Internet data encryption method and system

Abstract

The invention relates to the technical field of data encryption, in particular to an Internet data encryption method and system. The method comprises the following steps: acquiring Internet participation node data; carrying out distributed account book storage on the Internet participation node data to generate Internet participation node basic storage data; a random number generator is used for carrying out random number generation on Internet participating node data, and multi-party security calculation is carried out, so that an Internet node random number key is generated; the internet node random number secret keys are distributed through a secure channel, and random secret key receiver data are generated; therefore, through the innovative combination of the distributed account book, the random key generation and distribution and the abnormal behavior analysis, the problems of insufficient security, inflexible strategy and vulnerability to data attack in the traditional encryption method are solved, and the security, dynamics and reliability of Internet data encryption are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of data encryption, and in particular to an Internet data encryption method and system. Background Art

[0002] Traditional encryption methods (such as symmetric encryption and asymmetric encryption) rely on fixed encryption algorithms and key management strategies during data transmission, which leads to security vulnerabilities in key exchange, update and storage. The key management mechanism of traditional encryption methods generally relies on a centralized key distribution center or a trusted third party, which is particularly vulnerable to attack in a distributed network environment. The centralized storage and distribution of keys are easily targeted by malicious attackers, resulting in key leakage or abuse, which in turn endangers the security of the entire system. In addition, the existing system has weak dynamic adjustment and fine-grained management capabilities for encryption policies, especially in the face of changing network traffic and potential security threats. It is impossible to flexibly adjust encryption policies or implement real-time security monitoring and response. This static encryption strategy cannot adapt to emerging attack patterns in a timely manner. Most existing encryption methods focus on data confidentiality protection, but do not consider data integrity and potential tampering risk protection during transmission. Although some encryption protocols use integrity checks (such as hash value verification), these methods cannot effectively prevent data from encountering complex attacks during transmission. Existing technologies generally lack monitoring and response mechanisms for dynamic traffic and abnormal behavior. Traditional encryption methods assume that the network environment is stable and secure when encrypting and transmitting data, but in actual applications, Internet traffic often experiences abnormal fluctuations or potential security threats. Summary of the invention

[0003] Based on this, it is necessary to provide an Internet data encryption method and system to solve at least one of the above technical problems.

[0004] To achieve the above object, an Internet data encryption method is provided, the method comprising the following steps: Step S1: Obtain Internet participating node data; store the Internet participating node data in a distributed ledger to generate basic storage data of the Internet participating nodes; Step S2: Generate random numbers for Internet participating node data using a random number generator, and perform multi-party secure computing to generate Internet node random number keys; distribute the Internet node random number keys through a secure channel to generate random key recipient data; Step S3: Obtain historical network traffic data; perform abnormal traffic detection based on the historical network traffic data, and construct an abnormal behavior analysis model to generate an Internet abnormal behavior analysis model; Step S4: Based on the Internet abnormal behavior analysis model, abnormal traffic behavior analysis is performed on the Internet participating node data to generate abnormal traffic behavior data; behavior encryption information strategy is generated based on the abnormal traffic behavior data and random key recipient data to generate an Internet data encryption strategy; an Internet encryption strategy report is generated for the Internet data encryption strategy, thereby completing the Internet encryption method operation.

[0005] The beneficial effect of the present invention is that the data of Internet participating nodes is stored through distributed ledger technology, which significantly improves the integrity and non-tamperability of the data and ensures the reliability of the basic storage data of the participating nodes; at the same time, the node random key is generated by using a random number generator and multi-party secure computing, and distributed through a secure channel, so that the key generation and transmission process has higher security, effectively avoiding the risk of single point leakage and tampering. On the basis of historical network traffic data, this method combines anomaly detection algorithm and behavior analysis technology to construct an efficient Internet abnormal behavior analysis model, and realizes accurate identification of traffic abnormal behavior by extracting abnormal features, providing a reliable basis for subsequent strategy generation. In addition, by jointly processing abnormal traffic behavior data and random key receiver data, a behavior encryption information strategy is generated and an Internet data encryption strategy is formulated, thereby realizing targeted and dynamic encryption configuration in the process of data encryption, greatly improving the security and adaptability of Internet data. Finally, the generation of the Internet encryption policy report integrates the data processing results of the whole process, provides structured support for the verification and improvement of security policies, and reduces the complexity and error of manual intervention. The whole process builds an efficient closed loop in the data collection, processing, encryption and verification links, ensuring the security and availability of data in transmission and storage. Therefore, the present invention solves the problems of insufficient security, inflexible strategies and data vulnerability in traditional encryption methods through the innovative combination of distributed ledgers, random key generation and distribution, and abnormal behavior analysis, and improves the security, dynamism and reliability of Internet data encryption.

[0006] Preferably, step S1 comprises the following steps: Step S11: Obtain Internet participating node data; Step S12: Generate a unique identifier for the Internet participating node data to generate an Internet participating node UID; Step S13: Use the distributed ledger to store the Internet participating node UID and Internet participating node data to generate basic storage data of the Internet participating node.

[0007] The present invention achieves accurate identification and distinction of Internet participating nodes by acquiring Internet participating node data and generating a unique identifier (UID) based on the data. At the data level, the introduction of UID provides an efficient identification mechanism for the management and tracking of participating node data, effectively avoiding node identification errors caused by data redundancy or conflict. At the same time, the distributed ledger technology is used to store the Internet participating node UID and the corresponding data, ensuring the integrity, traceability and non-tamperability of the data, thereby greatly improving the security and credibility of the system. The distributed ledger storage method stores data in multiple nodes in a decentralized manner, avoids single point failure problems in a decentralized manner, and enhances the system's fault tolerance and data availability. In addition, through the combination of distributed ledgers and UIDs, the data of Internet participating nodes and their identifiers can correspond one by one, simplifying the data retrieval and update process, and providing reliable basic data support for subsequent encryption processing, behavior analysis and strategy generation. The entire process provides an efficient and reliable technical framework for the management and security of Internet participating nodes through innovative data identification and storage methods.

[0008] Preferably, step S2 comprises the following steps: Step S21: using a random number generator to generate random numbers for Internet participating node data, and performing multi-party secure computing to generate an Internet node random number key; Step S22: Timestamp the Internet node random number key to generate random key timestamp limiting data; Step S23: Establish a secure channel through the ECDH protocol, distribute the Internet node random number key and random key timestamp limiting data, and generate random key recipient data.

[0009] The present invention generates random numbers for Internet participating node data by using a random number generator, and combines multi-party secure computing technology to ensure the security and unpredictability of the random number key generation process, and effectively reduces the risk of attack during the key generation process from the data level. At the same time, the generated random number key is timestamped, which further enhances the timeliness and dynamics of the key, so that the key has clear validity during the life cycle. This mechanism not only improves the efficiency of key management, but also effectively reduces the long-term risk of key leakage. In addition, through a secure channel established based on the ECDH protocol, the random number key and the timestamp-limited data are distributed to ensure the security of key transmission and avoid eavesdropping or tampering during the distribution process. Combined with the characteristics of random key timestamp-limited data, the distribution process can realize accurate reception and dynamic verification of the key, ensuring the reliability and real-time performance of the key recipient data. The overall process provides a highly secure and intelligent technical framework for data encryption and key management of Internet participating nodes through the organic combination of random number generation, multi-party secure computing, timestamp limitation and secure channel transmission.

[0010] Preferably, step S21 includes the following steps: Step S211: collecting the noise sources of the mechanical energy nodes of the Internet participating node data to generate Internet node noise source data; performing time jitter processing on the Internet node noise source data to generate Internet node time jitter data; Step S212: Adding hardware random noise according to the Internet node time jitter data to generate Internet node time-hardware noise data; Step S213: Perform distributed entropy pool synthesis processing on the Internet node time-hardware noise data to generate Internet node distributed entropy pool data; generate random numbers for the Internet node distributed entropy pool data, and perform multi-party secure computing to generate Internet node random number keys.

