A method and system for identifying encrypted data stream

Abstract

The present invention relates to the technical field of encrypted data identification, and in particular to a method and system for identifying encrypted data streams. The method comprises the following steps: obtaining an encrypted data stream set; performing data preprocessing on the encrypted data stream set to generate an encrypted data stream preprocessing data set; performing data stream feature refinement extraction on the encrypted data stream preprocessing data set to generate an encrypted data stream refinement feature set; performing pattern encryption algorithm learning based on the encrypted data stream refinement feature set to generate an encrypted data stream identification model; therefore, the present invention solves the problems of insufficient processing accuracy and limited identification capability in traditional encrypted data stream identification through multi-level means such as refinement feature extraction, model optimization and accuracy evaluation, and improves the identification accuracy and robustness of complex encryption patterns.

Description

Technical Field

[0001] The present invention relates to the technical field of encrypted data identification, and in particular to a method and system for identifying encrypted data streams. Background Art

[0002] Existing methods rely on static feature extraction, such as traffic size and packet header information, but this approach cannot cope with the variability of encrypted data streams, especially when faced with complex encryption algorithms and hybrid protocols, the recognition accuracy is often low. In addition, many traditional technologies rely on manually designed rules and lack the ability to cope with new encryption technologies and unknown attacks, resulting in poor performance when faced with emerging encryption protocols. Secondly, existing technologies are weak in processing high-dimensional data and time series data. Many important features in encrypted data streams can only be reflected in high-dimensional space, and existing dimensionality reduction methods may lose key information, affecting the recognition effect. At the same time, for encrypted traffic with complex time series features, traditional methods cannot effectively capture long-term trends and dependencies, resulting in insufficient recognition capabilities. Finally, existing technologies are lacking in visual analysis. The results of traditional recognition methods are usually abstract and lack intuitive display, making it difficult for users to quickly understand and analyze the recognition results. In addition, existing methods have poor flexibility and scalability, and cannot be personalized and optimized according to actual needs. Summary of the invention

[0003] Based on this, it is necessary to provide a method and system for identifying encrypted data streams to solve at least one of the above technical problems.

[0004] To achieve the above object, a method for identifying an encrypted data stream comprises the following steps: Step S1: obtaining an encrypted data stream set; performing data preprocessing on the encrypted data stream set to generate an encrypted data stream preprocessing data set; Step S2: extracting data stream features from the encrypted data stream preprocessing data set to generate an encrypted data stream refinement feature set; learning a pattern encryption algorithm based on the encrypted data stream refinement feature set to generate an encrypted data stream recognition model; Step S3: Perform implicit pattern and pseudo-randomness recognition on the encrypted data flow recognition model to generate an encrypted data flow recognition result; based on the encrypted data flow recognition result, update the recognition parameters of the encrypted data flow recognition model to complete the construction of the encrypted data flow recognition model; Step S4: Evaluate the recognition accuracy based on the encrypted data stream recognition model and generate an encrypted data stream recognition accuracy report.

[0005] The beneficial effect of the present invention is that the steps of obtaining an encrypted data stream set and performing preprocessing effectively eliminate the noise and redundant information in the original data, and provide a cleaner and more standardized data basis for subsequent feature extraction. The preprocessing stage significantly improves the quality of the data set by removing irrelevant information and filling missing data, ensuring the reliability of subsequent analysis. In the data stream feature refinement and extraction stage, a refined feature set of the encrypted data stream is generated according to the extraction method of refined features. This process is to more accurately capture the potential information in the data by carefully analyzing various features of the data stream, such as temporal, pattern features, and the internal regularity of encrypted data. The optimization of this stage not only improves the model's recognition ability for encrypted data, but also effectively reduces feature redundancy, reduces the amount of calculation and model training time, and lays a solid foundation for further algorithm learning. Based on the process of learning the pattern encryption algorithm based on the refined feature set, an encrypted data stream recognition model is generated through in-depth learning of the feature set. The model has strong adaptability and recognition ability, and can effectively identify different encryption methods and encryption strengths. The implicit pattern and pseudo-randomness recognition stage further enhances the model's understanding of the inherent structure of the encrypted data stream, and improves its recognition accuracy and flexibility for irregular encryption patterns. In the recognition accuracy evaluation stage, a comprehensive evaluation is performed on the generated encrypted data stream recognition model to obtain accurate recognition results and generate a detailed accuracy report. This process ensures the reliability and stability of the model in real applications, and can efficiently and accurately complete the recognition task of the encrypted data stream, thereby ensuring the security and efficiency of data processing in practical applications. Therefore, the present invention solves the problems of insufficient processing accuracy and limited recognition ability in traditional encrypted data stream recognition by refining feature extraction, model optimization, and accuracy evaluation and other multi-level means, and improves the recognition accuracy and robustness of complex encryption patterns.

