Forward proxy tunnel monitoring method and system and storage medium

Abstract

The invention discloses a forward proxy tunnel monitoring method and system and a storage medium, and the method comprises the steps: analyzing a first data feature transmitted by a first forward proxy tunnel, and obtaining a first tunnel state vector; judging whether a tunnel fault occurs or not based on the first tunnel state vector, and if the tunnel fault occurs, re-establishing the connection of a second forward proxy tunnel; analyzing a second data feature in the second forward proxy tunnel to obtain a second tunnel state vector, evaluating the second tunnel state vector to obtain an evaluation result, and matching a corresponding execution strategy based on the evaluation result. The state of the tunnel can be monitored in real time, and the stability and reliability of the tunnel are improved.

Description

Technical Field

[0001] The present application relates to the field of tunnel scanning technology, and in particular to a forward proxy tunnel monitoring method, system and storage medium. Background Art

[0002] As a bridge for external networks to access internal resources, the forward proxy tunnel is easily targeted by attackers. Monitoring the tunnel can promptly detect and block potential malicious traffic, protect internal network security, and help detect and prevent internal threats caused by improper use by internal users.

[0003] When monitoring a forward proxy tunnel, the existing technology needs to adopt a variety of scanning strategies and technologies to fully obtain the status of the tunnel. However, frequent scanning behavior can easily trigger the security defense mechanism of the tunnel, thereby affecting the scanning behavior and, more seriously, affecting the connection of the tunnel.

[0004] Application Contents

[0005] The present application provides a forward proxy tunnel monitoring method, system and storage medium to monitor the status of the tunnel in real time and improve the stability and reliability of the tunnel.

[0006] In a first aspect, the present application provides a forward proxy tunnel monitoring method, comprising:

[0007] Analyze the first data characteristics transmitted by the first forward proxy tunnel to obtain a first tunnel state vector;

[0008] determining whether a tunnel failure occurs based on the first tunnel state vector, and if a tunnel failure occurs, reestablishing a connection of a second forward proxy tunnel;

[0009] The second data feature in the second forward proxy tunnel is analyzed to obtain a second tunnel state vector, the second tunnel state vector is evaluated to obtain an evaluation result, and a corresponding execution strategy is matched based on the evaluation result.

[0010] The embodiment of the present application analyzes the first data feature transmitted by the first forward proxy tunnel to obtain the first tunnel state vector, and can monitor the data transmitted by the first forward proxy tunnel in real time, so as to facilitate the subsequent judgment of the tunnel situation; based on the first tunnel state vector, it is judged whether a tunnel failure occurs, and the second forward proxy tunnel is rebuilt to solve the tunnel failure, so as to realize intelligent tunnel fault monitoring and fault handling; in the process of rebuilding the tunnel, network performance and data transmission will be affected. By analyzing the second data feature in the second forward proxy tunnel to obtain the second tunnel state vector, the state of the rebuilt second forward proxy tunnel can be evaluated to judge the state in the second forward proxy tunnel, whether there is an abnormal state and attack behavior, etc., and different execution strategies are matched according to different evaluation results to improve the stability and reliability of the tunnel.

[0011] Furthermore, before analyzing the first data feature transmitted by the first forward proxy tunnel, the method further includes:

[0012] Analyze the properties of the target system through the decision tree algorithm to obtain the optimal property set;

[0013] Generating a plurality of first scanning strategy combinations by permuting and combining the optimal attribute sets;

[0014] Performing random processing on a plurality of the first scanning strategy combinations to obtain a plurality of scanning schemes;

[0015] Using Monte Carlo simulation to evaluate each of the scanning schemes, if the score of each of the scanning schemes is lower than a first preset threshold, optimizing each of the scanning schemes by a genetic algorithm to generate a plurality of second scanning strategy combinations;

[0016] Based on the situation of the target system, an optimal scanning solution is selected from several combinations of the second scanning strategies.

[0017] In this way, the scanning plan is determined by the attributes of the target system, and the scanning plan is scored and optimized. Based on the target system, the scanning plan with the highest comprehensive score, the highest scanning efficiency, the strongest concealment and the widest target coverage can be selected. This can cope with different target systems and defense measures, and improve the comprehensiveness and accuracy of the scan.

[0018] Further, the first data feature transmitted by the first forward proxy tunnel is analyzed to obtain a first tunnel state vector, specifically:

[0019] Capturing a data packet transmitted by the first forward proxy tunnel, and extracting a first data feature in the data packet;

[0020] The first data feature is analyzed using a support vector machine to obtain a first tunnel state vector.

[0021] In this way, by analyzing the first data feature transmitted by the first forward proxy tunnel to obtain the first tunnel state vector, the data transmitted by the first forward proxy tunnel can be monitored in real time, which facilitates subsequent judgment of the tunnel situation.

[0022] Further, judging whether a tunnel failure occurs based on the first tunnel state vector, and if a tunnel failure occurs, re-establishing a connection of the second forward proxy tunnel, specifically:

[0023] Normalizing the first tunnel state vector to obtain a third tunnel state vector;

[0024] Calculating the Mahalanobis distance between the third tunnel vectors;

[0025] If the Mahalanobis distance between the third tunnel vectors is greater than a second preset threshold, it is determined that a tunnel failure occurs, and the connection of the second forward proxy tunnel is reestablished.

[0026] In this way, whether a tunnel failure occurs can be determined based on the Mahalanobis distance between tunnel state vectors, and the tunnel failure can be resolved by rebuilding a second forward proxy tunnel. This can achieve intelligent tunnel fault monitoring and fault handling, and improve tunnel stability and reliability.

[0027] Further, the second tunnel state vector is evaluated to obtain an evaluation result, and based on the evaluation result, a corresponding execution strategy is matched, specifically:

[0028] Evaluate the second tunnel state vector by using a preset tunnel state evaluation model to form a tunnel state evaluation result;

[0029] Based on the tunnel status evaluation result, a weighted round-robin scheduling algorithm is used to dynamically calculate and adjust the weight coefficient of the second forward proxy tunnel;

[0030] Dynamically adjust the forwarding path and traffic ratio of the second forward proxy tunnel using software defined network technology;

[0031] The weight coefficient, the forwarding path and the flow ratio are optimized using a preset simulated annealing algorithm.

[0032] In this way, the parameter optimization process can be periodically re-triggered according to changes in the tunnel status, and the tunnel weight and forwarding rules can be dynamically updated to minimize the transmission delay jitter and packet loss rate of business requests, improve load balancing performance and link utilization, and improve tunnel stability and reliability.

[0033] Further, the second tunnel state vector is evaluated to obtain an evaluation result, and based on the evaluation result, a corresponding execution strategy is matched, specifically:

[0034] Calculating an anomaly score of the second tunnel state vector by an isolation forest algorithm;

[0035] If the abnormality score is greater than the third preset threshold, it is determined that the second forward proxy tunnel has an attack behavior, and the connection of the third forward proxy tunnel is re-established.

[0036] In this way, by analyzing the second data feature in the second forward proxy tunnel to obtain the second tunnel state vector, the state of the reconstructed second forward proxy tunnel can be evaluated to determine whether there is abnormal behavior in the second forward proxy tunnel, thereby facilitating matching of corresponding disposal strategies and improving the stability and reliability of the tunnel.

[0037] Further, the second tunnel state vector is evaluated to obtain an evaluation result, and based on the evaluation result, a corresponding execution strategy is matched, specifically:

[0038] Inputting the second tunnel state vector into a preset graph attention network model;

[0039] Calculating the risk probability of the second forward proxy tunnel by using the graph attention network model;

[0040] If the risk probability is greater than a fourth preset threshold, the routing forwarding strategy of the second forward proxy tunnel is dynamically adjusted or the transport layer protocol is optimized.

[0041] In this way, by analyzing the second data feature in the second forward proxy tunnel to obtain the second tunnel state vector, the state of the reconstructed second forward proxy tunnel can be evaluated to determine whether there is an attack behavior in the second forward proxy tunnel, so as to facilitate matching of the corresponding disposal strategy, achieve more accurate and efficient fault defense and resource scheduling, and thus improve the stability and reliability of the tunnel.

[0042] Further, the second tunnel state vector is evaluated to obtain an evaluation result, and based on the evaluation result, a corresponding execution strategy is matched, specifically:

[0043] Classifying the second tunnel state vector to obtain a corresponding health level;

[0044] A third scanning strategy corresponding to the second forward proxy tunnel matching at different health levels;

[0045] The third scanning strategy is optimized using a multi-objective particle swarm optimization algorithm to obtain an optimal scanning parameter combination.

[0046] In this way, by matching the corresponding scanning strategy based on the second tunnel state vector and optimizing the scanning strategy, it can be ensured that the second forward proxy tunnel can be scanned comprehensively and accurately.

[0047] Furthermore, after matching the corresponding execution strategy based on the evaluation result, the method further includes:

[0048] Scanning strategy selection, tunnel status detection and security threat detection are mapped to Markov decision processes respectively;

[0049] The Markov decision process is solved by a deep deterministic policy gradient algorithm to obtain the optimal state-action mapping strategy;

[0050] The hyperparameters of the deep deterministic policy gradient algorithm are adjusted to output intelligent decisions integrating scanning strategy selection, tunnel status detection, and security threat detection.

[0051] In this way, by constructing a Markov decision process, scanning efficiency, concealment, tunnel performance and security risks can be dynamically weighed.

[0052] In a second aspect, the present application provides a forward proxy tunnel monitoring system, including: an analysis module, a reconstruction module and an evaluation module;

[0053] The analysis module is used to analyze the first data characteristics transmitted by the first forward proxy tunnel to obtain a first tunnel state vector;

[0054] The reconstruction module is used to determine whether a tunnel failure occurs based on the first tunnel state vector, and if a tunnel failure occurs, reestablish the connection of the second forward proxy tunnel;

[0055] The evaluation module is used to analyze the second data feature in the second forward proxy tunnel to obtain a second tunnel state vector, evaluate the second tunnel state vector to obtain an evaluation result, and match a corresponding execution strategy based on the evaluation result.

[0056] The embodiment of the present application analyzes the first data feature transmitted by the first forward proxy tunnel to obtain the first tunnel state vector, and can monitor the data transmitted by the first forward proxy tunnel in real time, so as to facilitate the subsequent judgment of the tunnel situation; based on the first tunnel state vector, it is judged whether a tunnel failure occurs, and the second forward proxy tunnel is rebuilt to solve the tunnel failure, so as to realize intelligent tunnel fault monitoring and fault handling; in the process of rebuilding the tunnel, network performance and data transmission will be affected. By analyzing the second data feature in the second forward proxy tunnel to obtain the second tunnel state vector, the state of the rebuilt second forward proxy tunnel can be evaluated to judge the state in the second forward proxy tunnel, whether there is an abnormal state and attack behavior, etc., and different execution strategies are matched according to different evaluation results to improve the stability and reliability of the tunnel.

[0057] Furthermore, the forward proxy tunnel monitoring system further includes: a scanning module, the scanning module including: a first analyzing unit, a combining unit, a first processing unit, a second processing unit and a selecting unit;

[0058] The first analysis unit is used to analyze the attributes of the target system by using a decision tree algorithm to obtain an optimal attribute set;

[0059] The combining unit is used to generate a plurality of first scanning strategy combinations by arranging and combining the optimal attribute sets;

[0060] The first processing unit is used to perform random processing on a plurality of the first scanning strategy combinations to obtain a plurality of scanning schemes;

[0061] The second processing unit is used to evaluate each of the scanning schemes by Monte Carlo simulation, and if the score of each of the scanning schemes is lower than a first preset threshold, optimize each of the scanning schemes by a genetic algorithm to generate a plurality of second scanning strategy combinations;

[0062] The selection unit is used to select an optimal scanning solution from a plurality of second scanning strategy combinations based on the situation of the target system.

[0063] Further, the analysis module includes: a capture unit and a second analysis unit;

[0064] The capture unit is used to capture a data packet transmitted by the first forward proxy tunnel and extract a first data feature in the data packet;

[0065] The second analysis unit is used to analyze the first data feature by using a support vector machine to obtain a first tunnel state vector.

[0066] Further, the reconstruction module includes: a third processing unit, a fourth processing unit and a reconstruction unit;

[0067] The third processing unit is used to normalize the first tunnel state vector to obtain a third tunnel state vector;

[0068] The fourth processing unit is used to calculate the Mahalanobis distance between the third tunnel vectors;

[0069] The reconstruction unit is configured to determine that a tunnel failure occurs if the Mahalanobis distance between the third tunnel vectors is greater than a second preset threshold, and to re-establish the connection of the second forward proxy tunnel.

[0070] Further, the evaluation module includes: a first evaluation unit, a first adjustment unit, a second adjustment unit and a third adjustment unit:

[0071] The first evaluation unit is used to evaluate the second tunnel state vector by using a preset tunnel state evaluation model to form a tunnel state evaluation result;

[0072] The first adjustment unit is used to dynamically calculate and adjust the weight coefficient of the second forward proxy tunnel by using a weighted round-robin scheduling algorithm based on the tunnel state evaluation result;

[0073] The second adjustment unit is used to dynamically adjust the forwarding path and traffic ratio of the second forward proxy tunnel by using software defined network technology;

[0074] The third adjustment unit is used to optimize the weight coefficient, the forwarding path and the traffic ratio by using a preset simulated annealing algorithm.

[0075] Furthermore, the evaluation module further includes: a second evaluation unit and a fourth adjustment unit:

[0076] The second evaluation unit is used to calculate the anomaly score of the second tunnel state vector by using an isolation forest algorithm;

[0077] The fourth adjustment unit is configured to determine that an attack behavior exists in the second forward proxy tunnel if the anomaly score is greater than a third preset threshold, and to re-establish a connection of the third forward proxy tunnel.

[0078] Furthermore, the evaluation module further includes: an input unit, a third evaluation unit and a fifth adjustment unit:

[0079] The input unit is used to input the second tunnel state vector into a preset graph attention network model;

[0080] The third evaluation unit is used to calculate the risk probability of the second forward proxy tunnel through the graph attention network model;

[0081] The fifth adjustment unit is used to dynamically adjust the routing forwarding strategy of the second forward proxy tunnel or optimize the transport layer protocol if the risk probability is greater than a fourth preset threshold.

[0082] Furthermore, the evaluation module further includes: a classification unit, a matching unit and an optimization unit:

[0083] The classification unit is used to classify the second tunnel state vector to obtain a corresponding health level;

[0084] The matching unit is used to match the corresponding third scanning strategy for the second forward proxy tunnels with different health levels;

[0085] The optimization unit is used to optimize the third scanning strategy using a multi-objective particle swarm optimization algorithm to obtain an optimal scanning parameter combination.

[0086] Furthermore, the forward proxy tunnel monitoring system further comprises: a decision module, the decision module comprising: a mapping unit, a calculation unit and a decision unit;

[0087] The mapping unit is used to map scanning strategy selection, tunnel status detection and security threat detection to Markov decision processes respectively;

[0088] The computing unit is used to solve the Markov decision process by using a deep deterministic policy gradient algorithm to obtain an optimal state-action mapping strategy;

[0089] The decision-making unit is used to adjust the hyperparameters of the deep deterministic policy gradient algorithm and output an intelligent decision integrating scanning strategy selection, tunnel status detection and security threat detection.