[0011] The present invention collects the mechanical energy node noise source in the Internet participating node data to generate the Internet node noise source data, thereby providing a reliable hardware foundation for random number generation. At the data level, the introduction of the mechanical energy noise source increases the randomness and unpredictability of the data, and effectively reduces the impact of external interference on random number generation. By performing time jitter processing on the noise source data, the uncertainty of the data is further enhanced, thereby improving the entropy level and security of the random number generation process. Subsequently, the time jitter data is combined with the hardware random noise to generate time-hardware noise data, making the randomness source more diverse and difficult to copy. The time-hardware noise data is processed by the distributed entropy pool synthesis technology, and the distributed entropy pool data is constructed through multi-node collaboration. This method ensures the distributed security and redundancy of the entropy source, and effectively avoids the problem of single-point entropy pool failure or being broken. Finally, random number generation is performed based on the distributed entropy pool data and combined with multi-party secure computing to generate Internet node random number keys, thereby realizing high-intensity and high-security key generation at the data level. The method shows significant advantages in randomness, unpredictability and distributed security assurance, and provides solid technical support for data security and communication confidentiality of Internet nodes.

[0012] Preferably, step S3 comprises the following steps: Step S31: Obtain historical network traffic data; Step S32: performing abnormal traffic detection based on historical network traffic data to generate historical traffic abnormal behavior data; Step S33: construct an abnormal behavior analysis model for the historical traffic abnormal behavior data to generate an Internet abnormal behavior analysis model.

[0013] The present invention provides a comprehensive and high-quality raw data basis for the identification and analysis of abnormal behavior by acquiring historical network traffic data. From the data level, the collection and integration of historical network traffic data can fully reflect the dynamic change characteristics of traffic during the operation of the Internet, including normal traffic patterns and potential abnormal traffic characteristics. On this basis, the historical network traffic data is deeply processed by abnormal traffic detection technology to generate historical traffic abnormal behavior data, thereby realizing the accurate capture and classification of traffic anomalies, and providing high-confidence data support for subsequent behavior analysis. Further, the abnormal behavior analysis model is constructed using the historical traffic abnormal behavior data to form an Internet abnormal behavior analysis model, which can generate a behavior analysis mechanism for different abnormal types by extracting the key features of abnormal behavior, effectively improving the identification, prediction and early warning capabilities of abnormal traffic. This method not only enhances the depth of mining historical data in the process of data processing, but also provides strong technical support for real-time monitoring and analysis of future traffic anomalies, significantly improving the security and robustness of the network system.

[0014] Preferably, step S33 includes the following steps: Step S331: Perform fluctuation analysis on the historical traffic abnormal behavior data to generate historical traffic abnormal fluctuation data; draw a two-dimensional traffic fluctuation graph on the historical traffic abnormal fluctuation data to generate a historical traffic abnormal fluctuation graph; perform abnormal peak detection based on the historical traffic abnormal fluctuation graph to generate historical traffic fluctuation peak data; perform timestamp tracing on the historical traffic fluctuation peak data to generate historical traffic abnormal behavior timestamp data; Step S332: construct the first layer of the model based on the historical traffic fluctuation abnormal data, and perform abnormal traffic matrix analysis to generate the Internet abnormal behavior-traffic abnormal layer; construct the second layer of the model based on the historical traffic fluctuation peak data, and perform point cloud computing processing to generate the Internet abnormal behavior-fluctuation peak layer; construct the third layer of the model based on the historical traffic abnormal behavior timestamp data, and perform timestamp comparison to generate the Internet abnormal behavior-timestamp layer; Step S333: construct an abnormal behavior analysis model for the Internet abnormal behavior-traffic abnormality layer, the Internet abnormal behavior-fluctuation peak layer and the Internet abnormal behavior-timestamp layer to generate an Internet abnormal behavior analysis model.

[0015] The present invention effectively captures the fluctuation characteristics of network traffic from the data level by performing fluctuation analysis on historical traffic abnormal behavior data, and provides a more detailed perspective for the identification of abnormal behavior. The historical traffic fluctuation abnormal data generated by the fluctuation analysis and the two-dimensional traffic fluctuation graph drawn subsequently provide an intuitive data expression form for the identification of abnormal behavior, which helps to detect subtle fluctuation changes missed by traditional methods. The abnormal peak detection based on the historical traffic fluctuation abnormal data further enhances the ability to capture significant abnormal events in network traffic. The generated historical traffic fluctuation peak data can help identify sudden changes in traffic, thereby providing efficient data support for more in-depth abnormal behavior analysis. The processing of timestamp tracing enables the occurrence time of abnormal behavior to be accurately marked, so that the specific moment of traffic abnormality can be traced back in subsequent analysis, enhancing the time sensitivity and real-time nature of the analysis process. Furthermore, by constructing models at different levels and performing different types of analysis and processing on historical traffic fluctuation abnormal data, historical traffic fluctuation peak data and historical traffic abnormal behavior timestamp data, the abnormal behavior of network traffic can be deeply mined in multiple dimensions. The model's first-layer abnormal traffic matrix analysis, second-layer point cloud computing processing, and third-layer timestamp comparison enable the model to comprehensively evaluate abnormal behaviors from multiple angles, thereby improving the accuracy and comprehensiveness of abnormal behavior identification. Ultimately, the three-layer model fusion forms an all-round, multi-level Internet abnormal behavior analysis model that can accurately identify and predict abnormal behaviors in network traffic and provide strong support for subsequent security protection and traffic management.

[0016] Preferably, step S4 comprises the following steps: Step S41: performing abnormal traffic behavior analysis on Internet participating node data based on an Internet abnormal behavior analysis model to generate traffic abnormal behavior data; Step S42: Generate a behavior encryption information strategy based on the traffic abnormal behavior data and the random key recipient data to generate an Internet data encryption strategy; Step S43: Encrypt and transmit the random key recipient data based on the Internet data encryption strategy to generate Internet information recipient transmission data; generate an Internet encryption policy report based on the Internet information recipient transmission data, thereby completing the Internet encryption method operation.

[0017] The present invention can effectively identify the potential risks and irregular traffic behaviors in the network by analyzing the abnormal traffic behavior of the Internet participating node data, and accurately capture the abnormal fluctuations and potential attack behaviors in the network traffic from the data level. First, based on the Internet abnormal behavior analysis model, the traffic abnormal behavior analysis can quickly identify the difference between the normal traffic pattern and the abnormal traffic pattern, thereby providing efficient and accurate data support for the subsequent encryption strategy generation. The generated traffic abnormal behavior data provides a key basis for the formulation of the behavior encryption information strategy. By analyzing the characteristics of the abnormal traffic behavior, a data encryption strategy with strong pertinence and high adaptability is formulated to improve the security and privacy protection level in the network transmission process. By combining the traffic abnormal behavior data with the random key receiver data to generate the encryption information strategy, the security of the information transmission process in the network can be guaranteed, and the risk of key leakage or tampering can be prevented. Next, the random key receiver data is encrypted and transmitted based on the Internet data encryption strategy to ensure the confidentiality, integrity and availability of the data during the transmission process. At the same time, the encryption strategy report generated by the Internet information receiver transmission data further provides detailed strategy guidance for network security protection. Through this series of sophisticated data processing and security measures, we were able to effectively encrypt Internet information, improving the security of data transmission and system protection capabilities.

[0018] Preferably, step S42 includes the following steps: Step S421: using a preset abnormal behavior threshold to judge the traffic abnormal behavior data, generating traffic abnormal behavior result data, wherein the traffic abnormal behavior result data includes high abnormal behavior result data and low abnormal behavior result data; based on the traffic abnormal behavior result data, a behavior encryption information strategy is generated to generate an Internet data encryption strategy, wherein the Internet data encryption strategy includes an Internet high abnormality processing strategy and an Internet low abnormality processing strategy; Step S422: When the traffic abnormal behavior result data is high abnormal behavior result data, the Internet high abnormality processing strategy is applied to perform data sharding on the Internet node random number key, generate multi-shard random number keys, and perform one-time key generation to generate a dynamic key enhanced data set; random noise is added to the traffic abnormal behavior data using packet encryption to generate obfuscated traffic data; the dynamic key enhanced data set and the obfuscated traffic data are sent through two-way identity authentication, thereby completing the Internet high abnormality processing strategy; Step S423: When the traffic abnormal behavior result data is low abnormal behavior result data, the Internet low abnormality processing strategy is applied to lightweight encrypt the Internet node random number key to generate a lightweight key data set; the lightweight key data set is sent to complete the Internet low abnormality processing strategy.

