Security encryption transmission system for game data

Abstract

The invention discloses a security encryption transmission system for game data, and relates to the technical field of game data encryption. Comprising a network environment data collection module, a network risk feature extraction module, a feature analysis and machine learning evaluation module, a network environment classification module, a low-risk network Hash algorithm module and a high-risk network Hash algorithm adjustment module, and various parameter information of the current network environment is comprehensively collected. According to the method, the network environment is intelligently evaluated through machine learning, the system recognizes a high-risk situation in real time, the Hash algorithm is dynamically adjusted, stronger encryption is adopted when the risk is high, the communication safety is improved, and viruses and ransomware are prevented. And when the risk is low, a fixed Hash algorithm is used, and high performance is kept. According to the mechanism, data security is effectively guaranteed, resource use is optimized, and security and system performance are balanced.

Description

Technical Field

[0001] The present invention relates to the technical field of game data encryption, and in particular to a secure encryption transmission system for game data. Background Art

[0002] Secure encrypted transmission of game data means that during the game, the player's sensitive data (such as account information, transaction records, game progress, etc.) is encrypted and transmitted over the network to ensure that the data will not be stolen, tampered with or leaked by unauthorized third parties during the transmission process. Encrypted transmission usually uses strong encryption algorithms, such as symmetric encryption (AES) or asymmetric encryption (RSA), to convert data into ciphertext, so that even if the data is intercepted, it cannot be interpreted or tampered with. In addition, in order to further ensure security, digital signatures and SSL / TLS protocols are often used to verify the integrity of the data and the security of the transmission, thereby preventing network threats such as man-in-the-middle attacks and replay attacks, and protecting the privacy of players and the stability of the gaming environment.

[0003] The prior art has the following deficiencies: The existing technology selects a fixed hash algorithm through the handshake protocol each time a session is established to ensure the independence and security of the session. However, in a high-risk network environment, continuing to use a fixed hash algorithm to ensure security may cause serious hidden dangers. Threats in high-risk environments are dynamic, and attackers can quickly attack the weaknesses of specific hash algorithms. The use of fixed hash algorithms limits the system's ability to flexibly adjust according to the changing threat situation and cannot respond to new security threats (such as viruses and ransomware). Over time, fixed hash algorithms may expose more and more security flaws, and attackers can continue to exploit these vulnerabilities. Once the hash algorithm is compromised, the security of the entire encrypted communication will be lost, which may lead to data leakage or session interruption, thus seriously threatening the confidentiality and integrity of data transmission.

[0004] The above information disclosed in this Background section is only for enhancement of understanding of the background of the present disclosure and therefore it may contain information that does not constitute the prior art that is already known to one of ordinary skill in the art. Summary of the invention

[0005] The purpose of the present invention is to provide a secure encryption transmission system for game data. Through the intelligent evaluation of the network environment by a machine learning model, the system can identify high-risk environments in real time, and dynamically adjust the hash algorithm according to the evaluation results, and select a stronger encryption algorithm in high-risk situations to improve communication security and prevent new threats such as viruses and ransomware. This mechanism not only effectively responds to known vulnerabilities, but also responds to emerging attacks to ensure the confidentiality and integrity of data. For low-risk environments, the system continues to use a fixed hash algorithm to maintain high performance and efficiency. In this way, while ensuring security, the system optimizes resource usage and balances encryption strength and performance requirements to solve the problems in the above-mentioned background technology.

[0006] In order to achieve the above-mentioned purpose, the present invention provides the following technical solutions: a secure encrypted transmission system for game data, including a network environment data collection module, a network risk feature extraction module, a feature analysis and machine learning evaluation module, a network environment classification module, a low-risk network hash algorithm module, and a high-risk network hash algorithm adjustment module: The network environment data collection module comprehensively collects various parameter information of the current network environment before the handshake protocol starts; The network risk feature extraction module collects network environment parameters and systematically organizes and stores them to form a structured analysis set, from which key features reflecting that the network environment is in a high-risk state are extracted; The feature analysis and machine learning evaluation module conducts in-depth analysis of the extracted key features within the detection window and inputs the analyzed key features into the pre-trained machine learning model for intelligent evaluation; The network environment classification module classifies the current network environment into high-risk network environment and low-risk network environment based on the evaluation results of the machine learning model; Low-risk network hash algorithm module: In a low-risk network environment, a fixed hash algorithm is continued to be used to ensure the independence and security of sessions while maintaining high performance and efficiency; The high-risk network hash algorithm adjustment module will dynamically adjust the hash algorithm in a high-risk network environment and select a hash algorithm with higher encryption strength and anti-attack capabilities to enhance the security of the session.

[0007] Preferably, key features reflecting that the network environment is in a high-risk state are extracted from the analysis set, and the extracted features include the frequency of port scanning in the network and potential abnormal behaviors in encrypted communications. Under the detection window, the extracted key features are analyzed to generate a port scanning behavior index and an encrypted communication anomaly index, respectively. The port scanning behavior index quantifies the frequency and abnormality of port scanning activities in the network; the encrypted communication anomaly index quantifies the abnormal behavior of encrypted communication traffic in the network.

[0008] Preferably, the port scanning behavior index and encrypted communication anomaly index generated after analyzing the extracted key features are input into a pre-learned machine learning model, a network security coefficient is generated through the machine learning model, and the network security environment is intelligently evaluated through the network security coefficient.

[0009] Preferably, the generated network security coefficient is compared and analyzed with a preset network security coefficient reference threshold to classify the current network environment. The specific steps are as follows: If the network security factor is greater than or equal to a preset network security factor reference threshold, the current network environment is classified as a high-risk network environment; If the network security factor is less than a preset network security factor reference threshold, the current network environment is classified as a low-risk network environment.