[0090] In a third aspect, the present application provides a computer-readable storage medium, which includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute the forward proxy tunnel monitoring method described in the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0091] Figure 1 It is a flowchart of an embodiment of a forward proxy tunnel monitoring method provided by the present application;

[0092] Figure 2 It is a structural diagram of an embodiment of a forward proxy tunnel monitoring system provided by the present application. DETAILED DESCRIPTION

[0093] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0094] It should be understood that the step numbers used in this article are only for the convenience of description and are not intended to limit the order in which the steps are executed.

[0095] It should be understood that the terms used in the present specification are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the present specification and the appended claims, the singular forms "a", "an" and "the" are intended to include plural forms unless the context clearly indicates otherwise.

[0096] The terms “include” and “comprising” indicate the presence of described features, integers, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0097] The term "and / or" means and includes any and all possible combinations of one or more of the associated listed items.

[0098] The forward proxy tunnel is a bridge for external access to internal resources and is easily targeted by attacks. Monitoring tunnels can promptly detect and block potential malicious traffic, protect the security of the intranet, and prevent internal threats.

[0099] Currently, diversified scanning strategies are needed to monitor forward proxy tunnels, but frequent scanning may trigger tunnel security defense, which not only affects the scanning effect but may even cause tunnel connection interruption.

[0100] Embodiment 1

[0101] Please refer to Figure 1 , Figure 1 It is a flow chart of an embodiment of a forward proxy tunnel monitoring method provided by the present application, including steps S1 to S3;

[0102] Step S1, analyzing a first data feature transmitted through a first forward proxy tunnel to obtain a first tunnel state vector;

[0103] It is understandable that before analyzing the first data characteristics transmitted by the first forward proxy tunnel, it is also necessary to confirm the scanning plan to obtain the data characteristics of the forward proxy tunnel. Specifically: First, the operating system type, open ports and service version of the target system are analyzed by a decision tree algorithm, and the optimal partitioning attributes are selected based on information gain or information gain rate to obtain the optimal attribute set; secondly, by arranging and combining the optimal attribute set, a number of first scanning strategy combinations are generated, and the first scanning strategy combination includes different scanning intensities, frequencies and durations; thirdly, by using uniform distribution or Gaussian distribution to perform random sampling within the value range of the three parameters of scanning intensity, frequency and duration in each first scanning strategy combination to achieve randomization processing, a number of scanning plans are obtained; then, each of the scanning plans is evaluated by Monte Carlo simulation, and the results are randomly selected. The computer generates a large number of network environments and defense configurations, evaluates each of the scanning schemes for multiple times to calculate the comprehensive score of each scheme, and if the score of each of the scanning schemes is lower than the first preset threshold, optimizes each of the scanning schemes through a genetic algorithm to generate a plurality of second scanning strategy combinations, and repeats the randomization process until the Monte Carlo simulation scores of the plurality of scanning schemes obtained are all greater than the first preset threshold. According to the network environment and defense capability of the scanning target system, the scanning efficiency, concealment, target coverage and other factors are comprehensively considered, and the optimal scanning scheme can be determined from the plurality of second scanning strategy combinations. At the same time, during the scanning process, the scanning intensity, frequency and duration can be adjusted in real time and dynamically according to the feedback information.Exemplarily, first, the ID3 decision tree algorithm can be used to select the optimal partitioning attribute by calculating the information gain of each attribute. Suppose there are 10 target systems to be scanned, of which 7 are Windows systems and 3 are Linux systems; in the Windows system, 5 have port 80 open and 2 have port 3389 open; in the Linux system, 2 have port 22 open and 1 has port 80 open; according to the information gain formula IG(D,A), it can be calculated that the information gain of the operating system type is 0.88, which is greater than the information gain of the port attribute of 0.62, so the operating system type is selected as the optimal partitioning attribute, and then the optimal attribute set is obtained; secondly, the optimal attribute set is arranged and combined to generate 4 scanning strategy combinations: Windows-80 port, Windows-3389 port, Linux-22 port, Linux-80 port; again, the scanning intensity, frequency, duration and other parameters of each scanning strategy combination are calculated. Uniformly distributed random sampling is used within a certain range, such as randomly selecting scanning intensity from three levels: low, medium, and high, randomly generating frequencies between 10 times / hour and 100 times / hour, and randomly generating durations between 1 hour and 24 hours, so as to obtain several scanning schemes; then, through Monte Carlo simulation, 1,000 network environments and defense configurations are randomly generated, and each scanning scheme is simulated and evaluated multiple times. The comprehensive score of each scanning scheme can be calculated by statistically analyzing indicators such as the average detection rate and false alarm rate. If the scores of all scanning schemes are lower than the preset threshold, a genetic algorithm is used for optimization until a sufficient number of second scanning strategy combinations that meet the threshold are obtained; finally, according to the network environment and defense capabilities of the target system to be scanned, the scanning scheme with the highest comprehensive score, the best scanning efficiency, and the strongest concealment is selected for execution, and the scanning intensity, frequency, and duration are adjusted according to the feedback from the target system during the scanning process. If it is detected that the number of open ports has decreased significantly, the scanning frequency can be appropriately reduced to reduce the risk of being discovered.

[0104] It should be noted that information gain measures the degree to which the uncertainty (entropy) of a data set is reduced under given feature conditions. Entropy is an indicator used to describe the purity of a data set. The higher the entropy, the more chaotic the data set is, and vice versa. The formula for information gain is: IG(D,A)=H(D)-H(D|A), where D is the data set, A is the feature, H(D) is the entropy of data set D, and H(D|A) is the conditional entropy of data set D under feature A.

[0105] It should be noted that the calculation formula of Monte Carlo simulation is: S = w1*Detection Rate+w2*FalsePositive Rate+w3*Efficiency, where Detection Rate is the detection rate, False Positive Rate is the false alarm rate, Efficiency is the scanning efficiency, w1, w2, w3 are the corresponding weight coefficients. The specific calculation process is not the focus of this application, so it will not be expanded here.

[0106] It should be noted that the first preset threshold can be set freely and is not limited in this application.

[0107] It should be noted that the optimization of each of the scanning schemes by genetic algorithm is specifically as follows: generating a second scanning strategy combination by operations such as selection operator, crossover operator and mutation operator, including obtaining the existing scanning scheme as the initial population of the genetic algorithm; calculating the fitness value of each scanning scheme according to the preset fitness function, the higher the fitness value, the better the scanning effect and efficiency of the strategy; selecting an operator, taking the fitness value as a weight, and selecting a part of the strategies from the existing scanning schemes as parent individuals; performing a crossover operation on the selected parent individuals, randomly selecting two parent individuals, and performing a crossover operation at random positions. The generated offspring scanning strategy is cross-linked to generate a new offspring scanning strategy; a mutation operation is performed on the generated offspring scanning strategy, and some gene positions are randomly selected to be inverted according to the preset mutation probability to introduce new strategy features; the parent individuals and the offspring individuals are merged, sorted according to the fitness value, and a part of the individuals with higher fitness values ​​are selected as the new generation population; the step selection operator is repeated until a part of the individuals with higher fitness values ​​are selected as the new generation population, until the preset number of iterations is reached or the termination condition is met, and the optimized second scanning strategy combination is obtained. The specific optimization process is not the focus of this application, so it will not be expanded here.

[0108] In this way, the scanning plan is determined by the attributes of the target system, and the scanning plan is scored and optimized. Based on the target system, the scanning plan with the highest comprehensive score, the highest scanning efficiency, the strongest concealment and the widest target coverage can be selected. This can cope with different target systems and defense measures, and improve the comprehensiveness and accuracy of the scan.

[0109] It is understandable that after confirming the scanning scheme, the first data feature transmitted by the first forward proxy tunnel can be obtained and analyzed. Specifically, first, the network packet sniffing is used to capture the data packets transmitted by the first forward proxy tunnel in real time, and the size and timestamp parameters in the data packets are extracted through the parsing technology to form the first data feature; secondly, the first data feature is analyzed by the support vector machine to obtain the first tunnel state vector. Exemplarily, the tcpdump tool is used to loop capture in units of 1000 data packets, and then the dpkt library is used to parse each data packet, extract the source IP, destination IP, source port, destination port, data packet size, timestamp and other fields to form the first data feature, and the support vector machine is used to classify and predict the first data feature of the last 1 minute every 5 seconds. If the classification result is abnormal, the corresponding 1-minute time window is marked as an abnormal state. When the abnormal state accumulates to 5 minutes, it is determined to be a tunnel abnormality, and the start and end time and duration of the abnormality are recorded to form a tunnel state vector.

[0110] It should be noted that it is necessary to collect data features of the forward proxy tunnel in order to train the support vector machine model. Specifically, first, the numpy library is used to calculate the mean, variance, kurtosis, etc. of the data packet size distribution, the average, maximum, minimum and other statistical indicators of the delay between data packets, and obtain the statistical characteristics of the data packet size distribution histogram and the delay distribution curve between data packets; secondly, the support vector machine model is trained based on the statistical features, and the RBF kernel function, penalty coefficient C = 1.0, and slack variable ξ = 0.001 are used for model training to obtain the behavior pattern classification hyperplane, and the accuracy, recall rate and other indicators of the model are evaluated by the cross-validation method, and the model parameters are optimized by grid search to obtain the optimal behavior pattern classification hyperplane. Optionally, k-fold cross-validation is used to train the data. The data set is divided into k subsets, one of the subsets is used as the test set each time, and the remaining subsets are combined as the training set. K training and testing are performed, and the average of the k results is calculated as the evaluation result of the model, wherein the hyperplane can be w*x+b=0, w is the weight vector, which determines the direction of the hyperplane, x is the input vector, that is, the feature vector, and b is the bias term, which determines the position of the hyperplane; finally, the sliding time window method is used to perform real-time classification and prediction on the newly collected first data features, and the current tunnel state is judged by the distance from the behavior pattern classification hyperplane, and then the tunnel state vector is generated. The specific optimization process is not the focus of this application, so it will not be expanded here.

[0111] It should be noted that in the process of establishing a forward proxy tunnel, a certificate and key bidirectional authentication mechanism based on the SSL / TLS protocol can be used, and the OpenSSL library can be used to implement identity authentication and key negotiation to ensure the legal identity of both parties in the tunnel communication. Specifically, first, the client identity information is associated with the tunnel state vector to establish a client behavior feature portrait, and the DBSCAN density clustering algorithm is used. With Euclidean distance or cosine similarity as the clustering similarity measurement index, abnormal behavior patterns are identified through cluster analysis; secondly, the suspicious clients corresponding to the abnormal behavior patterns are identified by combining the clustering analysis results and the tunnel state vector, and a suspicious client list is generated; finally, the degree of suspicion is determined based on the tunnel state vector. For clients with abnormal behavior patterns, they are divided into three levels: low risk, medium risk, and high risk according to the cumulative duration and frequency of their abnormal states, and different management and control strategies are adopted for each level: the maximum number of connections for low-risk clients is limited to 10, the maximum number of connections for medium-risk clients is limited to 5, and high-risk clients are directly disconnected and added to the blacklist. At the same time, the key length and update cycle of encrypted transmission are dynamically adjusted. The key length of low-risk clients is 128 bits, and the update cycle is 1 day. The key length of medium-risk clients is 256 bits, and the update cycle is 12 hours. The key length of high-risk clients is 384 bits, and the update cycle is 1 hour. This improves the security of tunnel transmission. The specific identity authentication process is not the focus of this application, so it will not be expanded here.

[0112] In this way, by analyzing the first data feature transmitted by the first forward proxy tunnel to obtain the first tunnel state vector, the data transmitted by the first forward proxy tunnel can be monitored in real time, which facilitates subsequent judgment of the tunnel situation.

[0113] Step S2: determining whether a tunnel failure occurs based on the first tunnel state vector; if a tunnel failure occurs, reestablishing a connection of a second forward proxy tunnel;

[0114] It can be understood that after the first tunnel state vector is obtained, the state of the tunnel can be determined. Specifically, first, the first tunnel state vector is normalized to obtain the third tunnel state vector; second, the Mahalanobis distance between the third tunnel vectors is calculated; finally, if the Mahalanobis distance between the third tunnel vectors in a certain time period is greater than the second preset threshold, it is determined that a tunnel fault occurs, and the fault type or fault level is determined based on the preset classification and regression tree decision tree model, and the pre-set handling action is matched according to the fault type. For general faults with short tunnel interruption time and small available bandwidth reduction, it is preferentially restored by re-establishing the TCP connection; for serious faults with long interruption time and large bandwidth reduction, the operation of dynamically switching the backup transmission channel is triggered. At the same time, during the entire process of fault handling and recovery, the status data of each tunnel will be continuously monitored, and key performance indicators such as fault occurrence frequency and average recovery time will be calculated. Visual display is performed through tools such as control charts or exponentially weighted moving average (EWMA), and the anomaly detection model and fault handling strategy are continuously tuned to improve the tunnel self-healing ability, shorten the fault recovery time, and maximize the reliability and continuity of data transmission.For example, assume that the forward proxy tunnel has five key status indicators: average delay, packet loss rate, throughput, number of interruptions and interruption duration. The status data is collected every 5 seconds to form a 5-dimensional state vector. Secondly, the collected status data is normalized, and the value range of each indicator is scaled to the interval [0, 1] to eliminate the dimension effect. Then, the Mahalanobis distance is used to measure the similarity between the state vectors. If the mean value of the Mahalanobis distance is 1.5 and the standard deviation is 0.5 calculated based on historical data, the normal threshold range can be determined to be [0.5, 2.5]. When the Mahalanobis distance of the state vector within a certain time window (such as 1 minute) exceeds 2.5, it is determined to be a tunnel failure. At the same time, the fault type or fault level is determined based on the preset classification and regression tree decision tree model, and the pre-set handling action is matched according to the fault type. If the interruption duration exceeds 1 minute and the available bandwidth decreases by more than 50%, it is further determined to be a serious fault, otherwise it is a general fault. For general faults, the recovery strategy of re-establishing the TCP connection is preferred, and the reconnection time interval is dynamically adjusted through the exponential backoff algorithm. The initial interval The interval is 1 second, and the interval is multiplied by 2 after each reconnection failure. If the connection is still not restored after 5 reconnections, the fault is reported. For serious faults, a recovery strategy of dynamically switching the backup transmission channel is selected, and 3 backup tunnels are established in advance. The latency, bandwidth and other indicators of the backup tunnels are detected every 30 seconds. When the main tunnel fails seriously, the backup tunnel with the lowest latency and the highest bandwidth is selected, and the OpenFlow flow table is sent down through the SDN controller to modify the tunnel ID field of the data packet to the backup tunnel ID to achieve seamless switching of the tunnel. Finally, in the process of TCP connection reconstruction and backup tunnel switching, the SPDY protocol is used to multiplex multiple TCP connections to reduce the overhead of connection establishment and improve link utilization. When the tunnel is restored, the EWMA tool is used to count and visualize KPI indicators such as fault occurrence frequency and average recovery time. When the fault frequency exceeds the warning threshold for 3 consecutive cycles, the retraining and optimization of the tunnel status prediction model is triggered, and the Mahalanobis distance threshold, decision tree model, etc. are dynamically updated using the latest status data to continuously improve the intelligence level of tunnel anomaly detection and fault handling.

[0115] It should be noted that re-establishing the connection of the second forward proxy tunnel mainly involves re-establishing or "regenerating" a tunnel through forward proxy technology in network security and network communications, which includes re-establishing the TCP connection and switching the backup transmission channel. The specific process of rebuilding the tunnel is not the focus of this application, so it will not be expanded here.