[0019] The present invention uses a preset abnormal behavior threshold to judge the traffic abnormal behavior data, generates high abnormality and low abnormal behavior result data, and provides an accurate basis for subsequent strategy formulation. The classification of high abnormal behavior result data and low abnormal behavior result data enables the encryption strategy to be differentiated according to the severity of abnormal traffic, thereby improving processing efficiency and security. The Internet data encryption strategy generated based on the traffic abnormal behavior result data clarifies the processing measures under high abnormality and low abnormality conditions, so that network traffic can be properly encrypted and protected under different types of abnormal events. Specifically, when the traffic abnormal behavior result data is highly abnormal, the Internet high abnormality processing strategy is applied to perform data sharding on the Internet node random number key, and generate multi-shard random number keys and one-time keys, thereby creating a dynamic key reinforcement data set. This process effectively avoids the risk of key leakage in the traditional key generation method, and adds random noise to the traffic abnormal behavior data through packet encryption to generate obfuscated traffic data, further improving the concealment and security of the data. The dynamic key reinforcement data set and obfuscated traffic data sent through two-way identity authentication ensure the integrity and confidentiality of the data during transmission. In the processing of low-abnormal behavior result data, the Internet low-abnormal processing strategy is adopted, and lightweight encryption technology is used to generate lightweight key data sets, which reduces the encryption load, improves processing speed and system efficiency, and ensures secure transmission under low-risk conditions. This differentiated processing strategy enables the system to flexibly respond to abnormal behaviors at different levels and improves the pertinence and intelligence of encryption.

[0020] Preferably, step S43 includes the following steps: Step S431: encrypting and transmitting the random key receiver data based on the Internet data encryption strategy to generate Internet information receiver transmission data; Step S432: Compare the Internet information receiver's transmission data with the Internet participating node's basic storage data to generate transmission channel integrity comparison data; Step S433: Generate an Internet encryption policy report based on the transmission channel integrity comparison data, thereby completing the Internet encryption method operation.

[0021] The present invention encrypts and transmits the random key receiver data based on the Internet data encryption strategy, thereby ensuring that the information transmission process in the network has a high degree of confidentiality and anti-tampering ability. The process of encrypted transmission not only ensures the privacy protection of data during transmission, but also effectively prevents potential external attacks and data leakage, thereby enhancing the security of the information system. In step S432, the method compares the Internet information receiver transmission data with the basic storage data of the Internet participating node, thereby generating transmission channel integrity comparison data. The key to this step is that by comparing the integrity of the data, any inconsistency or abnormality that occurs during the data transmission process can be discovered in time to ensure that the integrity of the transmission channel is not damaged. This measure effectively prevents potential security threats such as man-in-the-middle attacks or data loss, and provides additional protection for the security of data transmission. Finally, in step S433, an Internet encryption strategy report is generated based on the transmission channel integrity comparison data to further summarize and feedback the security status of data transmission. The report not only records the execution of the encryption strategy in detail, but also provides data support for future data transmission optimization. Through this series of steps, the system can provide comprehensive security protection in encryption, verification and report generation, ensuring the confidentiality, integrity and availability of data during transmission, thereby improving the security protection capabilities of the overall network system.

[0022] In this specification, an Internet data encryption system is provided, which is used to execute the above Internet data encryption method, and the Internet data encryption system includes: The node data management module is used to obtain the Internet participating node data; store the Internet participating node data in a distributed ledger and generate basic storage data of the Internet participating nodes; The random key generation and distribution module is used to generate random numbers for Internet participating node data using a random number generator and perform multi-party secure computing to generate Internet node random number keys; distribute Internet node random number keys through a secure channel to generate random key recipient data; The abnormal behavior modeling module is used to obtain historical network traffic data; perform abnormal traffic detection based on historical network traffic data, and build an abnormal behavior analysis model to generate an Internet abnormal behavior analysis model; The traffic anomaly analysis and encryption strategy module is used to analyze the abnormal traffic behavior of Internet participating node data based on the Internet abnormal behavior analysis model to generate traffic abnormal behavior data; generate behavior encryption information strategy based on traffic abnormal behavior data and random key recipient data to generate Internet data encryption strategy; generate Internet encryption strategy report for Internet data encryption strategy, thereby completing Internet encryption method operations.

[0023] The beneficial effect of the present invention is that the data of Internet participating nodes is stored through distributed ledger technology, which significantly improves the integrity and non-tamperability of the data and ensures the reliability of the basic storage data of the participating nodes; at the same time, the node random key is generated by using a random number generator and multi-party secure computing, and distributed through a secure channel, so that the key generation and transmission process has higher security, effectively avoiding the risk of single point leakage and tampering. On the basis of historical network traffic data, this method combines anomaly detection algorithm and behavior analysis technology to construct an efficient Internet abnormal behavior analysis model, and realizes accurate identification of traffic abnormal behavior by extracting abnormal features, providing a reliable basis for subsequent strategy generation. In addition, by jointly processing abnormal traffic behavior data and random key receiver data, a behavior encryption information strategy is generated and an Internet data encryption strategy is formulated, thereby realizing targeted and dynamic encryption configuration in the process of data encryption, greatly improving the security and adaptability of Internet data. Finally, the generation of the Internet encryption policy report integrates the data processing results of the whole process, provides structured support for the verification and improvement of security policies, and reduces the complexity and error of manual intervention. The whole process builds an efficient closed loop in the data collection, processing, encryption and verification links, ensuring the security and availability of data in transmission and storage. Therefore, the present invention solves the problems of insufficient security, inflexible strategies and data vulnerability in traditional encryption methods through the innovative combination of distributed ledgers, random key generation and distribution, and abnormal behavior analysis, and improves the security, dynamism and reliability of Internet data encryption. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 A schematic diagram of a process flow of an Internet data encryption method; Figure 2 for Figure 1 Detailed implementation steps of step S2 in the flowchart; Figure 3 for Figure 1 Detailed implementation steps of step S3 in FIG. Figure 4 for Figure 1 Detailed implementation steps of step S4 in FIG. The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0025] The following is a clear and complete description of the technical method of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by technicians in this field without creative work are within the scope of protection of the present invention.

[0026] In addition, the accompanying drawings are only schematic illustrations of the present invention and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. The functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor methods and / or microcontroller methods.

[0027] It should be understood that, although the terms "first", "second", etc. may be used herein to describe various units, these units should not be limited by these terms. These terms are used only to distinguish one unit from another unit. For example, without departing from the scope of the exemplary embodiments, the first unit may be referred to as the second unit, and similarly the second unit may be referred to as the first unit. The term "and / or" used herein includes any and all combinations of one or more of the listed associated items.

[0028] To achieve this, please refer to Figures 1 to 4 , an Internet data encryption method, the method comprising the following steps: Step S1: Obtain Internet participating node data; store the Internet participating node data in a distributed ledger to generate basic storage data of the Internet participating nodes; Step S2: Generate random numbers for Internet participating node data using a random number generator, and perform multi-party secure computing to generate Internet node random number keys; distribute the Internet node random number keys through a secure channel to generate random key recipient data; Step S3: Obtain historical network traffic data; perform abnormal traffic detection based on the historical network traffic data, and construct an abnormal behavior analysis model to generate an Internet abnormal behavior analysis model; Step S4: Based on the Internet abnormal behavior analysis model, abnormal traffic behavior analysis is performed on the Internet participating node data to generate abnormal traffic behavior data; behavior encryption information strategy is generated based on the abnormal traffic behavior data and random key recipient data to generate an Internet data encryption strategy; an Internet encryption strategy report is generated for the Internet data encryption strategy, thereby completing the Internet encryption method operation.