[0010] Preferably, in a high-risk network environment, the hash algorithm will be dynamically adjusted to select a hash algorithm with higher encryption strength and anti-attack capability to enhance the security of the session. The specific steps are as follows: By ensuring the network security factor Compared with the preset network security factor reference threshold Perform a comparison to determine whether the encryption strength needs to be adjusted, as follows: , when the network security factor Greater than or equal to the network security factor reference threshold When , it indicates that the network is in a high-risk environment, triggering the hash algorithm adjustment step; After confirming that the network environment is a high-risk network environment, the network security coefficient The value is used to select a hash algorithm with higher encryption strength and anti-attack ability. At this time, it is necessary to select a suitable high-strength hash algorithm from the algorithm library. In order to dynamically adjust the hash algorithm, refer to the performance indicators of the hash algorithm and combine it with the network security coefficient The value of determines which encryption level of the hash algorithm to switch to. The specific steps are as follows: , where The representative algorithm selection mechanism dynamically selects a hash algorithm with higher encryption strength based on the network security coefficient and algorithm performance indicators; After the hash algorithm is adjusted, the new hash algorithm will be applied in the handshake protocol phase. At this time, the new hash algorithm will be passed to both communicating parties to ensure that the subsequent data encryption and verification processes are processed based on high-intensity hash algorithms. Before the session starts, the default hash algorithm is replaced based on the security assessment results in a high-risk environment to ensure that the key exchange, identity authentication, and data integrity of the session are more secure. The formula is as follows: , where the new hash algorithm is the new hash algorithm selected in a high-risk network environment. After the handshake protocol is generated and the hash algorithm is applied, the hash algorithm cannot be modified in real time. In order to ensure the long-term security of network communications, real-time monitoring will be continuously performed throughout the life cycle of the session, and potential threats will be dynamically evaluated. If during the session, the network security coefficient If the rate continues to rise, it means that a new threat has emerged in the network environment. The feedback mechanism will be activated to notify the administrator to manually intervene and adjust the system to select a stronger hash algorithm for the next session establishment. The formula for this process is as follows: Even if the hash algorithm cannot be changed in the current session, the network environment can still be monitored to ensure that when a major security risk occurs, the next session can be adjusted in time, so that a high encryption level algorithm can be selected in future sessions to protect the confidentiality and integrity of the data.

[0011] Preferably, in the detection window, the specific steps of analyzing the port scanning frequency in the network and generating the port scanning behavior index are as follows: In the detection window, first, collect the port scanning events in the network. The collected port scanning behavior data is used for analysis and modeling. The expression is as follows: , where Is the source address The total number of port scan events initiated, Is the port scan event at the time point The indicator function, is the total duration of the detection window; After collecting port scan events, the next step is to analyze the intensity of the scan activity. To do this, consider each source The total number of address scanning events within the time window is weighted by the number of scanned ports to reflect the intensity of the scan. The calculation expression is as follows: , where Is the source address The number of different ports scanned, is an intensity adjustment factor, is the port scan intensity, Is the source participating in the scan The total number of addresses; After calculating the port scan intensity, it is also necessary to identify the abnormality of the scan behavior and calculate the rate of change of the scan intensity. The calculation expression is as follows: , where is the rate of change of the scan intensity, It's at the time Calculated port scan intensity, It's at the time Calculated port scan intensity; The port scan behavior index is generated by combining the port scan activity intensity and the rate of change of the scan intensity. The calculation expression is as follows: ,in, is the port scanning behavior index, Is the source address The scanning intensity, is the rate of change indicator function of the scanning intensity. When the rate of change exceeds the threshold When it is 1, it means there is abnormal behavior. It is the weighting coefficient of abnormal behavior on the final index, which is used to control the impact of abnormal behavior on the index.

[0012] In the detection window, the larger the port scan behavior index performance value generated after analyzing the port scan frequency in the network, the more frequent the port scan activity encountered by the network during the monitoring window, which usually indicates potential threats in the network environment, especially signs of viruses, ransomware or other malicious attacks. When attackers spread viruses or invade ransomware, they usually scan open ports to find targets that can be attacked. Therefore, the increase in the port scan behavior index reflects the increase in the frequency of port scans and abnormal activities in the network, which is usually direct evidence of the network being threatened or attacked. On the contrary, when the port scan behavior index is low, it means that there is less port scan activity in the network and no frequent abnormal behavior is shown, which usually means that the network environment is relatively safe and there are fewer attack activities.

[0013] The increase in potential abnormal behaviors in encrypted communications does indicate that the current network may be threatened, especially in high-risk environments where viruses, ransomware and other attack methods are active. When abnormal behaviors appear in encrypted communication traffic, it usually means some abnormal operations in the data transmission process, such as sudden increase in traffic, change in traffic pattern, use of abnormal encryption algorithms, or unauthorized access attempts, which may be the manifestation of malware (such as viruses or ransomware) trying to conceal its activities or steal data. For example, after encrypting files, ransomware may establish a connection with a remote server through an encrypted communication channel to transmit encrypted data or obtain instructions; while viruses may execute unauthorized commands or download malicious code by exploiting encryption protocols in the network. These abnormal behaviors may be due to malware trying to bypass firewalls and detection mechanisms through encrypted traffic to transmit data or remotely control, thereby concealing its attack traces. The increase in abnormal behaviors in encrypted communications means that there are hidden threat activities in the network, which usually indicates that the current network is in a high-risk state of being attacked and needs to take immediate response measures to strengthen monitoring and protection. Therefore, timely detection and identification of potential abnormal behaviors in encrypted communications is an important part of identifying and preventing network threats such as viruses and ransomware.