[0006] Preferably, step S1 comprises the following steps: Step S11: Obtain an encrypted data stream set; Step S12: performing stream encryption-group encryption hybrid classification on the encrypted data stream set to generate encrypted data stream classification data; Step S13: preprocess the encrypted data stream classification data to generate an encrypted data stream preprocessing data set.

[0007] The present invention ensures the integrity and diversity of the source of data by obtaining the encrypted data stream set as the first step, which is crucial for the subsequent processing links. The diversity and scale of the encrypted data stream set provide sufficient data support for subsequent classification and feature extraction, ensuring that the model can cope with various encryption methods and complex environments. In the process of mixed classification of stream encryption and group encryption, an advanced encryption algorithm classification method is adopted, and encrypted data stream classification data is generated by performing encryption-group encryption mixed classification on the encrypted data stream set. The beneficial effect of this step is that it enables the data stream to be reasonably grouped according to its different encryption methods, thereby providing structured data support for subsequent encryption mode recognition and algorithm selection. By classifying the encryption methods in the encrypted data stream set, the complexity caused by the mixing of different encryption methods can be effectively reduced, the interference in the model training and recognition process can be reduced, and the accuracy and training efficiency of classification can be improved. In addition, this classification method provides a more targeted input data set for data analysis, so that the model can focus on the details of the encryption mode during recognition, and improves the recognition accuracy of encrypted data. Next, when the encrypted data stream classification data is preprocessed, an encrypted data stream preprocessing data set is generated. Through data preprocessing, noise, redundant information and missing values ​​in the original data can be effectively cleaned up, and the standardization and consistency of the data can be ensured. This process is crucial for subsequent feature extraction and model learning, and can provide a more accurate and reliable data foundation for subsequent steps. Data preprocessing not only improves the quality of the data, but also lays a solid foundation for subsequent algorithm training and encryption pattern recognition, further improving the processing efficiency and accuracy of the overall system.

[0008] Preferably, step S13 comprises the following steps: Step S131: extracting the header timestamp information of the encrypted data stream classification data to generate the encrypted data stream header timestamp data; drawing the encrypted data stream header timestamp data as a time series icon to generate an encrypted data header timestamp two-dimensional graph; setting the unit cycle threshold value of the encrypted data header timestamp two-dimensional graph to generate the encrypted data header cycle threshold value; Step S132: segmenting the encrypted data stream classification data into unit periods based on the encrypted data header period threshold to generate encrypted data stream time series segmented data; Step S133: extracting the head and tail identifiers from the encrypted data stream classification data to generate encrypted data stream head and tail identifier extraction data; performing tail encryption signature verification on the encrypted data stream head and tail identifier extraction data using a preset encryption format character to generate encrypted data stream content mode division data; Step S134: Pack the encrypted data stream time series segmentation data and the encrypted data stream content mode division data into data sets, and pre-process the encrypted data stream data set.