[0029] The beneficial effect of the present invention is that the data of Internet participating nodes is stored through distributed ledger technology, which significantly improves the integrity and non-tamperability of the data and ensures the reliability of the basic storage data of the participating nodes; at the same time, the node random key is generated by using a random number generator and multi-party secure computing, and distributed through a secure channel, so that the key generation and transmission process has higher security, effectively avoiding the risk of single point leakage and tampering. On the basis of historical network traffic data, this method combines anomaly detection algorithm and behavior analysis technology to construct an efficient Internet abnormal behavior analysis model, and realizes accurate identification of traffic abnormal behavior by extracting abnormal features, providing a reliable basis for subsequent strategy generation. In addition, by jointly processing abnormal traffic behavior data and random key receiver data, a behavior encryption information strategy is generated and an Internet data encryption strategy is formulated, thereby realizing targeted and dynamic encryption configuration in the process of data encryption, greatly improving the security and adaptability of Internet data. Finally, the generation of the Internet encryption policy report integrates the data processing results of the whole process, provides structured support for the verification and improvement of security policies, and reduces the complexity and error of manual intervention. The whole process builds an efficient closed loop in the data collection, processing, encryption and verification links, ensuring the security and availability of data in transmission and storage. Therefore, the present invention solves the problems of insufficient security, inflexible strategies and data vulnerability in traditional encryption methods through the innovative combination of distributed ledgers, random key generation and distribution, and abnormal behavior analysis, and improves the security, dynamism and reliability of Internet data encryption.

[0030] In the embodiment of the present invention, reference Figure 1 FIG. 1 is a schematic diagram of a step flow chart of an Internet data encryption method of the present invention. In this example, the Internet data encryption method includes the following steps: Step S1: Obtain Internet participating node data; store the Internet participating node data in a distributed ledger to generate basic storage data of the Internet participating nodes; In the embodiment of the present invention, the process of obtaining the data of the Internet participating nodes and storing them in a distributed ledger adopts modern blockchain technology, aiming to ensure the decentralized storage, immutability and high availability of the data. From the data level, first, the data of the Internet participating nodes is collected and preliminarily sorted to ensure the validity and accuracy of the data. The data contains key information such as communication information, operation records and status of each node. By converting these data into a standardized data format, the compatibility and consistency of subsequent processing can be ensured. Then, the distributed ledger technology is used to store these node data. The distributed ledger is a decentralized database structure. The data is not stored in a single location, but distributedly stored through multiple nodes. Each node saves a copy of the data, which can enhance the fault tolerance and anti-attack of the data. In addition, the distributed ledger technology also uses a consensus algorithm to ensure data consistency. Even if there is a network delay or node failure between different nodes, the system can still maintain the consistency and integrity of the data. To further improve security and prevent tampering, all data will be encrypted and form a chain structure in the ledger. Each record (or "block") is linked to the previous block through a hash algorithm to form an irreversible chain.

[0031] Step S2: Generate random numbers for Internet participating node data using a random number generator, and perform multi-party secure computing to generate Internet node random number keys; distribute the Internet node random number keys through a secure channel to generate random key recipient data; In the embodiment of the present invention, a random number generator is used to generate random numbers for Internet participating node data, and the generated random numbers are used as random number keys of Internet nodes to ensure the unpredictability and security of the keys. Specifically, the random number generator (RNG) adopts an algorithm-based random number generation method, such as a physical phenomenon (such as a hardware noise source) or a pseudo-random algorithm (such as an algorithm based on a pseudo-random number generator). In order to further enhance the security of generating random numbers, a high-quality entropy source is used to ensure that the generated random numbers are statistically uniform and unpredictable, so as to avoid being predicted by attackers through vulnerability analysis. The key generation process. Next, multi-party secure computing (MPC) is performed, which is a secure computing protocol that jointly calculates through multiple participants without exposing the input of each party. The purpose of multi-party secure computing is to generate a shared security key without leaking the private data of each participant. In this protocol, data is not stored or calculated centrally, but encrypted through distributed computing to ensure that the data privacy of each node is protected. Through this process, multiple Internet nodes collaborate to generate a common key, which is unknown to any single party, increasing the security of the data generation process. The generated random number keys of Internet nodes are then distributed through a secure channel, which is done through an encrypted transmission protocol (such as TLS or SSL) to ensure that the keys are not intercepted or tampered with during transmission. During the distribution process, the keys are encrypted to prevent leakage in the middle, and an identity authentication mechanism is used to ensure that the recipient of the key is an authorized legal entity to prevent the key from being received by mistake or maliciously. Ultimately, the keys distributed through the secure channel generate "random key recipient data", which lays the foundation for subsequent encryption operations.

[0032] Step S3: Obtain historical network traffic data; perform abnormal traffic detection based on the historical network traffic data, and construct an abnormal behavior analysis model to generate an Internet abnormal behavior analysis model; In the embodiment of the present invention, the historical network traffic data includes various traffic indicators in the network, such as the size of the data packet, the transmission rate, the distribution of IP addresses, the usage of ports, the time distribution of the traffic, etc. These data can reflect the normal behavior pattern of the network and provide a reference for detecting abnormal behavior. In order to detect abnormal traffic, the system adopts a variety of data analysis and pattern recognition technologies, among which common means include statistical analysis methods, machine learning algorithms and deep learning models. Through the preprocessing of the historical traffic data, the system first extracts key features, identifies the regular patterns in the traffic, and establishes a statistical model of normal traffic based on this. Common anomaly detection methods include threshold-based detection, clustering-based anomaly detection, and classification models based on supervised learning and unsupervised learning. Based on these algorithms, the system can automatically identify traffic patterns that are significantly different from the distribution of historical data, thereby detecting potential abnormal traffic. These abnormal traffic are caused by network attacks, traffic overload, hardware failure and other reasons. Secondly, for the abnormal part detected in the traffic, the system will build an abnormal behavior analysis model to more deeply analyze the characteristics, impact range and causes of abnormal behavior. The construction of the model relies on machine learning algorithms, such as decision trees, support vector machines (SVMs), neural networks, etc., which optimize the accuracy of the model by training historical data so that it can identify the underlying patterns of various abnormal behaviors. By analyzing abnormal behaviors, the system can not only identify which traffic is abnormal, but also predict future abnormal traffic through the learned model.

[0033] Step S4: Based on the Internet abnormal behavior analysis model, abnormal traffic behavior analysis is performed on the Internet participating node data to generate abnormal traffic behavior data; behavior encryption information strategy is generated based on the abnormal traffic behavior data and random key recipient data to generate an Internet data encryption strategy; an Internet encryption strategy report is generated for the Internet data encryption strategy, thereby completing the Internet encryption method operation.

[0034] In the embodiment of the present invention, the abnormal traffic behavior analysis is performed on the Internet participating node data through the Internet abnormal behavior analysis model. The system uses the previously constructed abnormal behavior analysis model to analyze the real-time traffic data of the Internet participating nodes and identify the abnormal behavior therein. This process extracts features and recognizes patterns of network traffic, and identifies the behavior characteristics that deviate from the normal traffic pattern based on the training data and prediction algorithm in the model, such as the traffic peak of abnormal data packets, unreasonable transmission rate, or atypical protocol usage. Through this data-driven analysis method, the system can effectively distinguish normal traffic from potential attack traffic or fault traffic, thereby generating traffic abnormal behavior data. The generation process of traffic abnormal behavior data mainly relies on a variety of statistical learning and machine learning algorithms. These algorithms can automatically adjust model parameters to improve accuracy by learning historical and real-time traffic data, thereby effectively identifying abnormal behavior in the network. Next, the system generates a behavior encryption information strategy based on the traffic abnormal behavior data and the random key receiver data. In this process, the system analyzes the abnormal behavior characteristics shown in the network traffic and compares them with the data of the random key receiver, thereby generating an encryption strategy that adapts to different abnormal behavior types. The design of these encryption strategies needs to consider factors such as the degree of traffic anomaly, the type of attack, and the importance of data transmission, to ensure that different types of abnormal traffic can be protected by corresponding encryption methods. Specifically, different encryption strengths or encryption methods will be selected according to the dangerousness of the traffic. For example, for serious abnormal behavior, more complex encryption algorithms can be applied, such as fragmentation encryption, obfuscation encryption, etc. For mild abnormal behavior, lightweight encryption is used. Finally, the system generates an Internet encryption policy report based on the generated Internet data encryption policy. The report generation process provides a detailed description of the encryption policy, including the selection of encryption technology, key management scheme, encryption strength requirements, data security assessment, etc., so as to provide reference and basis for subsequent network defense strategies.