[0014] In the detection window, the specific steps for analyzing potential abnormal behaviors in encrypted communication and generating an encrypted communication anomaly index are as follows: In the detection window, we first extract multiple features from the encrypted communication traffic to capture abnormal behavior. Common features include sudden increases in encrypted traffic, connection request frequency, and changes in encryption algorithms. These features should be based on time domain and frequency domain analysis. By using high-precision data acquisition equipment and network monitoring tools, we can obtain encrypted communication data in real time and accurately capture changes in the behavior patterns of encrypted traffic, especially those that deviate significantly from normal communication patterns. The calculation expression is as follows: , where is the abnormality of encrypted communication traffic, i.e., the time point The abnormality of encrypted communication traffic at a certain moment is used to quantify the abnormality of encrypted communication traffic at a certain moment and help judge the security of the current network environment. It is Class encrypted communication traffic at time The observed value at time, It is The median of historical data of quasi-encrypted communication traffic. The median refers to the value in the middle after all data are sorted. It is usually used to measure the "typical" value of data to avoid being affected by extreme values ​​(such as abnormal traffic). It is Deviation function of encrypted communication traffic, used to measure the dispersion or fluctuation of traffic. It is The weighting coefficient of the encrypted communication traffic characteristics, is the total number of encrypted communication traffic categories; Using the extracted feature data, we can identify abnormal patterns in encrypted communications. For example, if there is a sudden increase in connection requests or irregular data packet distribution in the encrypted traffic, it may indicate that the network is under attack. This step is a key step in analyzing whether the traffic pattern is consistent with malicious behavior (such as virus or ransomware communication). We combine rule-based detection systems and machine learning methods to identify abnormal patterns in communication behavior. The calculation expression is as follows: , where Is the first The abnormal pattern indicators at time The observed value of is the normal behavior threshold of the pattern, is the tolerance coefficient for abnormal patterns, is the weighting coefficient, is the mode sensitivity index, is the abnormal pattern recognition index; After identifying abnormal patterns in encrypted communications, the ratio of abnormal behaviors in encrypted communications is calculated. By calculating the weighted ratio of abnormal traffic proportion and communication duration, it is possible to accurately assess whether the current network is threatened. The calculation expression is as follows: , where is an abnormal mark, is a small constant to avoid the denominator being zero, is the encrypted communication anomaly ratio; Based on the abnormality of encrypted traffic , Abnormal Pattern Recognition Index and the encrypted communication anomaly ratio Generate the encrypted communication anomaly index, the calculation expression is as follows: , where is the encrypted communication anomaly index, Represents at a point in time Top, The degree of abnormality of encrypted communication traffic, It is used for Class encrypted communication traffic at a time point Whether there is an index of abnormal patterns, It is used to measure the Class encrypted communication traffic at a time point The proportion of abnormal traffic within.

[0015] In the above technical solution, the technical effects and advantages provided by the present invention are: The present invention uses a machine learning model to intelligently evaluate the network environment, and the system can identify high-risk network environments in real time. In a high-risk environment (such as when security threats such as viruses and ransomware are active), the system will dynamically adjust the hash algorithm according to the evaluation results and select an algorithm with higher encryption strength and anti-attack capability. This mechanism significantly enhances the encryption strength and the ability to resist potential attacks during the communication process. For example, when port scanning is frequent in the network or abnormal behavior occurs in encrypted communication, the machine learning model can generate a corresponding safety factor and trigger the upgrade of the hash algorithm in time, using a more complex and more secure hash algorithm for session encryption. This dynamic hash algorithm adjustment can not only effectively prevent the vulnerabilities of known algorithms from being exploited, but also ensure the confidentiality and integrity of data transmission through flexible encryption algorithm selection when facing emerging attack methods. With the real-time changes in the network environment, the system can respond quickly and adopt appropriate encryption strategies to avoid the potential risks brought by traditional fixed hash algorithms.

[0016] The present invention can more accurately detect potential security threats through intelligent evaluation of the network environment by machine learning model, and divide the network environment into high risk or low risk according to the network security coefficient. This intelligent evaluation can help the system to perform more refined security protection in a dynamically changing network environment. In a low-risk network environment, continuing to use a fixed hash algorithm can maintain high performance and efficiency, avoiding unnecessary waste of resources and performance degradation. In a high-risk network environment, based on real-time security evaluation, the system can detect anomalies in time and respond quickly, and select a stronger encryption algorithm, thereby effectively responding to new threats such as viruses and ransomware. In this way, the system not only improves the overall security protection capability, but also optimizes the use of system resources, avoids performance degradation caused by excessive encryption, and ensures the balance between the efficiency and security of network transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0018] Figure 1 The module diagram of a secure encrypted transmission system for game data of the present invention is shown in FIG. DETAILED DESCRIPTION

[0019] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these example embodiments are provided so that the description of the present disclosure will be more comprehensive and complete, and the concept of the example embodiments will be fully conveyed to those skilled in the art.

[0020] The present invention provides Figure 1 A secure encryption transmission system for game data shown in the figure includes a network environment data collection module, a network risk feature extraction module, a feature analysis and machine learning evaluation module, a network environment classification module, a low-risk network hash algorithm module, and a high-risk network hash algorithm adjustment module: The network environment data collection module comprehensively collects various parameter information of the current network environment before the handshake protocol starts; Before the handshake protocol begins, the various parameter information of the current network environment is comprehensively collected, mainly to enable the dynamic selection and adjustment of the hash algorithm in a timely manner when the network environment changes. The original intention of the handshake protocol is to establish a secure and reliable communication channel, and the hash algorithm, as an important link, determines the protection of encryption and data integrity. If there are high-risk threats in the network environment, such as malicious attacks, network congestion, or unstable connections, pre-collecting network parameters can help the system evaluate these potential risks and select the appropriate hash algorithm based on the security of the current environment. If a high-risk environment is analyzed in advance, the system can select a hash algorithm with stronger encryption to enhance security, and avoid using a fixed hash algorithm that may have been compromised or vulnerable to threats. Therefore, by evaluating the network environment before the handshake protocol, the system can flexibly adjust the algorithm according to the real-time risk situation, thereby improving the security and reliability of the entire communication process.

[0021] The network risk feature extraction module collects network environment parameters and systematically organizes and stores them to form a structured analysis set, from which key features reflecting that the network environment is in a high-risk state are extracted; The collected network environment parameters are systematically organized and stored to form a structured analysis set. The specific steps include: first, the system will classify and label the various types of network information collected to ensure that each parameter can correspond to a specific network condition; then, these parameters are organized into a standardized data format according to predetermined rules to facilitate subsequent processing and analysis. Next, this information is stored in a database or memory to ensure efficient access and management of data. The role of the analysis set is that it provides a comprehensive and systematic view for subsequent risk assessment and decision-making. Through the structured analysis set, the system can quickly extract and identify key features that may lead to security risks, and can make targeted adjustments and optimizations based on these features, so as to take appropriate measures to protect session security in high-risk network environments.