[0116] It should be noted that the classification and regression tree decision tree model uses indicators such as tunnel interruption duration and available bandwidth reduction as decision variables, fault type or fault level as target variable, uses the Gini coefficient for feature selection and node partitioning, selects the optimal partitioning attribute, generates a fault handling decision path, and can also enhance the generalization performance of the model through cross-validation and pruning optimization strategies. The specific training process is not the focus of this application, so it will not be expanded here.

[0117] It should be noted that the second preset threshold can be determined according to the mean and standard deviation of the Mahalanobis distance. The specific determination process is not the focus of this application and will not be expanded here.

[0118] In this way, whether a tunnel failure occurs can be determined based on the Mahalanobis distance between tunnel state vectors, and the tunnel failure can be resolved by rebuilding a second forward proxy tunnel. This can achieve intelligent tunnel fault monitoring and fault handling, and improve tunnel stability and reliability.

[0119] Step S3: Analyze the second data feature in the second forward proxy tunnel to obtain a second tunnel state vector, evaluate the second tunnel state vector to obtain an evaluation result, and match a corresponding execution strategy based on the evaluation result.

[0120] It is understandable that after the connection of the second forward proxy tunnel is re-established, the forward proxy tunnel needs to be monitored. Specifically, first, using network traffic mirroring and data packet parsing technology, deploy traffic monitoring probes at the entrance and exit nodes of the tunnel to extract the second data features in the second forward proxy tunnel in real time, and obtain the second tunnel state vector by analyzing the second data features, including average transmission delay, delay jitter standard deviation, average packet loss rate, throughput performance indicators, and link encryption algorithm, key length, and security attributes of the authentication protocol; secondly, evaluate the second tunnel state vector through a preset tunnel state evaluation model to form a tunnel state evaluation result; thirdly, based on the tunnel state evaluation result, use a weighted polling scheduling algorithm to dynamically calculate and adjust the weight coefficient of the second forward proxy tunnel, and introduce a threshold-based dynamic weight. An adjustment mechanism is provided to reduce the weight of a tunnel when its comprehensive score is lower than a certain threshold, and to increase the weight when it is higher than the threshold, thereby forming a negative feedback adaptive adjustment; then, the forwarding rules are centrally issued through the controller using software-defined network technology to dynamically adjust the forwarding path and traffic ratio of the second forward proxy tunnel, and a refined distribution strategy is formulated based on the source IP address, target URL, request method and other characteristics of the request, and a rule-based engine such as Drools is used to realize intelligent distribution of load balancing; finally, a preset simulated annealing algorithm is used to search for the optimal load balancing parameters, and the load balancing parameters include the weight of each tunnel, forwarding rules and queue length, etc., so as to optimize the weight coefficient, the forwarding path and the traffic ratio.Exemplarily, first, through the network traffic mirroring technology, traffic monitoring probes are deployed at the inlet node and the outlet node of the tunnel respectively, with a sampling period of 1 minute to collect the status characteristic data of the tunnel in real time; secondly, the collected data is preprocessed to remove abnormal values ​​and outliers, and 15 key performance indicators (KPIs) such as average transmission delay, delay jitter standard deviation, average packet loss rate, and throughput, as well as 5 security attributes such as link encryption algorithm, key length, and authentication protocol are extracted to form a 20-dimensional second tunnel state vector; secondly, the second tunnel state vector is evaluated by a preset tunnel state evaluation model to form a tunnel state evaluation result; then, according to the comprehensive score of the tunnel, a weighted round robin algorithm is used to dynamically adjust the weight of the tunnel. If the initial weight is 1, when the comprehensive score is lower than 0.6, the weight is halved, and if it is higher than 0.6, the weight is halved. When the weight is 0.85, the weight is doubled, and the weight configuration is updated every 10 minutes to adjust the tunnel weight. Finally, the SDN controller dynamically sends forwarding rules based on OpenFlow to match the first 24 bits of the source IP address of the data packet, the domain name of the target URL, the request method (GET / POST) and other fields, and uses the Drools rule engine to write distribution strategies, such as directing requests from area A to tunnel A, and directing requests from area B to tunnel B, etc. On the basis of the forwarding rules, the simulated annealing algorithm is used to search for the optimal parameter configuration with the minimization of the standard deviation of delay jitter and packet loss rate as the optimization goal. When the change rate of the simulated annealing algorithm function value is less than 0.01 or the number of iterations reaches 1000, the simulated annealing algorithm converges and outputs the optimal parameter configuration. The simulated annealing algorithm is re-run every 30 minutes to dynamically optimize the load balancing strategy according to the changes in the tunnel status.

[0121] It should be noted that it is also possible to collect massive amounts of tunnel status data from the second forward proxy tunnel through perception technologies such as INT (In-band Network Telemetry), including performance indicators and security indicators such as throughput, latency, packet loss rate, retransmission rate, number of connections, and further analyze and form a fine-grained tunnel state vector.

[0122] It should be noted that the tunnel state evaluation model is constructed based on the second tunnel state vector. By assigning different weights to various performance and security indicators, a weighted sum evaluation function is formed. The specific construction process is not the focus of this application, so it will not be expanded here.

[0123] It should be noted that in the iterative search process of the simulated annealing algorithm, the Markov chain Monte Carlo method can be introduced to generate new candidate states, the gradient of the energy function can be calculated by the gradient descent method, the direction and step size of the state jump can be corrected, the convergence of the algorithm can be accelerated, and clear convergence conditions can be set, such as the rate of change of the energy function value is lower than a certain threshold, or the amplitude of the state change is lower than a certain threshold. At the same time, the maximum number of iterations is set as a bottom-line condition to prevent the algorithm from falling into an infinite loop; after reaching the convergence condition or the maximum number of iterations, the optimal load balancing parameter configuration is output. The specific optimization process is not the focus of this application, so it will not be expanded here.

[0124] In this way, the parameter optimization process can be periodically re-triggered according to changes in the tunnel status, and the tunnel weight and forwarding rules can be dynamically updated to minimize the transmission delay jitter and packet loss rate of business requests, improve load balancing performance and link utilization, and improve tunnel stability and reliability.

[0125] It is understandable that it is also possible to determine whether there is an attack on the second forward proxy tunnel based on the second tunnel state vector. Specifically, the abnormal score of the second tunnel state vector is calculated by the isolation forest algorithm; if the abnormal score is greater than the third preset threshold, it is determined that the second forward proxy tunnel has security threats or intrusions and other attack behaviors, and transitional security protection measures are taken to clean the traffic of suspicious tunnels, redirect honeypots, and perform deep protocol analysis, etc., to avoid frequent interruptions of tunnels as much as possible, and automatically trigger the tunnel security response mechanism, issue instructions through the SDN controller, release the network and computing resources occupied by the abnormal tunnel, re-apply for new resources from the resource pool, use the tunnel mode of the IPSec protocol, complete identity authentication and key exchange with the communication peer through the IKE (Internet Key Exchange) protocol, or use the SSL / TLS protocol for two-way digital certificate authentication, and re-establish the connection of the third forward proxy tunnel. For example, when the anomaly score of a tunnel node exceeds the threshold range [0.5, 0.7] for 5 consecutive minutes, the traffic of the suspicious tunnel is mirrored to the honeypot, and the threat behavior is detected through protocol parsing and behavior analysis; at the same time, the controller is notified to delete the tunnel forwarding rules, release tunnel resources, select the one with the lowest delay jitter from the backup link to re-establish the IPSec tunnel, execute the Diffie-Hellman key exchange algorithm through the IKE protocol, use the AES-256-GCM algorithm to encrypt data, and the SHA-256 algorithm for integrity verification. The 5-minute heartbeat interval and 30-second death time are used to detect the tunnel viability, and safe and reliable tunnel communication is achieved. The effectiveness of tunnel anomaly detection is tested by red and blue attack and defense drills with 200 tunnel attack traffics. The evaluation indicators include detection rate (TP / (TP+FN)), false alarm rate (FP / (FP+TN)), average detection delay, CPU occupancy, etc., and a tunnel security assessment report is formed to discuss improvement measures and implement them in all aspects of anomaly detection and security defense.

[0126] It should be noted that the second tunnel state vector can be used to construct a tunnel safety anomaly detection data set, an outlier detection algorithm such as local anomaly factor (LOF) is used to identify and filter noise data, a feature selection algorithm such as recursive feature elimination (RFE) is used to select the most relevant anomaly features, and an oversampling technique such as SMOTE is used to balance the ratio of abnormal samples and normal samples. The data set is cleaned and optimized, and the processed tunnel feature vector is input into the isolation forest unsupervised anomaly detection algorithm. By recursively randomly selecting features and randomly dividing the feature space, multiple isolated trees are constructed, and the average path length from each sample point to the isolated tree set is calculated as the anomaly score. The shorter the score, the more likely the sample point is an anomaly point. In addition, on the basis of the isolation forest algorithm, an adaptive dynamic threshold mechanism can also be introduced, and the statistical process control (SPC) theory is used. According to the mean μ and standard deviation σ of historical anomaly detection, the initial threshold is set to μ+3σ, and then fine-tuned in combination with expert experience, and an adaptive learning mechanism is introduced to dynamically adjust the threshold according to the abnormal situation of the newly added samples to improve the sensitivity and accuracy of anomaly detection. The specific training process and threshold setting process are not the focus of this application, so they will not be expanded here.

[0127] In this way, by analyzing the second data feature in the second forward proxy tunnel to obtain the second tunnel state vector, the state of the reconstructed second forward proxy tunnel can be evaluated to determine whether there is abnormal behavior in the second forward proxy tunnel, thereby facilitating matching of corresponding disposal strategies and improving the stability and reliability of the tunnel.

[0128] It is understandable that the risk probability of the second forward proxy tunnel can also be judged based on the second tunnel state vector. Specifically, first, the second tunnel state vector is input into the preset graph attention network model; second, the graph attention network model is used to perform rolling predictions based on the tunnel health trend and key performance indicators of the preset time, and the health score and key performance indicators of each tunnel node at the preset time are output. According to the health prediction results of the tunnel nodes, combined with the importance, impact range, historical failure frequency and other factors of the tunnel, a risk assessment matrix is ​​constructed to classify the tunnel failure risk to determine the risk probability of the second forward proxy tunnel; finally, if the risk probability is greater than the fourth preset threshold, it is determined that the tunnel has a high failure risk, and active defense measures are automatically triggered. Active defense dynamically adjusts the routing forwarding strategy of the tunnel node through the SDN controller, and uses the TCP-RL algorithm based on reinforcement learning to optimize the transport layer protocol. According to the state indicators such as the packet loss rate and delay of the tunnel, the TCP congestion window and retransmission timeout are dynamically adjusted. At the same time, an end-to-end hybrid transmission mechanism is introduced to dynamically switch between TCP and UDP.

[0129] It should be noted that the TCP-RL algorithm combines the TCP protocol and the dynamic adjustment mechanism of reinforcement learning (RL). It is mainly used to optimize the TCP congestion control strategy to improve network performance, especially when network conditions change, it can quickly adapt and make optimal decisions. Its core is to use reinforcement learning technology to dynamically adjust the parameters of the TCP protocol, such as the congestion window size, retransmission timeout, etc., to cope with congestion and other uncertain factors in the network.

[0130] It should be noted that the topological structure of the tunnel network can be abstracted into a directed weighted graph model, with tunnel nodes mapped as graph nodes, forward links and reverse links mapped as directed edges of the graph, and edge weights representing the health scores of the forward links and reverse links respectively. Edge (i, j) can be used to represent the link between tunnel node i and node j, and edge weight w(i, j) represents the health score of the link, including but not limited to the integrity of the tunnel structure, maintenance status, past accident records, traffic flow, road quality, etc.; the Z-score normalization method is used to normalize the multidimensional state feature vector of the tunnel node, and the value range of each indicator is scaled to a standard normal distribution with a mean of 0 and a variance of 1, forming the standardized features of the tunnel node as the attributes of the graph node. The feature dimension of each node is D, and the node feature matrix of the tunnel network topology graph is N×D dimensional, where N is the number of tunnel nodes. A two-layer graph neural network model is built. The first layer is the graph attention layer. The GAT algorithm is implemented using the MXNetGluon framework. Four attention heads are set, and the scaled dot product attention mechanism is used to calculate the attention coefficient between nodes, that is, the dot product of the node feature vector is divided by the square root of the vector dimension, and then the attention weight is obtained by normalization through the Softmax function. The features of each node are aggregated with the information of neighboring nodes through the attention mechanism to obtain the node embedding vector; the second layer is the graph convolution layer, which uses the GCN algorithm, sets 3 layers of graph convolution and 256 convolution kernels, and further propagates and updates the node embedding. The tunnel status data of a week in history is selected, and the training samples are constructed with a time step of 6 hours. The graph data is loaded in batches and the Adam optimizer is used to train the model. The tunnel health and key performance indicators are used as labels, and the binary cross entropy loss function is used. After 100 rounds of iterative training, the graph neural network model can be trained. The specific training process is not the focus of this application, so it will not be expanded here. Among them, the Z-score normalization method is used to convert the original data into a standard normal distribution with zero mean and unit variance, which can eliminate the dimensionality effect between different features and enable data of different dimensions and units to be compared and analyzed on the same scale. MXNet Gluon is a deep learning framework that provides a flexible and efficient API to build and train complex neural network models. GAT (Graph Attention Network) is a graph neural network model that uses the attention mechanism to aggregate node neighbor information to solve the problem of learning node representations in the graph. This framework is used to build a graph attention network.GCN (Graph Convolutional Network) is a deep learning model specifically designed to process graph data. It can capture the node features and their relationships in the graph structure. Its main purpose is to learn the representation of nodes by aggregating the information of nodes and their neighbors. These representations can be used for a variety of downstream tasks, such as node classification, link prediction, etc. Specifically, it updates the representation of each node by iteratively combining the features of each node with its direct neighbors.

[0131] In this way, by analyzing the second data feature in the second forward proxy tunnel to obtain the second tunnel state vector, the state of the reconstructed second forward proxy tunnel can be evaluated to determine whether there is an attack behavior in the second forward proxy tunnel, so as to facilitate matching of the corresponding disposal strategy, achieve more accurate and efficient fault defense and resource scheduling, and thus improve the stability and reliability of the tunnel.

