensional features and input them into a deep learning model to achieve threat score detection; the deep learning model is based on historical communication data and annotated threat data, and trains a hybrid model of an improved convolutional neural network combined with an attention mechanism to achieve threat identification.

5. According to claim 4, a parallel active communication interception system applied to mobile Internet, It is characterized in that In the first analysis unit, training a support vector machine or a random forest classification model includes: A normalization unit extracts multi-dimensional features from the formatted communication data and performs normalization and dimensionality reduction processing; Training classification units uses an improved random forest algorithm or support vector machine combined with ensemble learning, using normalized and dimensionally reduced annotated threat data for training, and optimizing hyperparameters through grid search or random search.

6. According to claim 4, a parallel active communication interception system applied to mobile Internet, It is characterized in that In the second analysis unit, a hybrid model combining an improved convolutional neural network and an attention mechanism is trained, including: The embedding unit is used to represent the payload content by word embedding to capture the semantic information in the content; the communication traffic is represented as a graph structure, and the graph embedding features are extracted through the graph neural network; The training unit uses the embedded communication data feature vector as the input of the hybrid model of the improved convolutional neural network combined with the attention mechanism, performs iterative training, and uses the cross entropy loss function to optimize the model parameters; The cross entropy loss function is as follows: Where N is the number of samples, y i is the true label, Predict probabilities for the model.

7. According to claim 1, a parallel active communication interception system applied to mobile Internet, It is characterized in that The interception decision module comprises: The policy engine unit is used to define and manage multi-level security policies, including whitelists, blacklists, and dynamic rules; The decision logic unit is used to comprehensively consider the threat level and communication context factors and use a decision tree or Bayesian network algorithm to determine whether to intercept; The execution unit sends the interception instruction to the communication interception module to realize the immediate interception of malicious communications.

8. According to claim 2, a parallel active communication interception system applied to mobile Internet, It is characterized in that Also includes: The adaptive learning and optimization module is used for the system to continuously collect and analyze communication data through the database module, and dynamically update the threat signature library and security policies.

9. The active communication interception system for mobile Internet according to claim 8, It is characterized in that The adaptive learning and optimization module specifically includes: Model update unit, which is used to regularly retrain machine learning and deep learning models using the latest communication data to improve the accuracy of threat identification; The policy adjustment unit is used to dynamically adjust security policies based on threat analysis results and interception effects, and optimize the accuracy and timeliness of interception decisions; The feedback mechanism unit is used to establish a user feedback mechanism, collect false positive and false negative information, and improve the system's protection capabilities.

10. A parallel active communication interception method applied to mobile Internet, It is characterized in that Using the parallel active communication interception system applied to the mobile Internet as described in any one of claims 1 to 9, the parallel active communication interception potential threat is realized, and the method comprises the following steps: S10, connecting to the mobile network communication path and capturing the network communication data of the mobile terminal device in real time; S20, performing preliminary data cleaning and formatting processing on the captured communication data; S30. Use pre-trained machine learning or deep learning models to analyze the cleaned communication data in real time to identify potential threats; S40, based on threat analysis results and preset security policies, quickly make decisions on whether to intercept; S50: Send the interception instruction to the communication interception module to implement real-time interception of malicious communications.

Images