[0022] The feature analysis and machine learning evaluation module conducts in-depth analysis of the extracted key features within the detection window and inputs the analyzed key features into the pre-trained machine learning model for intelligent evaluation; Key features that reflect that the network environment is in a high-risk state are extracted from the analysis set. The extracted features include the frequency of port scanning in the network and potential abnormal behaviors in encrypted communications. Under the detection window, the extracted key features are analyzed to generate a port scanning behavior index and an encrypted communication anomaly index respectively. The port scanning behavior index quantifies the frequency and abnormality of port scanning activities in the network; the encrypted communication anomaly index quantifies the abnormal behavior of encrypted communication traffic in the network.

[0023] The port scanning behavior index and encrypted communication anomaly index generated after analyzing the extracted key features are input into the pre-learned machine learning model, and the network security coefficient is generated by the machine learning model. The network security environment is intelligently evaluated through the network security coefficient.

[0024] Pre-learned machine learning models are models that have been fully trained with a large amount of historical data before deployment, and can intelligently evaluate input data features and generate accurate outputs. These models master the ability to identify network threats by learning the characteristic patterns of the network environment, especially the characteristic performance in high-risk and low-risk scenarios. During the training process, the model is provided with a training set containing various network environment data, such as key features such as port scanning frequency and abnormal encrypted communication behavior, as well as corresponding labels (such as "high risk" or "low risk"). Through multiple iterations of optimization, the model is able to extract effective feature relationships from the input data and learn how to map these features to accurate output results. For example, for the port scanning behavior index (PSBI) and the encrypted communication anomaly index (ECAI), the model can identify specific numerical change patterns and determine whether these changes reflect potential security threats.

[0025] The pre-training of this model also includes adjusting hyperparameters, selecting appropriate algorithms (such as random forests, neural networks, or support vector machines), and testing the generalization ability of the model to ensure that the model performs equally well on unknown data. The advantage of a pre-learned machine learning model is that it can quickly adapt to actual application scenarios by learning from historical data, and can efficiently evaluate input data without retraining during operation. For example, when the input PSBI and ECAI point to abnormal port scanning behavior and encrypted traffic in the network, the model can quickly generate a network security coefficient and give a risk assessment result for the network environment.

[0026] The significance of these pre-learned models is that they already have a certain decision-making ability and can accurately evaluate the network security status by analyzing the current network environment data. The intelligent evaluation function of these models greatly shortens the response time and improves the efficiency and adaptability of the security system. When the model receives input data such as PSBI and ECAI, it can quickly calculate the network security coefficient based on the characteristic patterns it has mastered during the training phase as a risk score for the current network environment. This evaluation method not only reduces the subjective error of human judgment, but also realizes real-time monitoring and dynamic decision-making through the efficient operation of the model, thereby significantly improving the network security protection capability and ensuring that targeted countermeasures can be made in a timely manner in a high-risk environment.

[0027] A surge in the frequency of port scans in a network is often a strong indicator that the network is under threat, especially in the context of a virus or ransomware attack. Port scanning is a common method used by attackers to find weaknesses and vulnerabilities that can be exploited in a network. In particular, malware often scans open ports to find potential targets for attack before infiltrating a network. Viruses and ransomware often attack by looking for vulnerable ports, such as open service ports, protocols with vulnerabilities, etc. Therefore, a surge in the frequency of port scans indicates that attackers may be actively looking for weak links in the system or network in order to further perform malicious actions, such as implanting malware, conducting denial of service attacks (DDoS), stealing sensitive data, or encrypting important files to demand ransom. Therefore, port scanning activities not only represent the activities of attackers, but also reflect potential security vulnerabilities in the network. Especially when the scanning frequency increases significantly, it usually means that the network environment is already at high risk and there is a serious threat of being invaded.

[0028] In the detection window, analyze the port scanning frequency in the network and generate the port scanning behavior index in the following specific steps: In the detection window, first collect the port scan events in the network, including all the sources that initiate the port scan. The address, target port, scan frequency, and scan time information can be obtained through traffic analyzers, IDS / IPS systems, etc., and after preliminary cleaning and filtering, the network traffic with non-scanning behavior is eliminated. The collected port scanning behavior data is used for analysis and modeling. The expression is as follows: , where Is the source address The total number of port scan events initiated, Is the port scan event at the time point The indicator function, if at time point If scanning occurs, it is 1, if not, it is 0. is the total duration of the detection window; after collecting port scanning events, the next step is to analyze the intensity of the scanning activity, that is, the intensity of the specific source within a certain period of time. The frequency of scanning the target port address. For this purpose, consider each source The total number of address scanning events within the time window is weighted by the number of scanned ports to reflect the intensity of the scan. The calculation expression is as follows: , where Is the source address The number of different ports scanned, It is an intensity adjustment factor used to enhance or weaken the effect of scanning frequency on the total intensity. Port scan intensity is used to measure the intensity and breadth of port scans in a network environment. Is the source participating in the scan The total number of addresses; This formula measures the The scanning density of the address enhances the behavior of frequent scanning and scanning multiple ports.

[0029] After calculating the port scan intensity, it is also necessary to identify the abnormality of the scan behavior and calculate the change rate of the scan intensity. Abnormal scan behavior usually manifests as a source The address scanning frequency suddenly increases, or the number of scanned ports far exceeds the normal range. The calculation expression is as follows: , where is the rate of change of the scan intensity, the rate of change Can reflect a dramatic change in scanning behavior, if a source The scanning intensity of the address suddenly increases, will increase significantly, indicating possible abnormal behavior. It's at the time Calculated port scan intensity, It's at the time (i.e. the previous moment) calculated port scan intensity; The port scan behavior index is generated by combining the port scan activity intensity and the rate of change of the scan intensity. The calculation expression is as follows: ,in, is the port scanning behavior index, Is the source address The scanning intensity, is the rate of change indicator function of the scanning intensity. When the rate of change exceeds the threshold When it is 1, it means there is abnormal behavior. It is the weighting coefficient of abnormal behavior on the final index, which is used to control the impact of abnormal behavior on the index.