[0009] The present invention extracts the header timestamp information of the encrypted data stream classification data and generates the header timestamp data of the encrypted data stream. This process can extract the timing information in the encrypted data stream, laying the foundation for the subsequent time series analysis. The extraction of the header timestamp data not only helps to capture the generation timing of the data packet, but also provides key time features for the subsequent periodic analysis and data flow behavior modeling. Further, by drawing the time series icon of the header timestamp data and generating a two-dimensional graph of the encrypted data header timestamp, support is provided for the visualization of the time series law, thereby making the periodic analysis more intuitive and easy to understand. When the unit cycle threshold is set for the encrypted data header timestamp two-dimensional graph, the periodic features in the data stream can be accurately identified, and a scientific and reasonable threshold is set for the subsequent unit cycle segmentation. This operation not only improves the accuracy of data segmentation, but also makes the time series division of the encrypted data stream more in line with its actual law through the optimized periodicity recognition algorithm, avoiding the misprocessing of irregular data streams, thereby effectively improving the efficiency and effect of subsequent analysis. Based on these periodic thresholds, the encrypted data stream classification data is segmented into unit periods to generate encrypted data stream time series segmentation data, making the data more operational and analytically valuable in terms of timing, and facilitating the subsequent decryption and pattern recognition of the encrypted data stream. By extracting the head and tail identifiers from the encrypted data stream classification data, the encrypted data stream head and tail identifier extraction data is generated, and the tail encryption signature of the encrypted data stream is verified through the preset encryption format symbol to generate the encrypted data stream content pattern division data. This step effectively distinguishes valid information from irrelevant information in the encrypted data stream, and performs pattern verification on the data through the preset standards of the encryption format symbol, ensuring the integrity and validity of the data in subsequent analysis. Finally, the encrypted data stream time series segmentation data and the encrypted data stream content pattern division data are packaged to generate an encrypted data stream preprocessing data set. This data set integrates the timing characteristics and pattern characteristics of the encrypted data stream, providing high-quality, structured data support for subsequent encrypted data recognition and decryption tasks.

[0010] Preferably, step S2 comprises the following steps: Step S21: extracting data stream features from the encrypted data stream preprocessing data set to generate an encrypted data stream refinement feature set; Step S22: performing dimensionality reduction processing on high-dimensional data according to the encrypted data stream refinement feature set to generate encrypted data stream dimensionality reduction data; Step S23: Perform pattern encryption algorithm learning based on the encrypted data stream dimensionality reduction data to generate an encrypted data stream recognition model.

[0011] The present invention generates a refined feature set of encrypted data stream by refining and extracting data stream features from a preprocessed data set of encrypted data stream. The main function of this process is to extract more discernible and representative features from the original encrypted data, and these features can better reflect the internal laws and encryption patterns of the encrypted data stream. By refining and extracting the features, redundant information and noise are eliminated, the expressiveness of key features is enhanced, and subsequent pattern recognition is more efficient and accurate. At the same time, the process of feature refinement also helps to improve the interpretability and reliability of the model, because by accurately extracting the key features in the data stream, the structure of the encrypted data can be more clearly identified and understood. By performing high-dimensional data dimensionality reduction processing on the refined feature set of encrypted data stream, reduced-dimensional data of encrypted data stream is generated. In practical applications, data sets often contain a large number of features. Although these features have certain correlations in theory, they will cause high-dimensional disaster problems in the actual model training process, which increases the computational complexity and affects the training speed and performance of the model. Dimensionality reduction processing can effectively reduce the amount of calculation and improve the efficiency of data processing by selecting the most representative features and compressing the dimensions of the data. In addition, the reduced-dimensional data avoids interference from irrelevant features while ensuring information integrity, providing a more streamlined and efficient data input for the subsequent learning process. The encrypted data stream recognition model is generated by learning the pattern encryption algorithm on the reduced-dimensional data of the encrypted data stream. The reduced-dimensional data set has a higher training efficiency, making the pattern learning process more accurate and faster. The learning at this stage not only enables the pattern of the encrypted data stream to be accurately identified, but also optimizes the model by continuously adjusting parameters to improve its adaptability to unknown data streams. This pattern learning process optimized by dimensionality reduction can quickly extract effective information from the encrypted data stream, improve the accuracy and robustness of the recognition model, avoid problems such as overfitting, and enhance the generalization ability of the model.

[0012] Preferably, step S21 includes the following steps: Step S211: acquiring standard encryption mode data; performing data stream transmission speed statistics on the encrypted data stream preprocessing data set to generate encrypted data stream transmission speed data; performing non-random information entropy structure analysis on the encrypted data stream transmission speed data to generate encrypted data stream information entropy structure data; Step S212: periodically analyzing and processing the encrypted data stream information entropy structure data, and comparing it with the standard encryption mode data to generate encrypted data stream feature data; Step S213: Perform wavelet transform on the encrypted data stream feature data to extract high-frequency signal patterns and generate a refined feature set for the encrypted data stream.