[0035] Preferably, step S1 comprises the following steps: Step S11: Obtain Internet participating node data; Step S12: Generate a unique identifier for the Internet participating node data to generate an Internet participating node UID; Step S13: Use the distributed ledger to store the Internet participating node UID and Internet participating node data to generate basic storage data of the Internet participating node.

[0036] In an embodiment of the present invention, Internet participating node data is obtained. This process collects basic information of nodes from multiple data sources, including but not limited to the IP address, MAC address, device type, geographic location, operating status, communication protocol, communication frequency, etc. of network devices. This information provides a basis for subsequent node management, data storage and security analysis. In the data acquisition stage, efficient data acquisition technologies such as web crawlers, traffic monitoring tools, network protocol analyzers, etc. are used to ensure that the status and behavior data of Internet participating nodes can be captured in real time or regularly. A unique identifier (UID) is generated for the acquired Internet participating node data. The generation of UID is to convert the data of each node into a unique and non-repeatable identifier through an algorithm to ensure that each node can be independently identified in the system. Common UID generation methods include hash algorithms (such as SHA-256), UUID (universally unique identifier) ​​and other technologies, which can ensure that the generated identifiers are highly unique and unpredictable. The generation of UID not only facilitates subsequent data storage and retrieval, but also enables identity authentication and security isolation between multiple nodes to prevent identity impersonation and data tampering. Distributed ledger technology is used to store the UID and data of Internet participating nodes. Distributed ledger technology (such as blockchain) has the characteristics of decentralization, data immutability, transparency and trustworthiness, and can ensure the security and consistency of data of each node during storage. At this stage, by recording the UID and related data of the node in the distributed ledger, the immutability and decentralized management of the data are ensured. In addition, the distributed ledger can also provide real-time data update and synchronization functions to ensure that there will be no data conflicts or losses when multiple participants store and share data on the same ledger. The basic storage data of the node will include all its associated information, such as device configuration, connection history, status monitoring data, etc. This information is stored in the form of blocks on the blockchain. Each block contains complete node data and a unique identifier to ensure the security, integrity and immutability of the data.

[0037] As an example of the present invention, refer to Figure 2 As shown, in this example, step S2 includes: Step S21: using a random number generator to generate random numbers for Internet participating node data, and performing multi-party secure computing to generate an Internet node random number key; Step S22: Timestamp the Internet node random number key to generate random key timestamp limiting data; Step S23: Establish a secure channel through the ECDH protocol, distribute the Internet node random number key and random key timestamp limiting data, and generate random key recipient data.

[0038] In an embodiment of the present invention, a random number generator (RNG) is used to generate random numbers for Internet participating node data. This process provides a basis for subsequent key generation by generating random numbers using a high-quality encryption algorithm. At the data level, the design of the random number generator is based on true random number generation (TRNG) or pseudo-random number generation (PRNG) technology. True random number generation depends on physical processes such as thermal noise, photoelectric effect, etc., while pseudo-random number generation depends on mathematical algorithms such as linear congruential method (LCG). Through these technical means, the generated random numbers not only meet the statistical randomness requirements, but also enhance security through encryption algorithms. Further, in order to ensure that the generated random numbers remain consistent in multi-party computing, multi-party secure computing (MPC) technology is used to achieve joint calculation and verification of the random number generation process by multiple participants without leaking single-party data. This technology ensures the security and fairness of the generated Internet node random number keys in a distributed environment, and avoids the problem of a single party tampering with or controlling the random number generation process. The generated random number keys of Internet nodes are further processed and timestamped to ensure the validity and timeliness of the keys. Timestamp-limited technology ensures that each key is associated with a specific time by adding time information to the random number keys. This is important in practical applications, especially in the process of multiple communications or long-term data interaction, which can effectively avoid the reuse of keys and increase the frequency of key updates. Timestamps not only provide the validity period of keys, but also help trace and track when detecting anomalies, thereby improving the overall security of the system. The Elliptic Curve Diffie-Hellman (ECDH) protocol is used to establish a secure channel to achieve key exchange between Internet nodes. The ECDH protocol uses the elliptic curve encryption algorithm and provides strong encryption protection based on the mathematical discrete logarithm problem. At the data level, the ECDH protocol enables the communicating parties to exchange keys securely, ensuring that the keys cannot be cracked even if there is a third-party eavesdropping. In this process, the Internet node random number keys and random key timestamp-limited data are distributed to the recipient, generating the final random key recipient data.

[0039] Preferably, step S21 includes the following steps: Step S211: collecting the noise sources of the mechanical energy nodes of the Internet participating node data to generate Internet node noise source data; performing time jitter processing on the Internet node noise source data to generate Internet node time jitter data; Step S212: Adding hardware random noise according to the Internet node time jitter data to generate Internet node time-hardware noise data; Step S213: Perform distributed entropy pool synthesis processing on the Internet node time-hardware noise data to generate Internet node distributed entropy pool data; generate random numbers for the Internet node distributed entropy pool data, and perform multi-party secure computing to generate Internet node random number keys.

[0040] In an embodiment of the present invention, the Internet participating node data is subjected to mechanical energy node noise source collection to generate Internet node noise source data. This process utilizes physical noise sources, such as vibration, temperature change, wind force and other factors in the environment, to extract mechanical energy noise from them. These noises are highly random and can be used as the initial data source for random number generation. In order to further improve the randomness of the data, the noise source data is subjected to time jitter processing. The time jitter processing increases the uncertainty of the data by temporally perturbing the collected mechanical energy data, making the time series data more random and reducing the impact of periodic fluctuations. This process ensures that the time jitter data finally generated can reflect more unpredictable random characteristics and increase the encryption strength of the data. The Internet node time jitter data is further processed to add hardware random noise. Hardware random noise comes from dedicated hardware devices, such as physical noise generators, or electromagnetic noise generated by circuit design. These hardware random noises have higher unpredictability than pseudo-random numbers generated by software, and can effectively enhance the randomness of generated data. Combining hardware noise with time jitter data allows the generated data to maintain high randomness at multiple levels, thereby improving the security of the key generation process and reducing the possibility of being predicted or attacked. The data after time jitter and hardware random noise are added enters the distributed entropy pool for synthesis processing. The role of the entropy pool is to fuse random data from different sources to increase the overall entropy value and ensure that the generated data is more random and difficult to predict. The entropy pool synthesis processing is carried out in a distributed manner, which means that the process is distributed on multiple participating nodes for calculation and storage, which not only increases the redundancy of the data, but also improves the fault tolerance and security of the system. On this basis, random numbers are generated for the generated distributed entropy pool data, and finally through multi-party secure computing technology, it is ensured that when calculating between multiple participants, a single party cannot obtain complete random numbers or key information, ensuring the fairness and security of key generation.

[0041] As an example of the present invention, refer to Figure 3 As shown, in this example, step S3 includes: Step S31: Obtain historical network traffic data; Step S32: performing abnormal traffic detection based on historical network traffic data to generate historical traffic abnormal behavior data; Step S33: construct an abnormal behavior analysis model for the historical traffic abnormal behavior data to generate an Internet abnormal behavior analysis model.