[0030] In the detection window, the larger the port scan behavior index performance value generated after analyzing the port scan frequency in the network, the more frequent the port scan activity encountered by the network during the monitoring window, which usually indicates potential threats in the network environment, especially signs of viruses, ransomware or other malicious attacks. When attackers spread viruses or invade ransomware, they usually scan open ports to find targets that can be attacked. Therefore, the increase in the port scan behavior index reflects the increase in the frequency of port scans and abnormal activities in the network, which is usually direct evidence of the network being threatened or attacked. On the contrary, when the port scan behavior index is low, it means that there is less port scan activity in the network and no frequent abnormal behavior is shown, which usually means that the network environment is relatively safe and there are fewer attack activities.

[0031] The increase in potential abnormal behaviors in encrypted communications does indicate that the current network may be threatened, especially in high-risk environments where viruses, ransomware and other attack methods are active. When abnormal behaviors appear in encrypted communication traffic, it usually means some abnormal operations in the data transmission process, such as sudden increase in traffic, change in traffic pattern, use of abnormal encryption algorithms, or unauthorized access attempts, which may be the manifestation of malware (such as viruses or ransomware) trying to conceal its activities or steal data. For example, after encrypting files, ransomware may establish a connection with a remote server through an encrypted communication channel to transmit encrypted data or obtain instructions; while viruses may execute unauthorized commands or download malicious code by exploiting encryption protocols in the network. These abnormal behaviors may be due to malware trying to bypass firewalls and detection mechanisms through encrypted traffic to transmit data or remotely control, thereby concealing its attack traces. The increase in abnormal behaviors in encrypted communications means that there are hidden threat activities in the network, which usually indicates that the current network is in a high-risk state of being attacked and needs to take immediate response measures to strengthen monitoring and protection. Therefore, timely detection and identification of potential abnormal behaviors in encrypted communications is an important part of identifying and preventing network threats such as viruses and ransomware.

[0032] In the detection window, the specific steps for analyzing potential abnormal behaviors in encrypted communication and generating an encrypted communication anomaly index are as follows: In the detection window, we first extract multiple features from the encrypted communication traffic to capture abnormal behavior. Common features include sudden increases in encrypted traffic, connection request frequency, and changes in encryption algorithms. These features should be based on time domain and frequency domain analysis. By using high-precision data acquisition equipment and network monitoring tools, we can obtain encrypted communication data in real time and accurately capture changes in the behavior patterns of encrypted traffic, especially those that deviate significantly from normal communication patterns. The calculation expression is as follows: , where is the abnormality of encrypted communication traffic, i.e., the time point The abnormality of encrypted communication traffic at a certain moment is used to quantify the abnormality of encrypted communication traffic at a certain moment and help judge the security of the current network environment. It is Class encrypted communication traffic at time The observed value at time, It is The median of historical data of quasi-encrypted communication traffic. The median refers to the value in the middle after all data are sorted. It is usually used to measure the "typical" value of data to avoid being affected by extreme values ​​(such as abnormal traffic). It is Deviation function of encrypted communication traffic, used to measure the dispersion or fluctuation of traffic. It is The weighting coefficient of the encrypted communication traffic characteristics, is the total number of encrypted communication traffic categories; Using the extracted feature data, we can identify abnormal patterns in encrypted communications. For example, if there is a sudden increase in connection requests or irregular data packet distribution in the encrypted traffic, it may indicate that the network is under attack. This step is a key step in analyzing whether the traffic pattern is consistent with malicious behavior (such as virus or ransomware communication). We combine rule-based detection systems and machine learning methods to identify abnormal patterns in communication behavior. The calculation expression is as follows: , where Is the first The abnormal pattern indicators at time The observed value of is the normal behavior threshold of the pattern, is the tolerance coefficient for abnormal patterns, is the weighting coefficient, which is the weighting coefficient assigned to different abnormal modes. is the mode sensitivity index, which determines the degree of amplification of the index when it deviates from the normal mode value. is the abnormal pattern recognition index; After identifying the abnormal pattern in encrypted communication, the ratio of abnormal behavior in encrypted communication is calculated. This step can quantify the proportion of abnormal behavior relative to the total communication traffic. As an important indicator of the degree of abnormal encryption communication, by calculating the weighted ratio of abnormal traffic proportion and communication duration, it can accurately assess whether the current network is threatened and reflect whether malicious activities occupy a large proportion of communication resources. The calculation expression is as follows: , where Is an abnormal mark, referring to Encrypted communication traffic at a point in time Whether it is abnormal or not (if the traffic is abnormal, it is marked as 1, and if it is normal, it is marked as 0). is a small constant to avoid the denominator being zero, is the encrypted communication anomaly ratio; The encrypted communication anomaly ratio is used to measure the proportion of abnormal behavior or traffic in the total communication traffic in encrypted communications. The purpose of calculating the encrypted communication anomaly ratio is to identify and quantify abnormal patterns or security threats that may exist in the communication process, such as malware, virus propagation, ransomware attacks, etc. By monitoring and analyzing abnormal behaviors in encrypted communications, calculating the encrypted communication anomaly ratio can help security systems detect potential network attacks or system vulnerabilities in a timely manner. When the anomaly ratio exceeds the normal range, the system can trigger a security alert or automatically take protective measures to reduce potential network risks, thereby ensuring the confidentiality, integrity and reliability of data transmission.

[0033] Based on the abnormality of encrypted traffic , Abnormal Pattern Recognition Index and the encrypted communication anomaly ratio Generate the encrypted communication anomaly index, the calculation expression is as follows: , where is the encrypted communication anomaly index, Represents at a point in time Top, The degree of abnormality of encrypted communication traffic, It is used for Class encrypted communication traffic at a time point Whether there is an index of abnormal patterns, It is used to measure the Class encrypted communication traffic at a time point The proportion of abnormal traffic within.

[0034] In the detection window, the larger the encrypted communication anomaly index performance value generated after analyzing the potential abnormal behaviors in encrypted communication, the more potential abnormal behaviors there are in the network, which means that the network may be threatened by malware such as viruses and ransomware and is in a high-risk environment. This is because when malware attacks, it often uses encrypted communication protocols to conduct covert data transmission, remote control, or command issuance, resulting in abnormal communication patterns. For example, a sudden increase in traffic, unusual changes in encryption methods, frequent unauthorized connections, etc. may all be manifestations of attack activities. When the value of the encrypted communication anomaly index is high, it usually means that these abnormal behaviors frequently appear in the monitoring window, indicating that the network may have been infected or is under attack. Therefore, the larger the performance value of the index, the higher the security risk of the network. On the contrary, when the performance value of the encrypted communication anomaly index is low, it means that the network communication traffic is stable, there are few or no abnormal behaviors, and the network security is high and not threatened.