[0013] The present invention generates encrypted data stream transmission speed data by acquiring standard encryption mode data and performing data stream transmission speed statistics on encrypted data stream preprocessing data sets. The core of this process is that by measuring and counting the encrypted data stream transmission speed, the time delay and bandwidth usage of the encrypted data stream during the transmission process can be revealed. These characteristics provide key timing and performance data for subsequent analysis. In particular, as the external manifestation of the encrypted data stream, the data stream transmission speed can reflect the performance characteristics of the encryption method under different network conditions, and is an important reference information for decryption and identification of encryption modes. The encrypted data stream transmission speed data is subjected to non-random information entropy structure analysis to generate encrypted data stream information entropy structure data. Information entropy, as an indicator for measuring the randomness and complexity of data, can reveal the regularity or disorder of information distribution in the encrypted data stream. In the encrypted data stream, the change of entropy structure can reflect the encryption strength and complexity of data under different encryption modes. By analyzing the entropy structure of the encrypted data stream transmission speed data, the characteristics of the encryption algorithm in a specific transmission environment can be effectively captured, thereby providing more abundant structural information for subsequent pattern recognition. The generation of entropy structure data effectively reduces the interference of irrelevant information in the processing process, laying a solid foundation for further pattern recognition. The information entropy structure data of the encrypted data stream is periodically analyzed and processed, and compared with the standard encryption mode data to generate encrypted data stream feature data. Periodic analysis can reveal potential repetitive patterns or regular behaviors in the encrypted data stream. These periodic features help identify the type and parameter configuration of the encryption algorithm. By comparing with the standard encryption mode data, it is possible to distinguish between different encryption modes and extract significant features in the encrypted data stream to ensure accurate identification and classification of the encrypted data stream. In this process, by comparing the standard mode data, the feature extraction accuracy of the encrypted data stream is further improved, so that the model can better adapt to various encryption modes and external environment changes. By performing wavelet transform on the encrypted data stream feature data to extract high-frequency signal patterns, a refined feature set of the encrypted data stream is generated. As an effective signal processing technology, wavelet transform can perform detailed analysis on the encrypted data stream from the perspective of multi-scale and multi-frequency, extract high-frequency signal patterns, and further refine and optimize feature data. The beneficial effect of this process is that wavelet transform can effectively capture the rapidly changing patterns in the encrypted data stream, which is critical for accurately identifying complex encryption modes and algorithms. The refined feature set generated by extracting high-frequency signal patterns not only provides accurate input data for subsequent encrypted data flow analysis, but also improves the model's adaptability and recognition ability to different encryption modes.

[0014] Preferably, step S23 includes the following steps: Step S231: Performing graph neural network training on the dimensionality reduction data of the encrypted data stream to generate encrypted data stream feature training data; performing recursive neural network training on the dimensionality reduction data of the encrypted data stream to generate encrypted data stream timing analysis training data; Step S232: using the encrypted data stream feature training data and the encrypted data stream timing analysis training data as inputs to a preset multi-level neural network model to perform protocol identification multi-scale encryption learning, and generate a preliminary encrypted data stream identification model; Step S233: Iterate the long-term trend convolution processing of the preliminary encrypted data flow recognition model to generate an encrypted data flow recognition model.