[0132] It is understandable that the scanning strategy can also be adjusted based on the second tunnel state vector. Specifically, first, the second tunnel state vector after tunnel regeneration is input into the graph attention network model, and the attention mechanism is used to update the hidden state of the target node through feature aggregation of neighboring nodes, and then the node embedding representation is obtained through sum or concat aggregation operation, and then the information is propagated between nodes through graph convolution, and finally mapped to the tunnel health level space through the fully connected layer to obtain the tunnel health level (such as excellent, good, medium, and poor); secondly, for the second forward proxy tunnels with different health levels, the time granularity, frequency, concurrency, and coverage parameters of the optimized scan are combined to form multiple scanning strategy alternative sets, and different strategy weights are assigned. The weight is positively correlated with the tunnel health level. For example, for the health level of " The weight of the tunnel with a health level of "excellent" can be set to 0.8, the weight of the tunnel with a health level of "good" is 0.6, and so on, to match the third scanning strategy corresponding to the second forward proxy tunnel; finally, the multi-objective particle swarm optimization algorithm is used to optimize the third scanning strategy, and the minimization of scanning response time, maximization of abnormal detection rate, minimization of false alarm rate, and minimization of CPU occupancy are taken as optimization goals. Each optimization goal is normalized to the same scale through weighted summation, and the fitness score is calculated. The upper limit of scanning time and the upper limit of CPU occupancy are taken as constraints. The particle encoding is a scanning parameter combination, and the particle speed corresponds to the parameter adjustment amplitude. After 1000 iterations, the Pareto optimal solution set is output to obtain the optimal scanning parameter combination. Finally, according to the changes in tunnel status and external environmental interference factors, the scanning strategy is dynamically adjusted, and the latest dynamically adjusted tunnel state vector set is input into the multi-objective particle swarm optimization algorithm to generate the optimal scanning parameter combination that matches the tunnel state vector, and deployed to the distributed scanner to start the scanning task; the scanning result data is returned to the graph attention network model, and the model parameters are fine-tuned in a supervised or semi-supervised manner to continuously improve the accuracy of tunnel state classification and anomaly detection, and enhance the model's adaptability and robustness; of course, the scanning task scheduling and tunnel state prediction can also be modeled as a two-player game for target long-term benefits. By designing a reasonable reward function, the dynamic scheduling strategy of the scanning task and the prediction results of the graph neural network are guided to adapt to each other and dynamically compete, continuously improving the intelligent optimization capability of the entire system; at the same time, the average response time, anomaly coverage, resource utilization, etc. of the scanning task can also be used as evaluation indicators to continuously verify and optimize the dynamic adjustment mechanism of the scanning strategy.For example, tunnel status perception uses the network telemetry framework IntellFlow, with a sampling interval of 10 milliseconds, to collect 200 multi-dimensional status indicators of newly generated tunnels in real time through network probes, use the LocalOutlierFactor (LOF) algorithm to identify and filter outliers in the single dimension of the status indicators, perform Min-Max normalization on the status indicators, map them to the [0,1] interval, and use the Recursive Feature The RFE algorithm recursively eliminates redundant indicators, selects 20 most relevant indicators to form a feature vector, and inputs the feature vector into the graph attention network model to output the tunnel health level; then, the third scanning strategy corresponding to the second forward proxy tunnel is generated through knowledge graph reasoning. The knowledge graph contains 100 candidate strategies, each strategy consists of 10 scanning parameters, forming a 1000-dimensional high-dimensional strategy space, and the strategy weight calculation formula is w=0.8^(4-l), where l represents the tunnel health level (excellent: 4, good: 3, medium: 2, poor: 1); secondly, multiple scanning strategy candidate sets are formed for different health levels, and different strategy weights are assigned. The weight is positively correlated with the tunnel health level. For example, for a tunnel with an "excellent" health level, its weight can be set to 0.8, and the weight of a tunnel with a "good" health level is 0.6, and so on, to match the third scanning strategy corresponding to the second forward proxy tunnel; finally, the multi-objective particle swarm optimization algorithm is used to optimize the third scanning strategy to obtain the optimal scanning parameter combination.

[0133] It should be noted that the sum operation simply adds the feature vectors of all neighbor nodes to obtain a new vector as the new feature representation of the central node, and the concat operation concatenates the feature vectors of neighbor nodes along the feature dimension to form a longer vector.

[0134] It should be noted that concurrency refers to the number of scanning tasks performed simultaneously, and coverage refers to the comprehensiveness and depth of the scan.

[0135] It should be noted that when adjusting the scanning strategy, anomaly detection algorithms such as the isolation forest algorithm can be used to identify suspicious areas from the scan result data, extract relevant state features, and expand the training sample set of the graph neural network. Among them, the isolation forest (IF) algorithm is an unsupervised learning method for anomaly detection. It constructs multiple isolated trees by randomly selecting features and randomly splitting feature space; in the process of building isolated trees, data points are recursively split until each data point is isolated. For each data point, the average path length in all isolated trees is calculated. The anomaly score is calculated based on the average path length. The lower the score, the more likely the data point is an anomaly.

[0136] It should be noted that the Local Outlier Factor (LOF) algorithm is an unsupervised learning method for anomaly detection. It is suitable for detecting data points that appear abnormal in a local area. It determines whether a data point is abnormal by comparing the density difference between a data point and its neighboring data points. If the density of a point is much lower than the average density of its neighborhood, the point is considered abnormal; the Recursive Feature Elimination (RFE) algorithm is used for feature selection. It reduces the size of the feature set by recursively removing the least important features; the graph attention network model is built using the Python framework, which includes 2 layers of graph attention layers and 3 layers of graph convolution layers. The graph attention layer calculates the attention weights using the scaled dot-product attention formula. After softmax normalization, it is weighted and summed with the neighborhood node features. The output vectors of the 2-layer attention layer are concat and input into the graph convolution layer for information propagation. The ReLU activation function is used and regularized by Batch Normalization and Dropout; Scaled Dot-Product Attention is a graph attention network (Graph Attention An attention mechanism used in GAT, which is used to capture the relationship between nodes in graph-structured data and assign different weights to the neighbors of each node. Batch Normalization is used to accelerate deep neural network training. It standardizes the input of each layer so that the input of each layer has the same distribution, thereby reducing internal covariate shift. It is applied after the fully connected layer and the convolutional layer and before the activation function. Dropout regularization is used to prevent overfitting of deep learning models. It achieves this goal by randomly "discarding" (i.e. temporarily disabling) a part of neurons during training. This random discarding prevents the model from relying too much on any single neuron during training, thereby enhancing the generalization ability of the model.

[0137] It should be noted that the multi-objective particle swarm algorithm adopts the NSGA-II framework, initializes 100 particles, each particle is encoded with 100 scanning parameters, and retains the non-dominated solutions of the Pareto frontier through non-dominated sorting and crowding calculation. The particle velocity and position update formula is v = w·v+c1·r1·(pbest-x)+c2·r2·(gbest-x), x = x+v, where w = 0.8, c1 = c2 = 1.5, r1 and r2 are random numbers in [0,1]. v represents the velocity vector of the particle, which determines the direction and speed of the particle's movement in the search space. w represents the inertia weight, which is used to control the influence of the particle's previous velocity, that is, how much of the original velocity component is retained in the new velocity. c1 and c2 represent learning factors, which control the degree of adjustment of the particle to the individual optimal solution pbest and the global optimal solution gbest, respectively. r1 and r2 represent random numbers ranging from [0,1], which are used to introduce randomness so that the search process is not completely deterministic and increase the global search capability of the algorithm. pbest represents the historical optimal position of each particle, that is, the best solution the particle has ever experienced. gbest represents the global optimal position in the current population, that is, the best solution among all particles. x represents the position vector of the current particle. After updating, the particle will move to a new position according to the new velocity v. Among them, the normalization formula of the optimization target is f=(Σwi·fi-fmin) / (fmax-fmin), where wi is 0.5, 0.3, 0.1, and 0.1 respectively, where fi represents the unnormalized value of the i-th optimization target, that is, the original objective function value, and wi represents the weight coefficient of each target, which is used to reflect the importance of different targets. fmin represents the minimum value of all objective function values, which is used to calculate the lower bound of the normalized range. fmax represents the maximum value of all objective function values, which is used to calculate the upper bound of the normalized range. f represents the normalized comprehensive objective function value. After all targets are weighted and processed, they are normalized to ensure that the result falls between 0 and 1, which is convenient for comparing the quality of different solutions, especially in multi-objective optimization scenarios, to help identify Pareto frontier solutions. The specific training process of the multi-objective particle swarm algorithm is not the focus of this application, so it will not be expanded here.

[0138] It should be noted that the Isolation Forest Anomaly Detection Algorithm uses the scikit-learn framework to construct multiple isolated trees based on 20 result indicators such as scan response time and CPU occupancy. The maximum depth of the tree is 8, and the internal nodes are randomly divided. The anomaly score calculation formula is s = 2^(-E / c(n)), where E represents the average path length from the sample to the root node of the isolated tree, c(n) is the normalization factor of the average path length, and the threshold is set to 0.6. The MAML meta-learning algorithm is used for fine-tuning the graph neural network model. 10 tasks are sampled from the support set, with 5 samples for each task. The inner loop learning rate is 0.01, the outer loop learning rate is 0.001, and the initialization parameters are obtained by iterating 10 times. Then the model is fine-tuned on the query set, and the triplet loss and cross entropy loss functions are used for joint optimization to dynamically update the tunnel state embedding representation and classification decision surface. In the game theory modeling, the strategy spaces of the two players for scanning task scheduling and tunnel state prediction are defined as 100 dimensions and 20 dimensions respectively, and the reward function is the weighted sum of scanning efficiency and prediction accuracy. The Nash equilibrium is solved by the multi-agent reinforcement learning algorithm MADDPG. The critic network uses centralized training and decentralized execution. The actor network generates actions based on local observations. The exploration noise uses the Ornstein-Uhlenbeck process, and 100 trajectories are trained in parallel. The discount factor γ = 0.95 and the softupdate parameter. The specific training process of the isolation forest anomaly detection algorithm is not the focus of this application, so it will not be expanded here.

[0139] In this way, by matching the corresponding scanning strategy based on the second tunnel state vector and optimizing the scanning strategy, it can be ensured that the second forward proxy tunnel can be scanned comprehensively and accurately.

[0140] It can be understood that after matching the corresponding execution strategy based on the evaluation results, it also includes: first, mapping the scanning strategy selection, tunnel status detection and security threat detection to the state space and action space of the Markov decision process respectively. The state space includes the state attributes of multiple dimensions such as the health level of the current tunnel, traffic intensity, and routing stability. The action space includes a combination of various scanning strategy parameters. The representation method of parameterized action space is adopted to map each parameter to a real value within a fixed range. The action space is the Cartesian product of all parameters. The strategy function is optimized by performing strategy search in continuous space; secondly, a reward function for the global optimization goal is designed. Referring to the framework of multi-objective optimization, weight coefficients are set for the scanning efficiency, concealment and other goals respectively, and a scalar is generated by weighted summation. The reward value considers the balance between short-term and long-term benefits, adds a discount factor to attenuate future rewards, positively incentivizes the improvement of scanning efficiency and security risks, and negatively punishes the decline of tunnel performance and the reduction of concealment; again, the Markov decision process is solved by the deep deterministic policy gradient algorithm to obtain the optimal state-action mapping strategy; finally, using the idea of ​​meta-learning, the hyperparameters of the DDPG algorithm are adaptively adjusted through Bayesian optimization, reinforcement learning and other methods, and combined with transfer learning algorithms such as meta-policy gradient and policy generalization, an initial strategy adapted to different tasks is learned through meta-training, and the deep deterministic policy gradient algorithm is fine-tuned in the new scenario to output intelligent decision-making that integrates scanning strategy selection, tunnel state detection and security threat detection.

[0141] It should be noted that the deep deterministic policy gradient algorithm consists of a deterministic policy network (Actor) and a value network (Critic). The policy network generates deterministic action outputs based on state inputs, and the value network evaluates the long-term cumulative rewards of state-action pairs. The two networks are continuously optimized and updated through alternating iterations, and finally converge to the optimal state-action mapping strategy; the neural network structure of the DDPG algorithm is built, and for the high-dimensional features of the state space, a convolutional neural network (CNN) is used for feature extraction and dimensionality reduction, combined with a recurrent neural network (RNN) to model the temporal dependency of the state, or an unsupervised learning method such as an autoencoder is used to learn a low-dimensional embedding representation of the state; the policy network contains 3 hidden layers, each with 64 neurons, the activation function is ReLU, and the output layer uses a tanh function to map the action value to between [-1,1]; the value network contains 2 hidden layers, each with 128 neurons, the activation function is ReLU, and the output layer uses a linear function to predict the Q value of the state-action pair. The experience replay mechanism is introduced to store the state transition data (current state, action, reward value, next state) of each step in the experience pool, break the time correlation between the data, and extract small batches of data from the experience pool by random batch sampling to train the neural network. In the training process of the DDPG algorithm, the target network mechanism is introduced to create a copy for each policy network and value network as the target network for policy evaluation and Q value estimation. The parameters of the main network are copied to the target network every 100 to 1000 steps. The coefficient of soft update is 0.01, which makes the update of the target network smoother, so as to improve the stability and robustness of the decision and avoid the oscillation and divergence of the strategy. On this basis, the idea of ​​hierarchical reinforcement learning (HierarchicalRL) is introduced to decompose the complex decision-making process into multiple abstract levels, each level corresponds to a sub-strategy, the upper strategy is responsible for selecting the lower strategy, and the lower strategy is responsible for executing specific actions. Through this hierarchical decision-making mechanism, the policy optimization problem of large-scale complex systems can be better dealt with; the specific training process of the deep deterministic policy gradient algorithm is not the focus of this application, so it will not be expanded here.

[0142] It should be noted that the state space of the Markov decision process includes 20 tunnel health levels (0100 points), 10 traffic intensity levels (010), and 5 routing stability levels (04), forming 20×10×5=1000 state combinations; the action space includes the scanning time interval (0.110 seconds), the number of scanning proxies (1100), the port range (065535), and the scanning message disguise method (SYN, ACK, FIN, PSH, etc.). By parameterizing the action space, each parameter is mapped to the [0,1] interval, corresponding to 1×100×65536×4=26214400 action combinations; the reward function is designed as r=0.5×e+0.3×i+0.1×p+0.1×s, where e is the scanning efficiency (0-1 00 points), i is concealment (0-100 points), p is tunnel performance (0-100 points), s is security risk (0-100 points), and the discount factor γ is 0.9. The state feature extraction of the DDPG algorithm adopts a three-layer CNN. The convolution kernel sizes of the first to third layers are 32 convolution kernels with a size of 5x5, 64 convolution kernels, the size is reduced to 3x3, and 128 convolution kernels with a size of 3x3, ReLU function activation, and the output of the last layer of CNN is flattened and connected to a 256-dimensional fully connected layer; the policy network contains 2 hidden layers, each with 64 neurons, and the value network contains 2 hidden layers, each with 128 neurons; the capacity of the experience replay pool is set to 1 million, the batch sampling size is 64, and 10,000 random data are used to fill the experience pool before training starts. The target network copies parameters from the main network every 200 steps, and the soft update coefficient τ = 0.01; the layered strategy sets three levels of scanning frequency, scanning range, and scanning intensity, and each level has 3 alternative sub-strategies, forming 27 combinations; meta-learning uses the MAML algorithm, with an outer loop learning rate of 0.001 and an inner loop learning rate of 0.01. Each meta-update samples 10 tasks from 100 tasks, and each task is trained for 5 steps. The specific content of the Markov decision process is not the focus of this application, so it will not be expanded here.

[0143] It should be noted that the transfer learning adopts the DAML algorithm, the source domain is the tunnel communication model of business scenario A, the target domain is the tunnel communication model of business scenario B, the first three layers of the policy network in scenario A are extracted as the initialization parameters of the policy network in scenario B, the parameters of the first two layers are frozen, the parameters of the last three layers are fine-tuned, and iterates 500 times. The specific training process of the DAML algorithm is not the focus of this application, so it will not be expanded here.

[0144] In this way, by constructing a Markov decision process, scanning efficiency, concealment, tunnel performance and security risks can be dynamically weighed.