[0042] In an embodiment of the present invention, network traffic data is collected from multiple sources such as Internet service providers (ISPs), enterprise networks or cloud platforms. These data include but are not limited to information such as source IP, target IP, transmission protocol type, packet size, traffic timing, and traffic source. In order to ensure the comprehensiveness and accuracy of the data, these data will be cleaned and formatted to make them suitable for subsequent anomaly detection and analysis tasks. The core purpose of this step is to establish a comprehensive historical traffic data set as the basis for subsequent abnormal traffic detection. Abnormal traffic detection is performed based on the acquired historical network traffic data. This process relies on statistical and machine learning methods, such as clustering algorithms, anomaly detection algorithms (such as IsolationForest, One-Class SVM) or rule-based detection systems. Through these methods, the system can identify abnormal traffic that is significantly different from normal traffic patterns. The specific technical means of abnormal traffic detection include time series analysis of traffic, distribution feature analysis, frequent pattern detection, etc., and the goal is to find security threats or network attack behaviors (such as DoS attacks, data leaks, malicious scanning, etc.). The detection results will generate historical traffic abnormal behavior data, including information such as the time of abnormal traffic, traffic characteristics, and its deviation from normal traffic. An abnormal behavior analysis model is constructed based on historical traffic abnormal behavior data. This process uses machine learning and statistical models to model and analyze abnormal behavior data. The methods used include autoencoders in deep learning, generative adversarial networks (GANs), ensemble learning methods, etc., which can deeply explore potential abnormal behaviors in complex traffic. The model learns the normal patterns of historical traffic data through the training process and can automatically identify abnormal patterns that are significantly different from them. The construction of the abnormal behavior analysis model includes steps such as data feature selection, model training, cross-validation, and performance evaluation. In this process, historical traffic abnormal behavior data is used to train the model, so that the model can accurately predict whether it is abnormal behavior based on the input traffic data, and further generate an Internet abnormal behavior analysis model.

[0043] Preferably, step S33 includes the following steps: Step S331: Perform fluctuation analysis on the historical traffic abnormal behavior data to generate historical traffic abnormal fluctuation data; draw a two-dimensional traffic fluctuation graph on the historical traffic abnormal fluctuation data to generate a historical traffic abnormal fluctuation graph; perform abnormal peak detection based on the historical traffic abnormal fluctuation graph to generate historical traffic fluctuation peak data; perform timestamp tracing on the historical traffic fluctuation peak data to generate historical traffic abnormal behavior timestamp data; Step S332: construct the first layer of the model based on the historical traffic fluctuation abnormal data, and perform abnormal traffic matrix analysis to generate the Internet abnormal behavior-traffic abnormal layer; construct the second layer of the model based on the historical traffic fluctuation peak data, and perform point cloud computing processing to generate the Internet abnormal behavior-fluctuation peak layer; construct the third layer of the model based on the historical traffic abnormal behavior timestamp data, and perform timestamp comparison to generate the Internet abnormal behavior-timestamp layer; Step S333: construct an abnormal behavior analysis model for the Internet abnormal behavior-traffic abnormality layer, the Internet abnormal behavior-fluctuation peak layer and the Internet abnormal behavior-timestamp layer to generate an Internet abnormal behavior analysis model.

[0044] In the embodiment of the present invention, fluctuation analysis is performed on the historical traffic abnormal behavior data. Fluctuation analysis models the fluctuation characteristics of traffic data through time series methods to identify the trend and amplitude change of fluctuations in the data. This process uses mathematical tools such as sliding average, volatility calculation, Fourier transform, etc. to process time series data and generate historical traffic fluctuation abnormal data. Further, by drawing a two-dimensional traffic fluctuation graph, the time and amplitude of traffic changes are visualized to help analyze the time series distribution and change trend of abnormal traffic and generate historical traffic abnormal fluctuation graphs. Based on these fluctuation graphs, the system uses abnormal peak detection methods (such as standard deviation-based anomaly detection and peak test algorithms) to identify significant peaks of abnormal fluctuations and generate historical traffic fluctuation peak data. At the same time, through the timestamp tracing technology, the abnormal peak is associated with the specific timestamp of the historical traffic data to generate the timestamp data of historical traffic abnormal behavior, ensuring the accurate recording and tracking of the time when the abnormal traffic behavior occurs. The first layer of the model is constructed based on the historical traffic fluctuation abnormal data, and the abnormal traffic matrix analysis method is adopted. This method extracts and reconstructs abnormal patterns in traffic data based on matrix decomposition techniques (such as singular value decomposition, principal component analysis, etc.) to generate an Internet abnormal behavior-traffic anomaly layer. In this way, the model can capture potential abnormal behavior patterns from complex traffic data. Next, the second layer of the model is constructed based on the historical traffic fluctuation peak data, and the outliers and fluctuation peaks in the traffic data are spatially analyzed and distributed evaluated using point cloud computing processing (such as k-means clustering, DBSCAN, etc.) to generate the Internet abnormal behavior-fluctuation peak layer. Through this processing, the system can identify the aggregation and distribution patterns of abnormal traffic in high-dimensional data space. Finally, the third layer of the model is constructed based on the historical traffic abnormal behavior timestamp data. The abnormal events are matched with specific time tags through the timestamp comparison technology to generate the Internet abnormal behavior-timestamp layer. This layer is mainly used to capture the time series characteristics of abnormal traffic behavior and provide time dimension support for subsequent analysis. The system conducts a comprehensive analysis of the abnormal behavior data of the above three levels (Internet abnormal behavior-traffic anomaly layer, Internet abnormal behavior-fluctuation peak layer, and Internet abnormal behavior-timestamp layer) to build a complete abnormal behavior analysis model.

[0045] As an example of the present invention, refer to Figure 4 As shown, in this example, step S4 includes: Step S41: performing abnormal traffic behavior analysis on Internet participating node data based on an Internet abnormal behavior analysis model to generate traffic abnormal behavior data; Step S42: Generate a behavior encryption information strategy based on the traffic abnormal behavior data and the random key recipient data to generate an Internet data encryption strategy; Step S43: Encrypt and transmit the random key recipient data based on the Internet data encryption strategy to generate Internet information recipient transmission data; generate an Internet encryption policy report based on the Internet information recipient transmission data, thereby completing the Internet encryption method operation.

[0046] In an embodiment of the present invention, abnormal traffic behavior analysis is performed on Internet participating node data based on an Internet abnormal behavior analysis model. This step relies on multidimensional data fusion technology, in which feature extraction and pattern recognition are performed on node traffic data. Using historical traffic data, time series analysis, and machine learning models (such as classifiers, regression analysis, etc.), the model can identify potential abnormal behaviors in traffic, such as DDoS attacks, traffic spikes, or irregular data flows. The abnormal behavior in the data is quantified by statistical methods, and clustering algorithms (such as K-means, DBSCAN) are used to classify abnormal behaviors in traffic data, thereby generating traffic abnormal behavior data. These data reveal the pattern of traffic fluctuations and provide a basis for the generation of subsequent encryption strategies. Based on the traffic abnormal behavior data and random key recipient data, a behavior encryption information strategy is generated, and then an Internet data encryption strategy is generated. This process uses the behavior-driven strategy generation technology in the encryption algorithm, combines the abnormality of the data and the access frequency of key nodes, and generates a multi-level encryption strategy through an encryption algorithm (such as AES, RSA, etc.). The strategy adopts encryption measures of different strengths and types based on the intensity of abnormal traffic, the identity of the visitor, and the specific characteristics of traffic behavior. For example, for situations where traffic anomalies are more severe, strong encryption strategies (such as the generation and update of dynamic keys) are adopted, while for nodes with smaller traffic fluctuations, lighter encryption methods (such as symmetric encryption) are selected. The core of this process is the combination of real-time processing of abnormal behavior data and random key generation. Based on the Internet data encryption strategy, the random key receiver data is encrypted and transmitted to generate Internet information receiver transmission data. This step uses the encryption strategy generated above to encrypt and transmit the data. During the encrypted transmission process, asymmetric encryption methods (such as public / private key pairing) and symmetric encryption methods (such as key exchange mechanism) are combined to ensure the confidentiality and security of data transmission. At the same time, secure transmission protocols (such as TLS, SSL, etc.) are used to protect the data transmission process in the network to prevent man-in-the-middle attacks and data leakage. Finally, an Internet encryption strategy report is generated based on the Internet information receiver transmission data, thereby completing the entire Internet encryption method operation.