[0035] The machine learning model is not limited here, and can achieve the port scanning behavior index and encrypted communication anomaly index Conduct comprehensive analysis to generate network security coefficients The machine learning model can be used. In order to realize the technical solution of the present invention, the present invention provides a specific implementation method; Network security factor The generation formula is as follows: , where , Port Scan Behavior Index and encrypted communication anomaly index The preset scaling factor of , Both are greater than 0.

[0036] It can be seen from the network security coefficient that, under the detection window, the larger the port scanning behavior index performance value generated after analyzing the port scanning frequency in the network, and the larger the encrypted communication anomaly index performance value generated after analyzing the potential abnormal behavior in encrypted communication, the larger the network security coefficient performance value generated under the detection window, which indicates that the current network is in a high-risk environment. Conversely, it indicates that the current network security is relatively high.

[0037] Preset scale factor in the diagram and Is the port scanning behavior index and encrypted communication anomaly index Calculating the network security factor The role of these two coefficients is to adjust the contribution of the two indexes according to the importance of different features in the network environment. For example, if port scanning behavior has a greater impact on network security in a specific network scenario, you can set On the other hand, if encrypted communication anomalies are more likely to reflect potential security threats, you can set The presets of these ratio coefficients are usually based on historical data analysis and risk preferences of specific application scenarios. and The value of can more flexibly reflect the comprehensive impact of different characteristics on network security in a specific environment, thereby improving the accuracy and adaptability of model evaluation. The network environment classification module classifies the current network environment into high-risk network environment and low-risk network environment based on the evaluation results of the machine learning model; The generated network security coefficient is compared and analyzed with the preset network security coefficient reference threshold to classify the current network environment. The specific steps are as follows: If the network security factor is greater than or equal to a preset network security factor reference threshold, the current network environment is classified as a high-risk network environment; If the network security factor is less than the preset network security factor reference threshold, the current network environment is classified as a low-risk network environment; A high-risk network environment refers to a network status where there are potential security threats or abnormal behaviors in the current network; a low-risk network environment refers to a network status where the current network operation status is relatively normal and stable, without significant abnormal behaviors or security threats.

[0038] Low-risk network hash algorithm module: In a low-risk network environment, a fixed hash algorithm is continued to be used to ensure the independence and security of sessions while maintaining high performance and efficiency; In a low-risk network environment, the purpose of continuing to use a fixed hash algorithm is to maximize the performance and efficiency of the system while ensuring the security and independence of the session. In a low-risk environment, the network security threat is relatively small, and the fixed hash algorithm is sufficient to deal with potential attack risks, so there is no need for overly complex encryption processes or high-intensity computing burdens. By using this fixed hash algorithm in the handshake protocol, the system can maintain high processing efficiency and response speed while ensuring the security of data transmission. Doing so can not only reduce the consumption and latency of computing resources, but also reduce the complexity of the system, ensuring that the user's session process is smooth and interference-free in a stable network environment. Therefore, the system will flexibly select the appropriate hash algorithm based on the risk level of the current environment to ensure that it can provide sufficient security and ensure smooth and efficient session performance.

[0039] The high-risk network hash algorithm adjustment module will dynamically adjust the hash algorithm in a high-risk network environment and select a hash algorithm with higher encryption strength and anti-attack capabilities to enhance the security of the session.

[0040] In a high-risk network environment, the hash algorithm will be dynamically adjusted to select a hash algorithm with higher encryption strength and anti-attack capabilities to enhance the security of the session. The specific steps are as follows: By ensuring the network security factor Compared with the preset network security factor reference threshold Perform a comparison to determine whether the encryption strength needs to be adjusted, as follows: , when the network security factor Greater than or equal to the network security factor reference threshold When , it indicates that the network is in a high-risk environment, triggering the hash algorithm adjustment step; After confirming that the network environment is a high-risk network environment, the network security coefficient The value is used to select a hash algorithm with higher encryption strength and anti-attack ability. At this time, it is necessary to select a suitable high-strength hash algorithm from the algorithm library, such as an enhanced hash function, which has strong anti-collision ability and higher computational complexity. In order to dynamically adjust the hash algorithm, refer to the performance indicators of the hash algorithm (such as encryption strength, computational load, etc.), and combine the network security factor The value of determines which encryption level of the hash algorithm to switch to. The specific steps are as follows: , where The representative algorithm selection mechanism dynamically selects a hash algorithm with higher encryption strength based on the network security coefficient and algorithm performance indicators; According to the network security factor of the current network and performance indicators of different hash algorithms, dynamically select the hash algorithm that best suits the current network environment. Specifically, the network security coefficient Reflects the current network security status. If the network security coefficient Greater than or equal to the network security factor reference threshold , indicating that the network is in a high-risk environment and needs to select a hash algorithm with higher encryption strength to enhance security; if the network security factor Less than the network security factor reference threshold , we can choose an algorithm with lower computational complexity but higher performance to balance security and efficiency. The function in the formula It is a decision-making mechanism that combines network security status and algorithm performance to dynamically output the best option, thereby ensuring that the system can respond flexibly in different risk environments, ensuring both security and optimizing performance.

[0041] Algorithm performance indicators refer to the performance characteristics of the hash algorithm itself, including but not limited to encryption strength, computational complexity, collision resistance, and attack resistance. These indicators can help the system evaluate the effectiveness and efficiency of a hash algorithm in practical applications. For example, the stronger the algorithm's attack resistance, the more computing resources it usually requires.

[0042] When the network is in a high-risk state, the system will select a strong encryption algorithm, such as SHA-256 or a stronger hash algorithm, based on algorithm performance indicators, instead of using an algorithm with low computational complexity and easy to crack (such as SHA-1). Conversely, when the network is in a low-risk state (that is, the network environment is relatively safe), you can continue to use a relatively lightweight hash algorithm (such as SHA-1 or MD5) to maintain efficiency and performance.