[0145] The embodiment of the present application analyzes the first data feature transmitted by the first forward proxy tunnel to obtain the first tunnel state vector, and can monitor the data transmitted by the first forward proxy tunnel in real time, so as to facilitate the subsequent judgment of the tunnel situation; based on the first tunnel state vector, it is judged whether a tunnel failure occurs, and the second forward proxy tunnel is rebuilt to solve the tunnel failure, so as to realize intelligent tunnel fault monitoring and fault handling; in the process of rebuilding the tunnel, network performance and data transmission will be affected. By analyzing the second data feature in the second forward proxy tunnel to obtain the second tunnel state vector, the state of the rebuilt second forward proxy tunnel can be evaluated to judge the state in the second forward proxy tunnel, whether there is an abnormal state and attack behavior, etc., and different execution strategies are matched according to different evaluation results to improve the stability and reliability of the tunnel.

[0146] Embodiment 2

[0147] Please refer to Figure 2 , Figure 2 It is a structural diagram of an embodiment of a forward proxy tunnel monitoring system provided by the present application, comprising an analysis module 01, a reconstruction module 02 and an evaluation module 03;

[0148] The analysis module 01 is used to analyze the first data characteristics transmitted by the first forward proxy tunnel to obtain a first tunnel state vector;

[0149] Specifically, a forward proxy tunnel monitoring system also includes: a scanning module, the scanning module includes: a first analysis unit, a combination unit, a first processing unit, a second processing unit and a selection unit; the first analysis unit is used to analyze the attributes of the target system through a decision tree algorithm to obtain an optimal attribute set; the combination unit is used to generate a number of first scanning strategy combinations by arranging and combining the optimal attribute set; the first processing unit is used to randomize a number of the first scanning strategy combinations to obtain a number of scanning schemes; the second processing unit is used to evaluate each of the scanning schemes using Monte Carlo simulation, if the score of each of the scanning schemes is lower than a first preset threshold, each of the scanning schemes is optimized through a genetic algorithm to generate a number of second scanning strategy combinations; the selection unit is used to select the optimal scanning scheme from a number of the second scanning strategy combinations based on the situation of the target system.

[0150] It is understandable that before analyzing the first data characteristics transmitted by the first forward proxy tunnel, it is also necessary to confirm the scanning plan to obtain the data characteristics of the forward proxy tunnel. Specifically: First, the operating system type, open ports and service version of the target system are analyzed by a decision tree algorithm, and the optimal partitioning attributes are selected based on information gain or information gain rate to obtain the optimal attribute set; secondly, by arranging and combining the optimal attribute set, a number of first scanning strategy combinations are generated, and the first scanning strategy combination includes different scanning intensities, frequencies and durations; thirdly, by using uniform distribution or Gaussian distribution to perform random sampling within the value range of the three parameters of scanning intensity, frequency and duration in each first scanning strategy combination to achieve randomization processing, a number of scanning plans are obtained; then, each of the scanning plans is evaluated by Monte Carlo simulation, and the results are randomly selected. The computer generates a large number of network environments and defense configurations, evaluates each of the scanning schemes for multiple times to calculate the comprehensive score of each scheme, and if the score of each of the scanning schemes is lower than the first preset threshold, optimizes each of the scanning schemes through a genetic algorithm to generate a plurality of second scanning strategy combinations, and repeats the randomization process until the Monte Carlo simulation scores of the plurality of scanning schemes obtained are all greater than the first preset threshold. According to the network environment and defense capability of the scanning target system, the scanning efficiency, concealment, target coverage and other factors are comprehensively considered, and the optimal scanning scheme can be determined from the plurality of second scanning strategy combinations. At the same time, during the scanning process, the scanning intensity, frequency and duration can be adjusted in real time and dynamically according to the feedback information.Exemplarily, first, the ID3 decision tree algorithm can be used to select the optimal partitioning attribute by calculating the information gain of each attribute. Suppose there are 10 target systems to be scanned, of which 7 are Windows systems and 3 are Linux systems; in the Windows system, 5 have port 80 open and 2 have port 3389 open; in the Linux system, 2 have port 22 open and 1 has port 80 open; according to the information gain formula IG(D,A), it can be calculated that the information gain of the operating system type is 0.88, which is greater than the information gain of the port attribute of 0.62, so the operating system type is selected as the optimal partitioning attribute, and then the optimal attribute set is obtained; secondly, the optimal attribute set is arranged and combined to generate 4 scanning strategy combinations: Windows-80 port, Windows-3389 port, Linux-22 port, Linux-80 port; again, the scanning intensity, frequency, duration and other parameters of each scanning strategy combination are calculated. Uniformly distributed random sampling is used within a certain range, such as randomly selecting scanning intensity from three levels: low, medium, and high, randomly generating frequencies between 10 times / hour and 100 times / hour, and randomly generating durations between 1 hour and 24 hours, so as to obtain several scanning schemes; then, through Monte Carlo simulation, 1,000 network environments and defense configurations are randomly generated, and each scanning scheme is simulated and evaluated multiple times. The comprehensive score of each scanning scheme can be calculated by statistically analyzing indicators such as the average detection rate and false alarm rate. If the scores of all scanning schemes are lower than the preset threshold, a genetic algorithm is used for optimization until a sufficient number of second scanning strategy combinations that meet the threshold are obtained; finally, according to the network environment and defense capabilities of the target system to be scanned, the scanning scheme with the highest comprehensive score, the best scanning efficiency, and the strongest concealment is selected for execution, and the scanning intensity, frequency, and duration are adjusted according to the feedback from the target system during the scanning process. If it is detected that the number of open ports has decreased significantly, the scanning frequency can be appropriately reduced to reduce the risk of being discovered.

[0151] It should be noted that information gain measures the degree to which the uncertainty (entropy) of a data set is reduced under given feature conditions. Entropy is an indicator used to describe the purity of a data set. The higher the entropy, the more chaotic the data set is, and vice versa. The formula for information gain is: IG(D,A)=H(D)-H(D|A), where D is the data set, A is the feature, H(D) is the entropy of data set D, and H(D|A) is the conditional entropy of data set D under feature A.

[0152] It should be noted that the calculation formula of Monte Carlo simulation is: S = w1*Detection Rate+w2*FalsePositive Rate+w3*Efficiency, where Detection Rate is the detection rate, False Positive Rate is the false alarm rate, Efficiency is the scanning efficiency, w1, w2, w3 are the corresponding weight coefficients. The specific calculation process is not the focus of this application, so it will not be expanded here.

[0153] It should be noted that the first preset threshold can be set freely and is not limited in this application.

[0154] It should be noted that the optimization of each of the scanning schemes by genetic algorithm is specifically as follows: generating a second scanning strategy combination by operations such as selection operator, crossover operator and mutation operator, including obtaining the existing scanning scheme as the initial population of the genetic algorithm; calculating the fitness value of each scanning scheme according to the preset fitness function, the higher the fitness value, the better the scanning effect and efficiency of the strategy; selecting an operator, taking the fitness value as a weight, and selecting a part of the strategies from the existing scanning schemes as parent individuals; performing a crossover operation on the selected parent individuals, randomly selecting two parent individuals, and performing a crossover operation at random positions. The generated offspring scanning strategy is cross-linked to generate a new offspring scanning strategy; a mutation operation is performed on the generated offspring scanning strategy, and some gene positions are randomly selected to be inverted according to the preset mutation probability to introduce new strategy features; the parent individuals and the offspring individuals are merged, sorted according to the fitness value, and a part of the individuals with higher fitness values ​​are selected as the new generation population; the step selection operator is repeated until a part of the individuals with higher fitness values ​​are selected as the new generation population, until the preset number of iterations is reached or the termination condition is met, and the optimized second scanning strategy combination is obtained. The specific optimization process is not the focus of this application, so it will not be expanded here.

[0155] In this way, the scanning plan is determined by the attributes of the target system, and the scanning plan is scored and optimized. Based on the target system, the scanning plan with the highest comprehensive score, the highest scanning efficiency, the strongest concealment and the widest target coverage can be selected. This can cope with different target systems and defense measures, and improve the comprehensiveness and accuracy of the scan.

[0156] The analysis module 01 includes: a capture unit and a second analysis unit; specifically, the capture unit is used to capture the data packet transmitted by the first forward proxy tunnel and extract the first data feature in the data packet; the second analysis unit is used to analyze the first data feature using a support vector machine to obtain a first tunnel state vector.

[0157] It is understandable that after confirming the scanning scheme, the first data feature transmitted by the first forward proxy tunnel can be obtained and analyzed. Specifically, first, the network packet sniffing is used to capture the data packets transmitted by the first forward proxy tunnel in real time, and the size and timestamp parameters in the data packets are extracted through the parsing technology to form the first data feature; secondly, the first data feature is analyzed by the support vector machine to obtain the first tunnel state vector. Exemplarily, the tcpdump tool is used to loop capture in units of 1000 data packets, and then the dpkt library is used to parse each data packet, extract the source IP, destination IP, source port, destination port, data packet size, timestamp and other fields to form the first data feature, and the support vector machine is used to classify and predict the first data feature of the last 1 minute every 5 seconds. If the classification result is abnormal, the corresponding 1-minute time window is marked as an abnormal state. When the abnormal state accumulates to 5 minutes, it is determined to be a tunnel abnormality, and the start and end time and duration of the abnormality are recorded to form a tunnel state vector.

[0158] It should be noted that it is necessary to collect data features of the forward proxy tunnel in order to train the support vector machine model. Specifically, first, the numpy library is used to calculate the mean, variance, kurtosis, etc. of the data packet size distribution, the average, maximum, minimum and other statistical indicators of the delay between data packets, and obtain the statistical characteristics of the data packet size distribution histogram and the delay distribution curve between data packets; secondly, the support vector machine model is trained based on the statistical features, and the RBF kernel function, penalty coefficient C = 1.0, and slack variable ξ = 0.001 are used for model training to obtain the behavior pattern classification hyperplane, and the accuracy, recall rate and other indicators of the model are evaluated by the cross-validation method, and the model parameters are optimized by grid search to obtain the optimal behavior pattern classification hyperplane. Optionally, k-fold cross-validation is used to train the data. The data set is divided into k subsets, one of the subsets is used as the test set each time, and the remaining subsets are combined as the training set. K training and testing are performed, and the average of the k results is calculated as the evaluation result of the model, wherein the hyperplane can be w*x+b=0, w is the weight vector, which determines the direction of the hyperplane, x is the input vector, that is, the feature vector, and b is the bias term, which determines the position of the hyperplane; finally, the sliding time window method is used to perform real-time classification and prediction on the newly collected first data features, and the current tunnel state is judged by the distance from the behavior pattern classification hyperplane, and then the tunnel state vector is generated. The specific optimization process is not the focus of this application, so it will not be expanded here.

[0159] It should be noted that in the process of establishing a forward proxy tunnel, a certificate and key bidirectional authentication mechanism based on the SSL / TLS protocol can be used, and the OpenSSL library can be used to implement identity authentication and key negotiation to ensure the legal identity of both parties in the tunnel communication. Specifically, first, the client identity information is associated with the tunnel state vector to establish a client behavior feature portrait, and the DBSCAN density clustering algorithm is used. With Euclidean distance or cosine similarity as the clustering similarity measurement index, abnormal behavior patterns are identified through cluster analysis; secondly, the suspicious clients corresponding to the abnormal behavior patterns are identified by combining the clustering analysis results and the tunnel state vector, and a suspicious client list is generated; finally, the degree of suspicion is determined based on the tunnel state vector. For clients with abnormal behavior patterns, they are divided into three levels: low risk, medium risk, and high risk according to the cumulative duration and frequency of their abnormal states, and different management and control strategies are adopted for each level: the maximum number of connections for low-risk clients is limited to 10, the maximum number of connections for medium-risk clients is limited to 5, and high-risk clients are directly disconnected and added to the blacklist. At the same time, the key length and update cycle of encrypted transmission are dynamically adjusted. The key length of low-risk clients is 128 bits, and the update cycle is 1 day. The key length of medium-risk clients is 256 bits, and the update cycle is 12 hours. The key length of high-risk clients is 384 bits, and the update cycle is 1 hour. This improves the security of tunnel transmission. The specific identity authentication process is not the focus of this application, so it will not be expanded here.

[0160] In this way, by analyzing the first data feature transmitted by the first forward proxy tunnel to obtain the first tunnel state vector, the data transmitted by the first forward proxy tunnel can be monitored in real time, which facilitates subsequent judgment of the tunnel situation.

[0161] The reconstruction module 02 is used to determine whether a tunnel failure occurs based on the first tunnel state vector, and if a tunnel failure occurs, re-establish the connection of the second forward proxy tunnel;

[0162] The reconstruction module 02 includes: a third processing unit, a fourth processing unit and a reconstruction unit; specifically, the third processing unit is used to normalize the first tunnel state vector to obtain a third tunnel state vector; the fourth processing unit is used to calculate the Mahalanobis distance between the third tunnel vectors; the reconstruction unit is used to determine that a tunnel failure occurs if the Mahalanobis distance between the third tunnel vectors is greater than a second preset threshold, and then re-establish the connection of the second forward proxy tunnel.

[0163] It can be understood that after the first tunnel state vector is obtained, the state of the tunnel can be determined. Specifically, first, the first tunnel state vector is normalized to obtain the third tunnel state vector; second, the Mahalanobis distance between the third tunnel vectors is calculated; finally, if the Mahalanobis distance between the third tunnel vectors in a certain time period is greater than the second preset threshold, it is determined that a tunnel fault occurs, and the fault type or fault level is determined based on the preset classification and regression tree decision tree model, and the pre-set handling action is matched according to the fault type. For general faults with short tunnel interruption time and small available bandwidth reduction, it is preferentially restored by re-establishing the TCP connection; for serious faults with long interruption time and large bandwidth reduction, the operation of dynamically switching the backup transmission channel is triggered. At the same time, during the entire process of fault handling and recovery, the status data of each tunnel will be continuously monitored, and key performance indicators such as fault occurrence frequency and average recovery time will be calculated. Visual display is performed through tools such as control charts or exponentially weighted moving average (EWMA), and the anomaly detection model and fault handling strategy are continuously tuned to improve the tunnel self-healing ability, shorten the fault recovery time, and maximize the reliability and continuity of data transmission.For example, assume that the forward proxy tunnel has five key status indicators: average delay, packet loss rate, throughput, number of interruptions and interruption duration. The status data is collected every 5 seconds to form a 5-dimensional state vector. Secondly, the collected status data is normalized, and the value range of each indicator is scaled to the interval [0, 1] to eliminate the dimension effect. Then, the Mahalanobis distance is used to measure the similarity between the state vectors. If the mean value of the Mahalanobis distance is 1.5 and the standard deviation is 0.5 calculated based on historical data, the normal threshold range can be determined to be [0.5, 2.5]. When the Mahalanobis distance of the state vector within a certain time window (such as 1 minute) exceeds 2.5, it is determined to be a tunnel failure. At the same time, the fault type or fault level is determined based on the preset classification and regression tree decision tree model, and the pre-set handling action is matched according to the fault type. If the interruption duration exceeds 1 minute and the available bandwidth decreases by more than 50%, it is further determined to be a serious fault, otherwise it is a general fault. For general faults, the recovery strategy of re-establishing the TCP connection is preferred, and the reconnection time interval is dynamically adjusted through the exponential backoff algorithm. The initial interval The interval is 1 second, and the interval is multiplied by 2 after each reconnection failure. If the connection is still not restored after 5 reconnections, the fault is reported. For serious faults, a recovery strategy of dynamically switching the backup transmission channel is selected, and 3 backup tunnels are established in advance. The latency, bandwidth and other indicators of the backup tunnels are detected every 30 seconds. When the main tunnel fails seriously, the backup tunnel with the lowest latency and the highest bandwidth is selected, and the OpenFlow flow table is sent down through the SDN controller to modify the tunnel ID field of the data packet to the backup tunnel ID to achieve seamless switching of the tunnel. Finally, in the process of TCP connection reconstruction and backup tunnel switching, the SPDY protocol is used to multiplex multiple TCP connections to reduce the overhead of connection establishment and improve link utilization. When the tunnel is restored, the EWMA tool is used to count and visualize KPI indicators such as fault occurrence frequency and average recovery time. When the fault frequency exceeds the warning threshold for 3 consecutive cycles, the retraining and optimization of the tunnel status prediction model is triggered, and the Mahalanobis distance threshold, decision tree model, etc. are dynamically updated using the latest status data to continuously improve the intelligence level of tunnel anomaly detection and fault handling.