[0047] Preferably, step S42 includes the following steps: Step S421: using a preset abnormal behavior threshold to judge the traffic abnormal behavior data, generating traffic abnormal behavior result data, wherein the traffic abnormal behavior result data includes high abnormal behavior result data and low abnormal behavior result data; based on the traffic abnormal behavior result data, a behavior encryption information strategy is generated to generate an Internet data encryption strategy, wherein the Internet data encryption strategy includes an Internet high abnormality processing strategy and an Internet low abnormality processing strategy; Step S422: When the traffic abnormal behavior result data is high abnormal behavior result data, the Internet high abnormality processing strategy is applied to perform data sharding on the Internet node random number key, generate multi-shard random number keys, and perform one-time key generation to generate a dynamic key enhanced data set; random noise is added to the traffic abnormal behavior data using packet encryption to generate obfuscated traffic data; the dynamic key enhanced data set and the obfuscated traffic data are sent through two-way identity authentication, thereby completing the Internet high abnormality processing strategy; Step S423: When the traffic abnormal behavior result data is low abnormal behavior result data, the Internet low abnormality processing strategy is applied to lightweight encrypt the Internet node random number key to generate a lightweight key data set; the lightweight key data set is sent to complete the Internet low abnormality processing strategy.

[0048] In the embodiment of the present invention, the traffic abnormal behavior data is judged by a preset abnormal behavior threshold. This process relies on rule-based anomaly detection algorithms, such as statistical methods or machine learning models (such as support vector machines, decision trees, etc.), which can monitor and analyze traffic data in real time and identify high abnormal and low abnormal behavior data. The generation of traffic abnormal behavior result data is a process based on abnormal behavior scoring, in which different types of abnormal behaviors are classified by threshold setting. This classification process not only takes into account the fluctuation of data traffic, but also integrates factors such as the frequency, duration and access mode of traffic, so as to generate accurate high abnormal and low abnormal behavior data. Next, based on these classified data, a behavior encryption information strategy is generated. This strategy adopts encryption strategies of different strengths according to different levels of abnormal traffic, thereby forming an Internet data encryption strategy. High abnormal behavior data adopts a high-intensity encryption strategy, and low abnormal behavior data adopts a lightweight encryption strategy. This hierarchical encryption method ensures that the system can both ensure data security when processing abnormal traffic and not impose excessive performance burden on normal traffic. When the traffic abnormal behavior result data is high abnormal behavior data, the system applies the Internet high abnormality processing strategy to perform data sharding on the random number key of the Internet node and generate a multi-shard random number key. This process relies on data sharding technology. By dividing the key into multiple small parts for encrypted transmission, the security of the key is enhanced and single-point attacks are prevented. Thereafter, a dynamic key reinforcement data set is generated through a one-time key generation technology to meet the security requirements in a high-risk environment. In addition, after the traffic abnormal behavior data is encrypted in groups, random noise is added to it to generate obfuscated traffic data. This process is implemented through encryption algorithms (such as AES, DES, etc.) to enhance the unpredictability of the transmitted data and make it more difficult for attackers to identify and analyze it. Finally, the generated dynamic key reinforcement data set and obfuscated traffic data are sent through two-way authentication. This mechanism ensures the authentication and data integrity during the transmission process and prevents malicious tampering and man-in-the-middle attacks. When the traffic abnormal behavior result data is low abnormal behavior data, step S423 applies the Internet low abnormality processing strategy to perform lightweight encryption on the random number key of the Internet node and generate a lightweight key data set. This process relies on lightweight encryption algorithms (such as RC4, ChaCha, etc.), which have low computational overhead while ensuring encryption strength and are suitable for low-risk or low-load environments.

[0049] Preferably, step S43 includes the following steps: Step S431: encrypting and transmitting the random key receiver data based on the Internet data encryption strategy to generate Internet information receiver transmission data; Step S432: Compare the Internet information receiver's transmission data with the Internet participating node's basic storage data to generate transmission channel integrity comparison data; Step S433: Generate an Internet encryption policy report based on the transmission channel integrity comparison data, thereby completing the Internet encryption method operation.

[0050] In the embodiment of the present invention, based on the Internet data encryption strategy, the system encrypts and transmits the random key receiver data to generate the Internet information receiver transmission data. The technical means of this step mainly rely on the encryption transmission mechanism, such as public key encryption, symmetric encryption or hybrid encryption. Encrypted transmission ensures the confidentiality and integrity of the data during the transmission process, and prevents the data from being maliciously tampered with or stolen. During the data transmission process, encryption algorithms (such as AES, RSA or ECC, etc.) that comply with the Internet encryption strategy are adopted. These algorithms ensure the safe transmission of data by selecting appropriate key management methods. In addition, during the transmission process, security protocols (such as TLS / SSL, IPSec, etc.) are also used to protect the encrypted data to ensure the safe transmission of the encryption key and the data itself. The system compares the Internet information receiver transmission data with the basic storage data of the Internet participating nodes to generate transmission channel integrity comparison data. The key technical means of this process is to use hash algorithms and integrity verification mechanisms, such as SHA series algorithms, HMAC, digital signatures, etc., to hash the transmitted data, and compare the generated hash value with the hash value of the original data stored in the node. Through this comparison, it is possible to detect whether the data has been tampered with or lost during the transmission process, thereby verifying the integrity of the transmission channel. This data integrity verification method based on hash comparison ensures that the received data is consistent with the original data, preventing the data from being maliciously attacked or tampered with during transmission. Based on the transmission channel integrity comparison data, the system generates an Internet encryption policy report. The report generation process relies on data analysis and report generation technology. Specifically, the system will generate a detailed encryption policy execution report based on the integrity verification results of the transmission channel and the abnormal conditions that occur during the encrypted transmission process. The report content includes the results of the encryption policy execution, the integrity status of the transmitted data, any abnormal or erroneous logs, and feedback on related security measures.

[0051] In this specification, an Internet data encryption system is provided, which is used to execute the above-mentioned Internet data encryption method. The Internet data encryption system: The node data management module is used to obtain the Internet participating node data; store the Internet participating node data in a distributed ledger and generate basic storage data of the Internet participating nodes; The random key generation and distribution module is used to generate random numbers for Internet participating node data using a random number generator and perform multi-party secure computing to generate Internet node random number keys; distribute Internet node random number keys through a secure channel to generate random key recipient data; The abnormal behavior modeling module is used to obtain historical network traffic data; perform abnormal traffic detection based on historical network traffic data, and build an abnormal behavior analysis model to generate an Internet abnormal behavior analysis model; The traffic anomaly analysis and encryption strategy module is used to analyze the abnormal traffic behavior of Internet participating node data based on the Internet abnormal behavior analysis model to generate traffic abnormal behavior data; generate behavior encryption information strategy based on traffic abnormal behavior data and random key recipient data to generate Internet data encryption strategy; generate Internet encryption strategy report for Internet data encryption strategy, thereby completing Internet encryption method operations.

[0052] The beneficial effect of the present invention is that the data of Internet participating nodes is stored through distributed ledger technology, which significantly improves the integrity and non-tamperability of the data and ensures the reliability of the basic storage data of the participating nodes; at the same time, the node random key is generated by using a random number generator and multi-party secure computing, and distributed through a secure channel, so that the key generation and transmission process has higher security, effectively avoiding the risk of single point leakage and tampering. On the basis of historical network traffic data, this method combines anomaly detection algorithm and behavior analysis technology to construct an efficient Internet abnormal behavior analysis model, and realizes accurate identification of traffic abnormal behavior by extracting abnormal features, providing a reliable basis for subsequent strategy generation. In addition, by jointly processing abnormal traffic behavior data and random key receiver data, a behavior encryption information strategy is generated and an Internet data encryption strategy is formulated, thereby realizing targeted and dynamic encryption configuration in the process of data encryption, greatly improving the security and adaptability of Internet data. Finally, the generation of the Internet encryption policy report integrates the data processing results of the whole process, provides structured support for the verification and improvement of security policies, and reduces the complexity and error of manual intervention. The whole process builds an efficient closed loop in the data collection, processing, encryption and verification links, ensuring the security and availability of data in transmission and storage. Therefore, the present invention solves the problems of insufficient security, inflexible strategies and data vulnerability in traditional encryption methods through the innovative combination of distributed ledgers, random key generation and distribution, and abnormal behavior analysis, and improves the security, dynamism and reliability of Internet data encryption.