[0043] After the hash algorithm is adjusted, the new hash algorithm will be applied in the handshake protocol phase. At this time, the new hash algorithm will be passed to both communicating parties to ensure that the subsequent data encryption and verification processes are processed based on high-intensity hash algorithms. Before the session starts, the default hash algorithm is replaced based on the security assessment results in a high-risk environment to ensure that the key exchange, identity authentication, and data integrity of the session are more secure. The formula is as follows: , where the new hash algorithm is the new hash algorithm selected in a high-risk network environment. The new hash algorithm is based on the network security factor of the current network The result of dynamic selection. The system evaluates the network security factor The value of determines whether the hash algorithm needs to be switched or adjusted. When the network is at high risk, the system will select a hash algorithm with higher encryption strength to enhance security. When it indicates that the network is more secure, a more efficient hash algorithm will be selected to optimize performance. The formula reflects the dynamic selection mechanism, ensuring that the hash algorithm can adapt to the real-time network security situation, thus taking into account both security and efficiency.

[0044] After the handshake protocol is generated and the hash algorithm is applied, the hash algorithm cannot be modified in real time because the hash algorithm has been determined when the session is established and used in the subsequent communication process. In order to ensure the long-term security of network communications, real-time monitoring will be carried out continuously throughout the life cycle of the session, and potential threats will be dynamically evaluated. Specifically, the system will regularly monitor the network security coefficient and compared with the preset network security factor reference threshold Compare to determine whether the current network status still meets the initial assessment criteria. If the network security factor is If the rate continues to rise, it means that a new threat has emerged in the network environment. The feedback mechanism will be activated to notify the administrator to manually intervene and adjust the system to select a stronger hash algorithm for the next session establishment. The formula for this process is as follows: Even if the hash algorithm cannot be changed in the current session, the network environment can still be monitored to ensure that when a major security risk occurs, the next session can be adjusted in time, so that a high encryption level algorithm can be selected in future sessions to protect the confidentiality and integrity of the data.

[0045] The present invention uses a machine learning model to intelligently evaluate the network environment, and the system can identify high-risk network environments in real time. In a high-risk environment (such as when security threats such as viruses and ransomware are active), the system will dynamically adjust the hash algorithm according to the evaluation results and select an algorithm with higher encryption strength and anti-attack capability. This mechanism significantly enhances the encryption strength and the ability to resist potential attacks during the communication process. For example, when port scanning is frequent in the network or abnormal behavior occurs in encrypted communication, the machine learning model can generate a corresponding safety factor and trigger the upgrade of the hash algorithm in time, using a more complex and more secure hash algorithm for session encryption. This dynamic hash algorithm adjustment can not only effectively prevent the vulnerabilities of known algorithms from being exploited, but also ensure the confidentiality and integrity of data transmission through flexible encryption algorithm selection when facing emerging attack methods. With the real-time changes in the network environment, the system can respond quickly and adopt appropriate encryption strategies to avoid the potential risks brought by traditional fixed hash algorithms.

[0046] The present invention can more accurately detect potential security threats through intelligent evaluation of the network environment by machine learning model, and divide the network environment into high risk or low risk according to the network security coefficient. This intelligent evaluation can help the system to perform more refined security protection in a dynamically changing network environment. In a low-risk network environment, continuing to use a fixed hash algorithm can maintain high performance and efficiency, avoiding unnecessary waste of resources and performance degradation. In a high-risk network environment, based on real-time security evaluation, the system can detect anomalies in time and respond quickly, and select a stronger encryption algorithm, thereby effectively responding to new threats such as viruses and ransomware. In this way, the system not only improves the overall security protection capability, but also optimizes the use of system resources, avoids performance degradation caused by excessive encryption, and ensures the balance between the efficiency and security of network transmission.

[0047] The above description is only by way of illustration of certain exemplary embodiments of the present invention. It is undoubted that those skilled in the art can modify the described embodiments in various ways without departing from the spirit and scope of the present invention. Therefore, the above drawings and descriptions are illustrative in nature and should not be construed as limiting the scope of protection of the claims of the present invention.

Claims

1. A secure encryption transmission system for game data, characterized in that: It includes network environment data collection module, network risk feature extraction module, feature analysis and machine learning evaluation module, network environment classification module, low-risk network hash algorithm module and high-risk network hash algorithm adjustment module: The network environment data collection module comprehensively collects various parameter information of the current network environment before the handshake protocol starts; The network risk feature extraction module collects network environment parameters and systematically organizes and stores them to form a structured analysis set, from which key features reflecting that the network environment is in a high-risk state are extracted; The feature analysis and machine learning evaluation module conducts in-depth analysis of the extracted key features within the detection window and inputs the analyzed key features into the pre-trained machine learning model for intelligent evaluation; The network environment classification module classifies the current network environment into high-risk network environment and low-risk network environment based on the evaluation results of the machine learning model; Low-risk network hash algorithm module: In a low-risk network environment, a fixed hash algorithm is continued to be used to ensure the independence and security of sessions while maintaining high performance and efficiency; The high-risk network hash algorithm adjustment module will dynamically adjust the hash algorithm in a high-risk network environment and select a hash algorithm with higher encryption strength and anti-attack capabilities to enhance the security of the session.

2. A secure encrypted transmission system for game data according to claim 1, characterized in that: Key features that reflect that the network environment is in a high-risk state are extracted from the analysis set. The extracted features include the frequency of port scanning in the network and potential abnormal behaviors in encrypted communications. Under the detection window, the extracted key features are analyzed to generate a port scanning behavior index and an encrypted communication anomaly index respectively. The port scanning behavior index quantifies the frequency and abnormality of port scanning activities in the network; the encrypted communication anomaly index quantifies the abnormal behavior of encrypted communication traffic in the network.

3. A secure encrypted transmission system for game data according to claim 2, characterized in that: The port scanning behavior index and encrypted communication anomaly index generated after analyzing the extracted key features are input into the pre-learned machine learning model, and the network security coefficient is generated by the machine learning model. The network security environment is intelligently evaluated through the network security coefficient.