[0164] It should be noted that re-establishing the connection of the second forward proxy tunnel mainly involves re-establishing or "regenerating" a tunnel through forward proxy technology in network security and network communications, which includes re-establishing the TCP connection and switching the backup transmission channel. The specific process of rebuilding the tunnel is not the focus of this application, so it will not be expanded here.

[0165] It should be noted that the classification and regression tree decision tree model uses indicators such as tunnel interruption duration and available bandwidth reduction as decision variables, fault type or fault level as target variable, uses the Gini coefficient for feature selection and node partitioning, selects the optimal partitioning attribute, generates a fault handling decision path, and can also enhance the generalization performance of the model through cross-validation and pruning optimization strategies. The specific training process is not the focus of this application, so it will not be expanded here.

[0166] It should be noted that the second preset threshold can be determined according to the mean and standard deviation of the Mahalanobis distance. The specific determination process is not the focus of this application and will not be expanded here.

[0167] In this way, whether a tunnel failure occurs can be determined based on the Mahalanobis distance between tunnel state vectors, and the tunnel failure can be resolved by rebuilding a second forward proxy tunnel. This can achieve intelligent tunnel fault monitoring and fault handling, and improve tunnel stability and reliability.

[0168] The evaluation module 03 is used to analyze the second data feature in the second forward proxy tunnel to obtain a second tunnel state vector, evaluate the second tunnel state vector to obtain an evaluation result, and match a corresponding execution strategy based on the evaluation result.

[0169] Specifically, the evaluation module 03 includes: a first evaluation unit, a first adjustment unit, a second adjustment unit and a third adjustment unit: the first evaluation unit is used to evaluate the second tunnel state vector through a preset tunnel state evaluation model to form a tunnel state evaluation result; the first adjustment unit is used to dynamically calculate and adjust the weight coefficient of the second forward proxy tunnel based on the tunnel state evaluation result by using a weighted polling scheduling algorithm; the second adjustment unit is used to dynamically adjust the forwarding path and traffic ratio of the second forward proxy tunnel by using software-defined network technology; the third adjustment unit is used to optimize the weight coefficient, the forwarding path and the traffic ratio by using a preset simulated annealing algorithm.

[0170] It is understandable that after the connection of the second forward proxy tunnel is re-established, the forward proxy tunnel needs to be monitored. Specifically, first, using network traffic mirroring and data packet parsing technology, deploy traffic monitoring probes at the entrance and exit nodes of the tunnel to extract the second data features in the second forward proxy tunnel in real time, and obtain the second tunnel state vector by analyzing the second data features, including average transmission delay, delay jitter standard deviation, average packet loss rate, throughput performance indicators, and link encryption algorithm, key length, and security attributes of the authentication protocol; secondly, evaluate the second tunnel state vector through a preset tunnel state evaluation model to form a tunnel state evaluation result; thirdly, based on the tunnel state evaluation result, use a weighted polling scheduling algorithm to dynamically calculate and adjust the weight coefficient of the second forward proxy tunnel, and introduce a threshold-based dynamic weight. An adjustment mechanism is provided to reduce the weight of a tunnel when its comprehensive score is lower than a certain threshold, and to increase the weight when it is higher than the threshold, thereby forming a negative feedback adaptive adjustment; then, the forwarding rules are centrally issued through the controller using software-defined network technology to dynamically adjust the forwarding path and traffic ratio of the second forward proxy tunnel, and a refined distribution strategy is formulated based on the source IP address, target URL, request method and other characteristics of the request, and a rule-based engine such as Drools is used to realize intelligent distribution of load balancing; finally, a preset simulated annealing algorithm is used to search for the optimal load balancing parameters, and the load balancing parameters include the weight of each tunnel, forwarding rules and queue length, etc., so as to optimize the weight coefficient, the forwarding path and the traffic ratio.Exemplarily, first, through the network traffic mirroring technology, traffic monitoring probes are deployed at the inlet node and the outlet node of the tunnel respectively, with a sampling period of 1 minute to collect the status characteristic data of the tunnel in real time; secondly, the collected data is preprocessed to remove abnormal values ​​and outliers, and 15 key performance indicators (KPIs) such as average transmission delay, delay jitter standard deviation, average packet loss rate, and throughput, as well as 5 security attributes such as link encryption algorithm, key length, and authentication protocol are extracted to form a 20-dimensional second tunnel state vector; secondly, the second tunnel state vector is evaluated by a preset tunnel state evaluation model to form a tunnel state evaluation result; then, according to the comprehensive score of the tunnel, a weighted round robin algorithm is used to dynamically adjust the weight of the tunnel. If the initial weight is 1, when the comprehensive score is lower than 0.6, the weight is halved, and if it is higher than 0.6, the weight is halved. When the weight is 0.85, the weight is doubled, and the weight configuration is updated every 10 minutes to adjust the tunnel weight. Finally, the SDN controller dynamically sends forwarding rules based on OpenFlow to match the first 24 bits of the source IP address of the data packet, the domain name of the target URL, the request method (GET / POST) and other fields, and uses the Drools rule engine to write distribution strategies, such as directing requests from area A to tunnel A, and directing requests from area B to tunnel B, etc. On the basis of the forwarding rules, the simulated annealing algorithm is used to search for the optimal parameter configuration with the minimization of the standard deviation of delay jitter and packet loss rate as the optimization goal. When the change rate of the simulated annealing algorithm function value is less than 0.01 or the number of iterations reaches 1000, the simulated annealing algorithm converges and outputs the optimal parameter configuration. The simulated annealing algorithm is re-run every 30 minutes to dynamically optimize the load balancing strategy according to the changes in the tunnel status.

[0171] It should be noted that it is also possible to collect massive amounts of tunnel status data from the second forward proxy tunnel through perception technologies such as INT (In-band Network Telemetry), including performance indicators and security indicators such as throughput, latency, packet loss rate, retransmission rate, number of connections, and further analyze and form a fine-grained tunnel state vector.

[0172] It should be noted that the tunnel state evaluation model is constructed based on the second tunnel state vector. By assigning different weights to various performance and security indicators, a weighted sum evaluation function is formed. The specific construction process is not the focus of this application, so it will not be expanded here.

[0173] It should be noted that in the iterative search process of the simulated annealing algorithm, the Markov chain Monte Carlo method can be introduced to generate new candidate states, the gradient of the energy function can be calculated by the gradient descent method, the direction and step size of the state jump can be corrected, the convergence of the algorithm can be accelerated, and clear convergence conditions can be set, such as the rate of change of the energy function value is lower than a certain threshold, or the amplitude of the state change is lower than a certain threshold. At the same time, the maximum number of iterations is set as a bottom-line condition to prevent the algorithm from falling into an infinite loop; after reaching the convergence condition or the maximum number of iterations, the optimal load balancing parameter configuration is output. The specific optimization process is not the focus of this application, so it will not be expanded here.

[0174] In this way, the parameter optimization process can be periodically re-triggered according to changes in the tunnel status, and the tunnel weight and forwarding rules can be dynamically updated to minimize the transmission delay jitter and packet loss rate of business requests, improve load balancing performance and link utilization, and improve tunnel stability and reliability.

[0175] Specifically, the evaluation module 03 also includes: a second evaluation unit and a fourth adjustment unit: the second evaluation unit is used to calculate the anomaly score of the second tunnel state vector through an isolation forest algorithm; the fourth adjustment unit is used to determine that there is an attack behavior in the second forward proxy tunnel if the anomaly score is greater than a third preset threshold, and then re-establish the connection of the third forward proxy tunnel.

[0176] It is understandable that it is also possible to determine whether there is an attack on the second forward proxy tunnel based on the second tunnel state vector. Specifically, the abnormal score of the second tunnel state vector is calculated by the isolation forest algorithm; if the abnormal score is greater than the third preset threshold, it is determined that the second forward proxy tunnel has security threats or intrusions and other attack behaviors, and transitional security protection measures are taken to clean the traffic of suspicious tunnels, redirect honeypots, and perform deep protocol analysis, etc., to avoid frequent interruptions of tunnels as much as possible, and automatically trigger the tunnel security response mechanism, issue instructions through the SDN controller, release the network and computing resources occupied by the abnormal tunnel, re-apply for new resources from the resource pool, use the tunnel mode of the IPSec protocol, complete identity authentication and key exchange with the communication peer through the IKE (Internet Key Exchange) protocol, or use the SSL / TLS protocol for two-way digital certificate authentication, and re-establish the connection of the third forward proxy tunnel. For example, when the anomaly score of a tunnel node exceeds the threshold range [0.5, 0.7] for 5 consecutive minutes, the traffic of the suspicious tunnel is mirrored to the honeypot, and the threat behavior is detected through protocol parsing and behavior analysis; at the same time, the controller is notified to delete the tunnel forwarding rules, release tunnel resources, select the one with the lowest delay jitter from the backup link to re-establish the IPSec tunnel, execute the Diffie-Hellman key exchange algorithm through the IKE protocol, use the AES-256-GCM algorithm to encrypt data, and the SHA-256 algorithm for integrity verification. The 5-minute heartbeat interval and 30-second death time are used to detect the tunnel viability, and safe and reliable tunnel communication is achieved. The effectiveness of tunnel anomaly detection is tested by red and blue attack and defense drills with 200 tunnel attack traffics. The evaluation indicators include detection rate (TP / (TP+FN)), false alarm rate (FP / (FP+TN)), average detection delay, CPU occupancy, etc., and a tunnel security assessment report is formed to discuss improvement measures and implement them in all aspects of anomaly detection and security defense.

[0177] It should be noted that the second tunnel state vector can be used to construct a tunnel safety anomaly detection data set, an outlier detection algorithm such as local anomaly factor (LOF) is used to identify and filter noise data, a feature selection algorithm such as recursive feature elimination (RFE) is used to select the most relevant anomaly features, and an oversampling technique such as SMOTE is used to balance the ratio of abnormal samples and normal samples. The data set is cleaned and optimized, and the processed tunnel feature vector is input into the isolation forest unsupervised anomaly detection algorithm. By recursively randomly selecting features and randomly dividing the feature space, multiple isolated trees are constructed, and the average path length from each sample point to the isolated tree set is calculated as the anomaly score. The shorter the score, the more likely the sample point is an anomaly point. In addition, on the basis of the isolation forest algorithm, an adaptive dynamic threshold mechanism can also be introduced, and the statistical process control (SPC) theory is used. According to the mean μ and standard deviation σ of historical anomaly detection, the initial threshold is set to μ+3σ, and then fine-tuned in combination with expert experience, and an adaptive learning mechanism is introduced to dynamically adjust the threshold according to the abnormal situation of the newly added samples to improve the sensitivity and accuracy of anomaly detection. The specific training process and threshold setting process are not the focus of this application, so they will not be expanded here.

[0178] In this way, by analyzing the second data feature in the second forward proxy tunnel to obtain the second tunnel state vector, the state of the reconstructed second forward proxy tunnel can be evaluated to determine whether there is abnormal behavior in the second forward proxy tunnel, thereby facilitating matching of corresponding disposal strategies and improving the stability and reliability of the tunnel.

[0179] Specifically, the evaluation module 03 also includes: an input unit, a third evaluation unit and a fifth adjustment unit: the input unit is used to input the second tunnel state vector into a preset graph attention network model; the third evaluation unit is used to calculate the risk probability of the second forward proxy tunnel through the graph attention network model; the fifth adjustment unit is used to dynamically adjust the routing forwarding strategy of the second forward proxy tunnel or optimize the transport layer protocol if the risk probability is greater than a fourth preset threshold.

[0180] It is understandable that the risk probability of the second forward proxy tunnel can also be judged based on the second tunnel state vector. Specifically, first, the second tunnel state vector is input into the preset graph attention network model; second, the graph attention network model is used to perform rolling predictions based on the tunnel health trend and key performance indicators of the preset time, and the health score and key performance indicators of each tunnel node at the preset time are output. According to the health prediction results of the tunnel nodes, combined with the importance, impact range, historical failure frequency and other factors of the tunnel, a risk assessment matrix is ​​constructed to classify the tunnel failure risk to determine the risk probability of the second forward proxy tunnel; finally, if the risk probability is greater than the fourth preset threshold, it is determined that the tunnel has a high failure risk, and active defense measures are automatically triggered. Active defense dynamically adjusts the routing forwarding strategy of the tunnel node through the SDN controller, and uses the TCP-RL algorithm based on reinforcement learning to optimize the transport layer protocol. According to the state indicators such as the packet loss rate and delay of the tunnel, the TCP congestion window and retransmission timeout are dynamically adjusted. At the same time, an end-to-end hybrid transmission mechanism is introduced to dynamically switch between TCP and UDP.

[0181] It should be noted that the TCP-RL algorithm combines the TCP protocol and the dynamic adjustment mechanism of reinforcement learning (RL). It is mainly used to optimize the TCP congestion control strategy to improve network performance, especially when network conditions change, it can quickly adapt and make optimal decisions. Its core is to use reinforcement learning technology to dynamically adjust the parameters of the TCP protocol, such as the congestion window size, retransmission timeout, etc., to cope with congestion and other uncertain factors in the network.

[0182] It should be noted that the topological structure of the tunnel network can be abstracted into a directed weighted graph model, with tunnel nodes mapped as graph nodes, forward links and reverse links mapped as directed edges of the graph, and edge weights representing the health scores of the forward links and reverse links respectively. Edge (i, j) can be used to represent the link between tunnel node i and node j, and edge weight w(i, j) represents the health score of the link, including but not limited to the integrity of the tunnel structure, maintenance status, past accident records, traffic flow, road quality, etc.; the Z-score normalization method is used to normalize the multidimensional state feature vector of the tunnel node, and the value range of each indicator is scaled to a standard normal distribution with a mean of 0 and a variance of 1, forming the standardized features of the tunnel node as the attributes of the graph node. The feature dimension of each node is D, and the node feature matrix of the tunnel network topology graph is N×D dimensional, where N is the number of tunnel nodes. A two-layer graph neural network model is built. The first layer is the graph attention layer. The GAT algorithm is implemented using the MXNetGluon framework. Four attention heads are set, and the scaled dot product attention mechanism is used to calculate the attention coefficient between nodes, that is, the dot product of the node feature vector is divided by the square root of the vector dimension, and then the attention weight is obtained by normalization through the Softmax function. The features of each node are aggregated with the information of neighboring nodes through the attention mechanism to obtain the node embedding vector; the second layer is the graph convolution layer, which uses the GCN algorithm, sets 3 layers of graph convolution and 256 convolution kernels, and further propagates and updates the node embedding. The tunnel status data of a week in history is selected, and the training samples are constructed with a time step of 6 hours. The graph data is loaded in batches and the Adam optimizer is used to train the model. The tunnel health and key performance indicators are used as labels, and the binary cross entropy loss function is used. After 100 rounds of iterative training, the graph neural network model can be trained. The specific training process is not the focus of this application, so it will not be expanded here. Among them, the Z-score normalization method is used to convert the original data into a standard normal distribution with zero mean and unit variance, which can eliminate the dimensionality effect between different features and enable data of different dimensions and units to be compared and analyzed on the same scale. MXNet Gluon is a deep learning framework that provides a flexible and efficient API to build and train complex neural network models. GAT (Graph Attention Network) is a graph neural network model that uses the attention mechanism to aggregate node neighbor information to solve the problem of learning node representations in the graph. This framework is used to build a graph attention network.GCN (Graph Convolutional Network) is a deep learning model specifically designed to process graph data. It can capture the node features and their relationships in the graph structure. Its main purpose is to learn the representation of nodes by aggregating the information of nodes and their neighbors. These representations can be used for a variety of downstream tasks, such as node classification, link prediction, etc. Specifically, it updates the representation of each node by iteratively combining the features of each node with its direct neighbors.