[0053] Therefore, the embodiments should be regarded as illustrative and non-restrictive from all points, and the scope of the present invention is limited by the appended claims rather than the above description, and it is therefore intended that all changes falling within the meaning and range of equivalent elements of the application documents are included in the present invention.

[0054] The above description is only a specific embodiment of the present invention, so that those skilled in the art can understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but should conform to the widest scope consistent with the principles and novel features invented herein.

Claims

1. A method for encrypting Internet data, characterized in that: The following steps are involved: Step S1: Obtain Internet participating node data; Distributed ledger storage of Internet participating node data to generate basic storage data of Internet participating nodes; Step S2: Generate random numbers for Internet participating node data using a random number generator, and perform multi-party secure computing to generate Internet node random number keys; distribute the Internet node random number keys through a secure channel to generate random key recipient data; Step S3: Obtain historical network traffic data; perform abnormal traffic detection based on the historical network traffic data, and construct an abnormal behavior analysis model to generate an Internet abnormal behavior analysis model; Step S4: Analyze the abnormal traffic behavior of Internet participating node data based on the Internet abnormal behavior analysis model to generate abnormal traffic behavior data; Generate behavior encryption information strategy based on traffic abnormal behavior data and random key recipient data, and generate Internet data encryption strategy; Generate an Internet encryption policy report for the Internet data encryption policy, thereby completing the Internet encryption method operation.

2. The Internet data encryption method according to claim 1, characterized in that: Step S1 includes the following steps: Step S11: Obtain Internet participating node data; Step S12: Generate a unique identifier for the Internet participating node data to generate an Internet participating node UID; Step S13: Use the distributed ledger to store the Internet participating node UID and Internet participating node data to generate basic storage data of the Internet participating node.

3. The Internet data encryption method according to claim 1, characterized in that: Step S2 includes the following steps: Step S21: using a random number generator to generate random numbers for Internet participating node data, and performing multi-party secure computing to generate an Internet node random number key; Step S22: Timestamp the Internet node random number key to generate random key timestamp limiting data; Step S23: Establish a secure channel through the ECDH protocol, distribute the Internet node random number key and random key timestamp limiting data, and generate random key recipient data.

4. The Internet data encryption method according to claim 3, characterized in that: Step S21 includes the following steps: Step S211: collecting the noise sources of the mechanical energy nodes of the Internet participating node data to generate Internet node noise source data; performing time jitter processing on the Internet node noise source data to generate Internet node time jitter data; Step S212: Adding hardware random noise according to the Internet node time jitter data to generate Internet node time-hardware noise data; Step S213: Perform distributed entropy pool synthesis processing on the Internet node time-hardware noise data to generate Internet node distributed entropy pool data; generate random numbers for the Internet node distributed entropy pool data, and perform multi-party secure computing to generate Internet node random number keys.

5. The Internet data encryption method according to claim 1, characterized in that: Step S3 includes the following steps: Step S31: Obtain historical network traffic data; Step S32: performing abnormal traffic detection based on historical network traffic data to generate historical traffic abnormal behavior data; Step S33: construct an abnormal behavior analysis model for the historical traffic abnormal behavior data to generate an Internet abnormal behavior analysis model.

6. The Internet data encryption method according to claim 5, characterized in that: Step S33 includes the following steps: Step S331: Perform fluctuation analysis on the historical traffic abnormal behavior data to generate historical traffic abnormal fluctuation data; draw a two-dimensional traffic fluctuation graph on the historical traffic abnormal fluctuation data to generate a historical traffic abnormal fluctuation graph; perform abnormal peak detection based on the historical traffic abnormal fluctuation graph to generate historical traffic fluctuation peak data; perform timestamp tracing on the historical traffic fluctuation peak data to generate historical traffic abnormal behavior timestamp data; Step S332: construct the first layer of the model based on the historical traffic fluctuation abnormal data, and perform abnormal traffic matrix analysis to generate the Internet abnormal behavior-traffic abnormal layer; construct the second layer of the model based on the historical traffic fluctuation peak data, and perform point cloud computing processing to generate the Internet abnormal behavior-fluctuation peak layer; construct the third layer of the model based on the historical traffic abnormal behavior timestamp data, and perform timestamp comparison to generate the Internet abnormal behavior-timestamp layer; Step S333: construct an abnormal behavior analysis model for the Internet abnormal behavior-traffic abnormality layer, the Internet abnormal behavior-fluctuation peak layer and the Internet abnormal behavior-timestamp layer to generate an Internet abnormal behavior analysis model.

7. The Internet data encryption method according to claim 1, characterized in that: Step S4 includes the following steps: Step S41: performing abnormal traffic behavior analysis on Internet participating node data based on an Internet abnormal behavior analysis model to generate traffic abnormal behavior data; Step S42: Generate a behavior encryption information strategy based on the traffic abnormal behavior data and the random key recipient data to generate an Internet data encryption strategy; Step S43: Encrypt and transmit the random key recipient data based on the Internet data encryption strategy to generate Internet information recipient transmission data; generate an Internet encryption policy report based on the Internet information recipient transmission data, thereby completing the Internet encryption method operation.

8. The Internet data encryption method according to claim 7, characterized in that: Step S42 includes the following steps: Step S421: using a preset abnormal behavior threshold to judge the traffic abnormal behavior data, generating traffic abnormal behavior result data, wherein the traffic abnormal behavior result data includes high abnormal behavior result data and low abnormal behavior result data; based on the traffic abnormal behavior result data, a behavior encryption information strategy is generated to generate an Internet data encryption strategy, wherein the Internet data encryption strategy includes an Internet high abnormality processing strategy and an Internet low abnormality processing strategy; Step S422: When the traffic abnormal behavior result data is high abnormal behavior result data, the Internet high abnormality processing strategy is applied to perform data sharding on the Internet node random number key, generate multi-shard random number keys, and perform one-time key generation to generate a dynamic key enhanced data set; random noise is added to the traffic abnormal behavior data using packet encryption to generate obfuscated traffic data; the dynamic key enhanced data set and the obfuscated traffic data are sent through two-way identity authentication, thereby completing the Internet high abnormality processing strategy; Step S423: When the traffic abnormal behavior result data is low abnormal behavior result data, the Internet low abnormality processing strategy is applied to lightweight encrypt the Internet node random number key to generate a lightweight key data set; the lightweight key data set is sent to complete the Internet low abnormality processing strategy.

9. The Internet data encryption method according to claim 7, characterized in that: Step S43 includes the following steps: Step S431: encrypting and transmitting the random key receiver data based on the Internet data encryption strategy to generate Internet information receiver transmission data; Step S432: Compare the Internet information receiver's transmission data with the Internet participating node's basic storage data to generate transmission channel integrity comparison data; Step S433: Generate an Internet encryption policy report based on the transmission channel integrity comparison data, thereby completing the Internet encryption method operation.

10. An Internet data encryption system, characterized in that: Used to execute the Internet data encryption method as claimed in claim 1, the Internet data encryption system comprises: The node data management module is used to obtain the Internet participating node data; store the Internet participating node data in a distributed ledger and generate basic storage data of the Internet participating nodes; The random key generation and distribution module is used to generate random numbers for Internet participating node data using a random number generator and perform multi-party secure computing to generate Internet node random number keys; distribute Internet node random number keys through a secure channel to generate random key recipient data; The abnormal behavior modeling module is used to obtain historical network traffic data; perform abnormal traffic detection based on historical network traffic data, and build an abnormal behavior analysis model to generate an Internet abnormal behavior analysis model; The traffic anomaly analysis and encryption strategy module is used to analyze the abnormal traffic behavior of Internet participating node data based on the Internet abnormal behavior analysis model to generate traffic abnormal behavior data; generate behavior encryption information strategy based on traffic abnormal behavior data and random key recipient data to generate Internet data encryption strategy; generate Internet encryption strategy report for Internet data encryption strategy, thereby completing Internet encryption method operations.

Images