4. A secure encrypted transmission system for game data according to claim 3, characterized in that: The generated network security coefficient is compared and analyzed with the preset network security coefficient reference threshold to classify the current network environment. The specific steps are as follows: If the network security factor is greater than or equal to a preset network security factor reference threshold, the current network environment is classified as a high-risk network environment; If the network security factor is less than a preset network security factor reference threshold, the current network environment is classified as a low-risk network environment.

5. A secure encrypted transmission system for game data according to claim 1, characterized in that: In a high-risk network environment, the hash algorithm will be dynamically adjusted to select a hash algorithm with higher encryption strength and anti-attack capabilities to enhance the security of the session. The specific steps are as follows: By ensuring the network security factor Compared with the preset network security factor reference threshold Perform a comparison to determine whether the encryption strength needs to be adjusted, as follows: , when the network security factor Greater than or equal to the network security factor reference threshold When , it indicates that the network is in a high-risk environment, triggering the hash algorithm adjustment step; After confirming that the network environment is a high-risk network environment, the network security coefficient The value is used to select a hash algorithm with higher encryption strength and anti-attack ability. At this time, it is necessary to select a suitable high-strength hash algorithm from the algorithm library. In order to dynamically adjust the hash algorithm, refer to the performance indicators of the hash algorithm and combine it with the network security coefficient The value of determines which encryption level of the hash algorithm to switch to. The specific steps are as follows: , where The representative algorithm selection mechanism dynamically selects a hash algorithm with higher encryption strength based on the network security coefficient and algorithm performance indicators; After the hash algorithm is adjusted, the new hash algorithm will be applied in the handshake protocol phase. At this time, the new hash algorithm will be passed to both communicating parties to ensure that the subsequent data encryption and verification processes are processed based on high-intensity hash algorithms. Before the session starts, the default hash algorithm is replaced based on the security assessment results in a high-risk environment to ensure that the key exchange, identity authentication, and data integrity of the session are more secure. The formula is as follows: , where the new hash algorithm is the new hash algorithm selected in a high-risk network environment. After the handshake protocol is generated and the hash algorithm is applied, the hash algorithm cannot be modified in real time. In order to ensure the long-term security of network communications, real-time monitoring will be continuously performed throughout the life cycle of the session, and potential threats will be dynamically evaluated. If during the session, the network security coefficient If the rate continues to rise, it means that a new threat has emerged in the network environment. The feedback mechanism will be activated to notify the administrator to manually intervene and adjust the system to select a stronger hash algorithm for the next session establishment. The formula for this process is as follows: Even if the hash algorithm cannot be changed in the current session, the network environment can still be monitored to ensure that when a major security risk occurs, the next session can be adjusted in time, so that a high encryption level algorithm can be selected in future sessions to protect the confidentiality and integrity of the data.

6. A secure encrypted transmission system for game data according to claim 2, characterized in that: In the detection window, analyze the port scanning frequency in the network and generate the port scanning behavior index in the following specific steps: In the detection window, first, collect the port scanning events in the network. The collected port scanning behavior data is used for analysis and modeling. The expression is as follows: , where Is the source address The total number of port scan events initiated, Is the port scan event at the time point The indicator function, is the total duration of the detection window; After collecting port scan events, the next step is to analyze the intensity of the scan activity. To do this, consider each source The total number of address scanning events within the time window is weighted by the number of scanned ports to reflect the intensity of the scan. The calculation expression is as follows: , where Is the source address The number of different ports scanned, is an intensity adjustment factor, is the port scan intensity, Is the source participating in the scan The total number of addresses; After calculating the port scan intensity, it is also necessary to identify the abnormality of the scan behavior and calculate the rate of change of the scan intensity. The calculation expression is as follows: , where is the rate of change of the scan intensity, It's at the time Calculated port scan intensity, It's at the time Calculated port scan intensity; The port scan behavior index is generated by combining the port scan activity intensity and the rate of change of the scan intensity. The calculation expression is as follows: ,in, is the port scanning behavior index, Is the source address The scanning intensity, is the rate-of-change indicator function of the scan intensity, is the weighting factor of abnormal behavior on the final index.

7. A secure encrypted transmission system for game data according to claim 2, characterized in that: In the detection window, the specific steps for analyzing potential abnormal behaviors in encrypted communication and generating an encrypted communication anomaly index are as follows: In the detection window, we first extract multiple features from the encrypted communication traffic to capture abnormal behavior. By acquiring encrypted communication data in real time, we can accurately capture the behavior pattern changes of encrypted traffic. The calculation expression is as follows: , where is the abnormality of encrypted communication traffic, i.e., the time point The abnormality of encrypted communication traffic at the time It is Class encrypted communication traffic at time The observed value at time, It is The historical data median of encrypted communication traffic, It is Deviation function of encrypted communication traffic, It is The weighting coefficient of the encrypted communication traffic characteristics, is the total number of encrypted communication traffic categories; Using the extracted feature data, we can identify the abnormal patterns of encrypted communications. By combining the rule-based detection system and machine learning methods, we can identify abnormal patterns in communication behaviors. The calculation expression is as follows: , where Is the first The abnormal pattern indicators at time The observed value of is the normal behavior threshold of the pattern, is the tolerance coefficient for abnormal patterns, is the weighting coefficient, is the mode sensitivity index, is the abnormal pattern recognition index; After identifying abnormal patterns in encrypted communications, the ratio of abnormal behaviors in encrypted communications is calculated. By calculating the weighted ratio of abnormal traffic proportion and communication duration, it is possible to accurately assess whether the current network is threatened. The calculation expression is as follows: , where is an abnormal mark, is a small constant to avoid the denominator being zero, is the encrypted communication anomaly ratio; Based on the abnormality of encrypted traffic , Abnormal Pattern Recognition Index and the encrypted communication anomaly ratio Generate the encrypted communication anomaly index, the calculation expression is as follows: , where is the encrypted communication anomaly index, Represents at a point in time Top, The degree of abnormality of encrypted communication traffic, It is used for Class encrypted communication traffic at a time point Whether there is an index of abnormal patterns, It is used to measure the Class encrypted communication traffic at a time point The proportion of abnormal traffic within.

Images