[0183] In this way, by analyzing the second data feature in the second forward proxy tunnel to obtain the second tunnel state vector, the state of the reconstructed second forward proxy tunnel can be evaluated to determine whether there is an attack behavior in the second forward proxy tunnel, so as to facilitate matching of the corresponding disposal strategy, achieve more accurate and efficient fault defense and resource scheduling, and thus improve the stability and reliability of the tunnel.

[0184] Specifically, the evaluation module 03 also includes: a classification unit, a matching unit and an optimization unit: the classification unit is used to classify the second tunnel state vector to obtain a corresponding health level; the matching unit is used to match the corresponding third scanning strategy for the second forward proxy tunnels with different health levels; the optimization unit is used to optimize the third scanning strategy using a multi-objective particle swarm optimization algorithm to obtain an optimal scanning parameter combination.

[0185] It is understandable that the scanning strategy can also be adjusted based on the second tunnel state vector. Specifically, first, the second tunnel state vector after tunnel regeneration is input into the graph attention network model, and the attention mechanism is used to update the hidden state of the target node through feature aggregation of neighboring nodes, and then the node embedding representation is obtained through sum or concat aggregation operation, and then the information is propagated between nodes through graph convolution, and finally mapped to the tunnel health level space through the fully connected layer to obtain the tunnel health level (such as excellent, good, medium, and poor); secondly, for the second forward proxy tunnels with different health levels, the time granularity, frequency, concurrency, and coverage parameters of the optimized scan are combined to form multiple scanning strategy alternative sets, and different strategy weights are assigned. The weight is positively correlated with the tunnel health level. For example, for the health level of " The weight of the tunnel with a health level of "excellent" can be set to 0.8, the weight of the tunnel with a health level of "good" is 0.6, and so on, to match the third scanning strategy corresponding to the second forward proxy tunnel; finally, the multi-objective particle swarm optimization algorithm is used to optimize the third scanning strategy, and the minimization of scanning response time, maximization of abnormal detection rate, minimization of false alarm rate, and minimization of CPU occupancy are taken as optimization goals. Each optimization goal is normalized to the same scale through weighted summation, and the fitness score is calculated. The upper limit of scanning time and the upper limit of CPU occupancy are taken as constraints. The particle encoding is a scanning parameter combination, and the particle speed corresponds to the parameter adjustment amplitude. After 1000 iterations, the Pareto optimal solution set is output to obtain the optimal scanning parameter combination. Finally, according to the changes in tunnel status and external environmental interference factors, the scanning strategy is dynamically adjusted, and the latest dynamically adjusted tunnel state vector set is input into the multi-objective particle swarm optimization algorithm to generate the optimal scanning parameter combination that matches the tunnel state vector, and deployed to the distributed scanner to start the scanning task; the scanning result data is returned to the graph attention network model, and the model parameters are fine-tuned in a supervised or semi-supervised manner to continuously improve the accuracy of tunnel state classification and anomaly detection, and enhance the model's adaptability and robustness; of course, the scanning task scheduling and tunnel state prediction can also be modeled as a two-player game for target long-term benefits. By designing a reasonable reward function, the dynamic scheduling strategy of the scanning task and the prediction results of the graph neural network are guided to adapt to each other and dynamically compete, continuously improving the intelligent optimization capability of the entire system; at the same time, the average response time, anomaly coverage, resource utilization, etc. of the scanning task can also be used as evaluation indicators to continuously verify and optimize the dynamic adjustment mechanism of the scanning strategy.For example, tunnel status perception uses the network telemetry framework IntellFlow, with a sampling interval of 10 milliseconds, to collect 200 multi-dimensional status indicators of newly generated tunnels in real time through network probes, use the LocalOutlierFactor (LOF) algorithm to identify and filter outliers in the single dimension of the status indicators, perform Min-Max normalization on the status indicators, map them to the [0,1] interval, and use the Recursive Feature The RFE algorithm recursively eliminates redundant indicators, selects 20 most relevant indicators to form a feature vector, and inputs the feature vector into the graph attention network model to output the tunnel health level; then, the third scanning strategy corresponding to the second forward proxy tunnel is generated through knowledge graph reasoning. The knowledge graph contains 100 candidate strategies, each strategy consists of 10 scanning parameters, forming a 1000-dimensional high-dimensional strategy space, and the strategy weight calculation formula is w=0.8^(4-l), where l represents the tunnel health level (excellent: 4, good: 3, medium: 2, poor: 1); secondly, multiple scanning strategy candidate sets are formed for different health levels, and different strategy weights are assigned. The weight is positively correlated with the tunnel health level. For example, for a tunnel with an "excellent" health level, its weight can be set to 0.8, and the weight of a tunnel with a "good" health level is 0.6, and so on, to match the third scanning strategy corresponding to the second forward proxy tunnel; finally, the multi-objective particle swarm optimization algorithm is used to optimize the third scanning strategy to obtain the optimal scanning parameter combination.

[0186] It should be noted that the sum operation simply adds the feature vectors of all neighbor nodes to obtain a new vector as the new feature representation of the central node, and the concat operation concatenates the feature vectors of neighbor nodes along the feature dimension to form a longer vector.

[0187] It should be noted that concurrency refers to the number of scanning tasks performed simultaneously, and coverage refers to the comprehensiveness and depth of the scan.

[0188] It should be noted that when adjusting the scanning strategy, anomaly detection algorithms such as the isolation forest algorithm can be used to identify suspicious areas from the scan result data, extract relevant state features, and expand the training sample set of the graph neural network. Among them, the isolation forest (IF) algorithm is an unsupervised learning method for anomaly detection. It constructs multiple isolated trees by randomly selecting features and randomly splitting feature space; in the process of building isolated trees, data points are recursively split until each data point is isolated. For each data point, the average path length in all isolated trees is calculated. The anomaly score is calculated based on the average path length. The lower the score, the more likely the data point is an anomaly.

[0189] It should be noted that the Local Outlier Factor (LOF) algorithm is an unsupervised learning method for anomaly detection. It is suitable for detecting data points that appear abnormal in a local area. It determines whether a data point is abnormal by comparing the density difference between a data point and its neighboring data points. If the density of a point is much lower than the average density of its neighborhood, the point is considered abnormal; the Recursive Feature Elimination (RFE) algorithm is used for feature selection. It reduces the size of the feature set by recursively removing the least important features; the graph attention network model is built using the Python framework, which includes 2 layers of graph attention layers and 3 layers of graph convolution layers. The graph attention layer calculates the attention weights using the scaled dot-product attention formula. After softmax normalization, it is weighted and summed with the neighborhood node features. The output vectors of the 2-layer attention layer are concat and input into the graph convolution layer for information propagation. The ReLU activation function is used and regularized by Batch Normalization and Dropout; Scaled Dot-Product Attention is a graph attention network (Graph Attention An attention mechanism used in GAT, which is used to capture the relationship between nodes in graph-structured data and assign different weights to the neighbors of each node. Batch Normalization is used to accelerate deep neural network training. It standardizes the input of each layer so that the input of each layer has the same distribution, thereby reducing internal covariate shift. It is applied after the fully connected layer and the convolutional layer and before the activation function. Dropout regularization is used to prevent overfitting of deep learning models. It achieves this goal by randomly "discarding" (i.e. temporarily disabling) a part of neurons during training. This random discarding prevents the model from relying too much on any single neuron during training, thereby enhancing the generalization ability of the model.

[0190] It should be noted that the multi-objective particle swarm algorithm adopts the NSGA-II framework, initializes 100 particles, each particle is encoded with 100 scanning parameters, and retains the non-dominated solutions of the Pareto frontier through non-dominated sorting and crowding calculation. The particle velocity and position update formula is v = w·v+c1·r1·(pbest-x)+c2·r2·(gbest-x), x = x+v, where w = 0.8, c1 = c2 = 1.5, r1 and r2 are random numbers in [0,1]. v represents the velocity vector of the particle, which determines the direction and speed of the particle's movement in the search space. w represents the inertia weight, which is used to control the influence of the particle's previous velocity, that is, how much of the original velocity component is retained in the new velocity. c1 and c2 represent learning factors, which control the degree of adjustment of the particle to the individual optimal solution pbest and the global optimal solution gbest, respectively. r1 and r2 represent random numbers ranging from [0,1], which are used to introduce randomness so that the search process is not completely deterministic and increase the global search capability of the algorithm. pbest represents the historical optimal position of each particle, that is, the best solution the particle has ever experienced. gbest represents the global optimal position in the current population, that is, the best solution among all particles. x represents the position vector of the current particle. After updating, the particle will move to a new position according to the new velocity v. Among them, the normalization formula of the optimization target is f=(Σwi·fi-fmin) / (fmax-fmin), where wi is 0.5, 0.3, 0.1, and 0.1 respectively, where fi represents the unnormalized value of the i-th optimization target, that is, the original objective function value, and wi represents the weight coefficient of each target, which is used to reflect the importance of different targets. fmin represents the minimum value of all objective function values, which is used to calculate the lower bound of the normalized range. fmax represents the maximum value of all objective function values, which is used to calculate the upper bound of the normalized range. f represents the normalized comprehensive objective function value. After all targets are weighted and processed, they are normalized to ensure that the result falls between 0 and 1, which is convenient for comparing the quality of different solutions, especially in multi-objective optimization scenarios, to help identify Pareto frontier solutions. The specific training process of the multi-objective particle swarm algorithm is not the focus of this application, so it will not be expanded here.

[0191] It should be noted that the Isolation Forest Anomaly Detection Algorithm uses the scikit-learn framework to construct multiple isolated trees based on 20 result indicators such as scan response time and CPU occupancy. The maximum depth of the tree is 8, and the internal nodes are randomly divided. The anomaly score calculation formula is s = 2^(-E / c(n)), where E represents the average path length from the sample to the root node of the isolated tree, c(n) is the normalization factor of the average path length, and the threshold is set to 0.6. The MAML meta-learning algorithm is used for fine-tuning the graph neural network model. 10 tasks are sampled from the support set, with 5 samples for each task. The inner loop learning rate is 0.01, the outer loop learning rate is 0.001, and the initialization parameters are obtained by iterating 10 times. Then the model is fine-tuned on the query set, and the triplet loss and cross entropy loss functions are used for joint optimization to dynamically update the tunnel state embedding representation and classification decision surface. In the game theory modeling, the strategy spaces of the two players for scanning task scheduling and tunnel state prediction are defined as 100 dimensions and 20 dimensions respectively, and the reward function is the weighted sum of scanning efficiency and prediction accuracy. The Nash equilibrium is solved by the multi-agent reinforcement learning algorithm MADDPG. The critic network uses centralized training and decentralized execution. The actor network generates actions based on local observations. The exploration noise uses the Ornstein-Uhlenbeck process, and 100 trajectories are trained in parallel. The discount factor γ = 0.95 and the softupdate parameter. The specific training process of the isolation forest anomaly detection algorithm is not the focus of this application, so it will not be expanded here.

[0192] In this way, by matching the corresponding scanning strategy based on the second tunnel state vector and optimizing the scanning strategy, it can be ensured that the second forward proxy tunnel can be scanned comprehensively and accurately.

[0193] Specifically, a forward proxy tunnel monitoring system also includes: a decision module, which includes: a mapping unit, a computing unit and a decision unit; the mapping unit is used to map scanning strategy selection, tunnel state detection and security threat detection to a Markov decision process respectively; the computing unit is used to solve the Markov decision process through a deep deterministic policy gradient algorithm to obtain an optimal state-action mapping strategy; the decision unit is used to adjust the hyperparameters of the deep deterministic policy gradient algorithm to output an intelligent decision integrating scanning strategy selection, tunnel state detection and security threat detection.

[0194] It can be understood that after matching the corresponding execution strategy based on the evaluation results, it also includes: first, mapping the scanning strategy selection, tunnel status detection and security threat detection to the state space and action space of the Markov decision process respectively. The state space includes the state attributes of multiple dimensions such as the health level of the current tunnel, traffic intensity, and routing stability. The action space includes a combination of various scanning strategy parameters. The representation method of parameterized action space is adopted to map each parameter to a real value within a fixed range. The action space is the Cartesian product of all parameters. The strategy function is optimized by performing strategy search in continuous space; secondly, a reward function for the global optimization goal is designed. Referring to the framework of multi-objective optimization, weight coefficients are set for the scanning efficiency, concealment and other goals respectively, and a scalar is generated by weighted summation. The reward value considers the balance between short-term and long-term benefits, adds a discount factor to attenuate future rewards, positively incentivizes the improvement of scanning efficiency and security risks, and negatively punishes the decline of tunnel performance and the reduction of concealment; again, the Markov decision process is solved by the deep deterministic policy gradient algorithm to obtain the optimal state-action mapping strategy; finally, using the idea of ​​meta-learning, the hyperparameters of the DDPG algorithm are adaptively adjusted through Bayesian optimization, reinforcement learning and other methods, and combined with transfer learning algorithms such as meta-policy gradient and policy generalization, an initial strategy adapted to different tasks is learned through meta-training, and the deep deterministic policy gradient algorithm is fine-tuned in the new scenario to output intelligent decision-making that integrates scanning strategy selection, tunnel state detection and security threat detection.

[0195] It should be noted that the deep deterministic policy gradient algorithm consists of a deterministic policy network (Actor) and a value network (Critic). The policy network generates deterministic action outputs based on state inputs, and the value network evaluates the long-term cumulative rewards of state-action pairs. The two networks are continuously optimized and updated through alternating iterations, and finally converge to the optimal state-action mapping strategy; the neural network structure of the DDPG algorithm is built, and for the high-dimensional features of the state space, a convolutional neural network (CNN) is used for feature extraction and dimensionality reduction, combined with a recurrent neural network (RNN) to model the temporal dependency of the state, or an unsupervised learning method such as an autoencoder is used to learn a low-dimensional embedding representation of the state; the policy network contains 3 hidden layers, each with 64 neurons, the activation function is ReLU, and the output layer uses a tanh function to map the action value to between [-1,1]; the value network contains 2 hidden layers, each with 128 neurons, the activation function is ReLU, and the output layer uses a linear function to predict the Q value of the state-action pair. The experience replay mechanism is introduced to store the state transition data (current state, action, reward value, next state) of each step in the experience pool, break the time correlation between the data, and extract small batches of data from the experience pool by random batch sampling to train the neural network. In the training process of the DDPG algorithm, the target network mechanism is introduced to create a copy for each policy network and value network as the target network for policy evaluation and Q value estimation. The parameters of the main network are copied to the target network every 100 to 1000 steps. The coefficient of soft update is 0.01, which makes the update of the target network smoother, so as to improve the stability and robustness of the decision and avoid the oscillation and divergence of the strategy. On this basis, the idea of ​​hierarchical reinforcement learning (HierarchicalRL) is introduced to decompose the complex decision-making process into multiple abstract levels, each level corresponds to a sub-strategy, the upper strategy is responsible for selecting the lower strategy, and the lower strategy is responsible for executing specific actions. Through this hierarchical decision-making mechanism, the policy optimization problem of large-scale complex systems can be better dealt with; the specific training process of the deep deterministic policy gradient algorithm is not the focus of this application, so it will not be expanded here.

[0196] It should be noted that the state space of the Markov decision process includes 20 tunnel health levels (0100 points), 10 traffic intensity levels (010), and 5 routing stability levels (04), forming 20×10×5=1000 state combinations; the action space includes the scanning time interval (0.110 seconds), the number of scanning proxies (1100), the port range (065535), and the scanning message disguise method (SYN, ACK, FIN, PSH, etc.). By parameterizing the action space, each parameter is mapped to the [0,1] interval, corresponding to 1×100×65536×4=26214400 action combinations; the reward function is designed as r=0.5×e+0.3×i+0.1×p+0.1×s, where e is the scanning efficiency (0-1 00 points), i is concealment (0-100 points), p is tunnel performance (0-100 points), s is security risk (0-100 points), and the discount factor γ is 0.9. The state feature extraction of the DDPG algorithm adopts a three-layer CNN. The convolution kernel sizes of the first to third layers are 32 convolution kernels with a size of 5x5, 64 convolution kernels, the size is reduced to 3x3, and 128 convolution kernels with a size of 3x3, ReLU function activation, and the output of the last layer of CNN is flattened and connected to a 256-dimensional fully connected layer; the policy network contains 2 hidden layers, each with 64 neurons, and the value network contains 2 hidden layers, each with 128 neurons; the capacity of the experience replay pool is set to 1 million, the batch sampling size is 64, and 10,000 random data are used to fill the experience pool before training starts. The target network copies parameters from the main network every 200 steps, and the soft update coefficient τ = 0.01; the layered strategy sets three levels of scanning frequency, scanning range, and scanning intensity, and each level has 3 alternative sub-strategies, forming 27 combinations; meta-learning uses the MAML algorithm, with an outer loop learning rate of 0.001 and an inner loop learning rate of 0.01. Each meta-update samples 10 tasks from 100 tasks, and each task is trained for 5 steps. The specific content of the Markov decision process is not the focus of this application, so it will not be expanded here.

[0197] It should be noted that the transfer learning adopts the DAML algorithm, the source domain is the tunnel communication model of business scenario A, the target domain is the tunnel communication model of business scenario B, the first three layers of the policy network in scenario A are extracted as the initialization parameters of the policy network in scenario B, the parameters of the first two layers are frozen, the parameters of the last three layers are fine-tuned, and iterates 500 times. The specific training process of the DAML algorithm is not the focus of this application, so it will not be expanded here.

[0198] In this way, by constructing a Markov decision process, scanning efficiency, concealment, tunnel performance and security risks can be dynamically weighed.

[0199] The embodiment of the present application analyzes the first data feature transmitted by the first forward proxy tunnel to obtain the first tunnel state vector, and can monitor the data transmitted by the first forward proxy tunnel in real time, so as to facilitate the subsequent judgment of the tunnel situation; based on the first tunnel state vector, it is judged whether a tunnel failure occurs, and the second forward proxy tunnel is rebuilt to solve the tunnel failure, so as to realize intelligent tunnel fault monitoring and fault handling; in the process of rebuilding the tunnel, network performance and data transmission will be affected. By analyzing the second data feature in the second forward proxy tunnel to obtain the second tunnel state vector, the state of the rebuilt second forward proxy tunnel can be evaluated to judge the state in the second forward proxy tunnel, whether there is an abnormal state and attack behavior, etc., and different execution strategies are matched according to different evaluation results to improve the stability and reliability of the tunnel.

[0200] An embodiment of the present application also provides a computer-readable storage medium, which stores processor-executable instructions. When the processor-executable instructions are executed by the processor, they are used to implement the above-mentioned forward proxy tunnel monitoring method.

[0201] The contents of the above-mentioned forward proxy tunnel monitoring method embodiment are all applicable to the present storage medium embodiment. The functions specifically implemented by the present storage medium embodiment are the same as those of the above-mentioned forward proxy tunnel monitoring method embodiment, and the beneficial effects achieved are also the same as those achieved by the above-mentioned forward proxy tunnel monitoring method embodiment. Therefore, this embodiment can also monitor the status of the tunnel in real time and improve the stability and reliability of the tunnel.

[0202] The above is a preferred embodiment of the present invention. It should be pointed out that a person skilled in the art can make several improvements and modifications without departing from the principle of the present invention. These improvements and modifications are also considered to be within the scope of protection of the present invention.

[0203] Those skilled in the art can understand that all or part of the processes in the above embodiments can be implemented by instructing related hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes in the above embodiments. The storage medium can be a disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc.

Claims

1. A forward proxy tunnel monitoring method, characterized in that: include: Analyze the first data characteristics transmitted by the first forward proxy tunnel to obtain a first tunnel state vector; determining whether a tunnel failure occurs based on the first tunnel state vector, and if a tunnel failure occurs, reestablishing a connection of a second forward proxy tunnel; The second data feature in the second forward proxy tunnel is analyzed to obtain a second tunnel state vector, the second tunnel state vector is evaluated to obtain an evaluation result, and a corresponding execution strategy is matched based on the evaluation result.

2. The forward proxy tunnel monitoring method according to claim 1, characterized in that: Before analyzing the first data feature transmitted by the first forward proxy tunnel, the method further includes: Analyze the properties of the target system through the decision tree algorithm to obtain the optimal property set; Generating a plurality of first scanning strategy combinations by permuting and combining the optimal attribute sets; Performing random processing on a plurality of the first scanning strategy combinations to obtain a plurality of scanning schemes; Using Monte Carlo simulation to evaluate each of the scanning schemes, if the score of each of the scanning schemes is lower than a first preset threshold, optimizing each of the scanning schemes by a genetic algorithm to generate a plurality of second scanning strategy combinations; An optimal scanning solution is determined from a plurality of combinations of the second scanning strategies.

3. The forward proxy tunnel monitoring method according to claim 1, characterized in that: The first data feature transmitted through the first forward proxy tunnel is analyzed to obtain a first tunnel state vector, specifically: Capturing a data packet transmitted by the first forward proxy tunnel, and extracting a first data feature in the data packet; The first data feature is analyzed using a support vector machine to obtain a first tunnel state vector.

4. The forward proxy tunnel monitoring method according to claim 1, characterized in that: The determining whether a tunnel failure occurs based on the first tunnel state vector, and if a tunnel failure occurs, re-establishing a connection of the second forward proxy tunnel, specifically comprises: Normalizing the first tunnel state vector to obtain a third tunnel state vector; Calculating the Mahalanobis distance between the third tunnel vectors; If the Mahalanobis distance between the third tunnel vectors is greater than a second preset threshold, it is determined that a tunnel failure occurs, and the connection of the second forward proxy tunnel is reestablished.

5. The forward proxy tunnel monitoring method according to claim 1, characterized in that: The evaluating the second tunnel state vector to obtain an evaluation result, and matching a corresponding execution strategy based on the evaluation result, specifically: Evaluate the second tunnel state vector by using a preset tunnel state evaluation model to form a tunnel state evaluation result; Based on the tunnel status evaluation result, a weighted round-robin scheduling algorithm is used to dynamically calculate and adjust the weight coefficient of the second forward proxy tunnel; Dynamically adjust the forwarding path and traffic ratio of the second forward proxy tunnel using software defined network technology; The weight coefficient, the forwarding path and the flow ratio are optimized using a preset simulated annealing algorithm.

6. The forward proxy tunnel monitoring method according to claim 1, characterized in that: The evaluating the second tunnel state vector to obtain an evaluation result, and matching a corresponding execution strategy based on the evaluation result, specifically: Calculating an anomaly score of the second tunnel state vector by an isolation forest algorithm; If the abnormality score is greater than the third preset threshold, it is determined that the second forward proxy tunnel has an attack behavior, and the connection of the third forward proxy tunnel is re-established.

7. The forward proxy tunnel monitoring method according to claim 1, characterized in that: The evaluating the second tunnel state vector to obtain an evaluation result, and matching a corresponding execution strategy based on the evaluation result, specifically: Inputting the second tunnel state vector into a preset graph attention network model; Calculating the risk probability of the second forward proxy tunnel by using the graph attention network model; If the risk probability is greater than a fourth preset threshold, the routing forwarding strategy of the second forward proxy tunnel is dynamically adjusted or the transport layer protocol is optimized.

8. The forward proxy tunnel monitoring method according to claim 1, characterized in that: The evaluating the second tunnel state vector to obtain an evaluation result, and matching a corresponding execution strategy based on the evaluation result, specifically: Classifying the second tunnel state vector to obtain a corresponding health level; A third scanning strategy corresponding to the second forward proxy tunnel matching at different health levels; The third scanning strategy is optimized using a multi-objective particle swarm optimization algorithm to obtain an optimal scanning parameter combination.

9. The forward proxy tunnel monitoring method according to claim 1, characterized in that: After matching the corresponding execution strategy based on the evaluation result, the method further includes: Scanning strategy selection, tunnel status detection and security threat detection are mapped to Markov decision processes respectively; The Markov decision process is solved by a deep deterministic policy gradient algorithm to obtain the optimal state-action mapping strategy; The hyperparameters of the deep deterministic policy gradient algorithm are adjusted to output intelligent decisions integrating scanning strategy selection, tunnel status detection, and security threat detection.

10. A forward proxy tunnel monitoring system, characterized in that: include: analysis module, reconstruction module and evaluation module; The analysis module is used to analyze the first data characteristics transmitted by the first forward proxy tunnel to obtain a first tunnel state vector; The reconstruction module is used to determine whether a tunnel failure occurs based on the first tunnel state vector, and if a tunnel failure occurs, reestablish the connection of the second forward proxy tunnel; The evaluation module is used to analyze the second data feature in the second forward proxy tunnel to obtain a second tunnel state vector, evaluate the second tunnel state vector to obtain an evaluation result, and match a corresponding execution strategy based on the evaluation result.

11. The forward proxy tunnel monitoring system according to claim 10, characterized in that: Also includes: A scanning module, the scanning module comprising: a first analyzing unit, a combining unit, a first processing unit, a second processing unit and a selecting unit; The first analysis unit is used to analyze the attributes of the target system by using a decision tree algorithm to obtain an optimal attribute set; The combining unit is used to generate a plurality of first scanning strategy combinations by arranging and combining the optimal attribute sets; The first processing unit is used to perform random processing on a plurality of the first scanning strategy combinations to obtain a plurality of scanning schemes; The second processing unit is used to evaluate each of the scanning schemes by Monte Carlo simulation, and if the score of each of the scanning schemes is lower than a first preset threshold, optimize each of the scanning schemes by a genetic algorithm to generate a plurality of second scanning strategy combinations; The selection unit is used to select an optimal scanning solution from a plurality of second scanning strategy combinations based on the situation of the target system.

12. The forward proxy tunnel monitoring system according to claim 10, characterized in that: The analysis module includes: a capture unit and a second analysis unit; The capture unit is used to capture a data packet transmitted by the first forward proxy tunnel and extract a first data feature in the data packet; The second analysis unit is used to analyze the first data feature by using a support vector machine to obtain a first tunnel state vector.

13. The forward proxy tunnel monitoring system according to claim 10, characterized in that: The reconstruction module comprises: a third processing unit, a fourth processing unit and a reconstruction unit; The third processing unit is used to normalize the first tunnel state vector to obtain a third tunnel state vector; The fourth processing unit is used to calculate the Mahalanobis distance between the third tunnel vectors; The reconstruction unit is configured to determine that a tunnel failure occurs if the Mahalanobis distance between the third tunnel vectors is greater than a second preset threshold, and to re-establish the connection of the second forward proxy tunnel.

14. The forward proxy tunnel monitoring system according to claim 10, characterized in that: The evaluation module includes: a first evaluation unit, a first adjustment unit, a second adjustment unit and a third adjustment unit: The first evaluation unit is used to evaluate the second tunnel state vector by using a preset tunnel state evaluation model to form a tunnel state evaluation result; The first adjustment unit is used to dynamically calculate and adjust the weight coefficient of the second forward proxy tunnel by using a weighted round-robin scheduling algorithm based on the tunnel state evaluation result; The second adjustment unit is used to dynamically adjust the forwarding path and traffic ratio of the second forward proxy tunnel by using software defined network technology; The third adjustment unit is used to optimize the weight coefficient, the forwarding path and the traffic ratio by using a preset simulated annealing algorithm.

15. The forward proxy tunnel monitoring system according to claim 10, characterized in that: The evaluation module further includes: a second evaluation unit and a fourth adjustment unit: The second evaluation unit is used to calculate the anomaly score of the second tunnel state vector by using an isolation forest algorithm; The fourth adjustment unit is configured to determine that an attack behavior exists in the second forward proxy tunnel if the anomaly score is greater than a third preset threshold, and to re-establish a connection of the third forward proxy tunnel.

16. The forward proxy tunnel monitoring system according to claim 10, characterized in that: The evaluation module further includes: an input unit, a third evaluation unit and a fifth adjustment unit: The input unit is used to input the second tunnel state vector into a preset graph attention network model; The third evaluation unit is used to calculate the risk probability of the second forward proxy tunnel through the graph attention network model; The fifth adjustment unit is used to dynamically adjust the routing forwarding strategy of the second forward proxy tunnel or optimize the transport layer protocol if the risk probability is greater than a fourth preset threshold.

17. The forward proxy tunnel monitoring system according to claim 10, characterized in that: The evaluation module also includes: a classification unit, a matching unit and an optimization unit: The classification unit is used to classify the second tunnel state vector to obtain a corresponding health level; The matching unit is used to match the corresponding third scanning strategy for the second forward proxy tunnels with different health levels; The optimization unit is used to optimize the third scanning strategy using a multi-objective particle swarm optimization algorithm to obtain an optimal scanning parameter combination.

18. The forward proxy tunnel monitoring system according to claim 10, characterized in that: Also includes: A decision module, the decision module comprising: a mapping unit, a calculation unit and a decision unit; The mapping unit is used to map scanning strategy selection, tunnel status detection and security threat detection to Markov decision processes respectively; The computing unit is used to solve the Markov decision process by using a deep deterministic policy gradient algorithm to obtain an optimal state-action mapping strategy; The decision-making unit is used to adjust the hyperparameters of the deep deterministic policy gradient algorithm and output an intelligent decision integrating scanning strategy selection, tunnel status detection and security threat detection.

19. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored computer program, wherein when the computer program is executed, the device where the computer-readable storage medium is located is controlled to execute the forward proxy tunnel monitoring method according to any one of claims 1 to 9.

Images