[0015] The present invention generates encrypted data stream feature training data by training the encrypted data stream dimension reduction data with a graph neural network. The graph neural network (GNN) can capture the complex dependencies between nodes in the graph structure data, and the data after the encrypted data stream dimension reduction can be used as the node feature input of the graph, so that the graph neural network can effectively learn the implicit structural information in the encrypted data stream. This process helps to extract the multi-dimensional and nonlinear characteristics of the encrypted data stream, provides more detailed and rich training data, and can more accurately identify important patterns in the encrypted stream. Subsequently, the encrypted data stream dimension reduction data is input into the recurrent neural network (RNN) for training to generate encrypted data stream timing analysis training data. The recurrent neural network can capture the time series characteristics in the encrypted data stream, especially when the encrypted data stream has time-varying and periodic changes, the timing modeling ability of the RNN is crucial. In this way, the changing trend and dynamic characteristics of the encrypted data stream in the time dimension can be better simulated, thereby enhancing the modeling ability of the model for long-term dependencies. The encrypted data stream feature training data and the encrypted data stream timing analysis training data are used as inputs to a preset multi-level neural network model for protocol identification multi-scale encryption learning to generate a preliminary encrypted data stream identification model. Multi-level neural networks can extract different scale features of data at different levels. This multi-scale learning method is particularly suitable for encrypted data streams because it contains rich information from local features to global features. By combining multiple learning of temporal features and structural features, the encryption protocol features of encrypted data streams can be captured more accurately, providing powerful expression capabilities for the recognition model. At the same time, this multi-scale learning method can handle the complexity of different encryption protocols, effectively enhancing the generalization ability of the model, so that it can adapt to different encryption modes and algorithms. The preliminary encrypted data stream recognition model is iterated by long-term trend convolution processing to generate the final encrypted data stream recognition model. The long-term trend convolution processing can better capture the long-term change characteristics in the encrypted stream by iteratively updating the long-term trend in the encrypted data stream, and continuously optimize the model parameters through iteration to ensure that the model can adapt to the long-term trend changes brought about by different encryption strategies. This process not only enhances the model's ability to recognize long-term dependencies, but also ensures the stability and accuracy of the recognition results, avoiding the deviation of short-term patterns.

[0016] Preferably, step S3 comprises the following steps: Step S31: performing implicit pattern and pseudo-randomness recognition on the encrypted data stream recognition model to generate an encrypted data stream recognition result; Step S32: Adaptively update the encrypted data flow identification result to generate an adaptive hybrid protocol identification result; update the identification parameters of the encrypted data flow identification model based on the adaptive hybrid protocol identification result, thereby completing the construction of the encrypted data flow identification model and the adaptive traffic identification strategy; Step S33: Based on the adaptive hybrid protocol recognition result, the recognition parameters of the encrypted data flow recognition model are updated, thereby completing the construction of the encrypted data flow recognition model and the adaptive traffic recognition strategy.

[0017] The present invention generates an encrypted data stream recognition result by performing implicit pattern and pseudo-randomness recognition on an encrypted data stream recognition model. Implicit pattern recognition aims to capture potential non-explicit features and regularities in an encrypted data stream, which are not directly manifested but are effective encryption recognition information. Pseudo-randomness recognition can analyze pseudo-random characteristics in an encrypted data stream, which plays an important role in identifying pseudo-encrypted or weakly encrypted data streams. By analyzing and identifying these complex patterns, the recognition accuracy of encrypted data streams can be greatly improved, ensuring that different encryption modes can be effectively distinguished under various encryption environments. In addition, implicit pattern and pseudo-randomness recognition not only optimizes the feature extraction process of data streams, but also enables the model to recognize and adapt to new encryption technologies and encryption methods. By performing adaptive traffic update on the encrypted data stream recognition result, an adaptive hybrid protocol recognition result is generated. Adaptive traffic update can adjust the recognition strategy of the model according to the dynamic changes of the encrypted data stream, thereby adapting to the constantly changing encryption protocol and network environment. Through this adaptive mechanism, the model can adjust its recognition strategy in real time to avoid performance degradation when the encryption protocol changes. This process ensures the flexibility and reliability of encrypted data flow identification, especially in complex network environments where different traffic patterns change frequently. Traditional static identification models are often difficult to adapt to, while the adaptive update mechanism effectively improves the robustness and practicality of the system. In this process, the model parameters are continuously updated based on the identification results, so that the identification model can more accurately capture the characteristics of encrypted data flows, especially the ability to respond quickly to changes in traffic patterns has been significantly improved. Through the dynamic optimization of model parameters, it is ensured that the encrypted data flow identification model can always maintain efficient identification capabilities when facing different encryption protocols and attack methods. By updating the parameters of the identification model again based on the adaptive hybrid protocol identification results, the encrypted data flow identification model and traffic identification strategy can be further improved. Through multiple iterations of parameter updates, the accuracy of the model can be further improved, and the adaptability to unknown encryption protocols or changing traffic patterns can be enhanced, ensuring that the model continues to play a role in complex encryption environments.

[0018] Preferably, performing implicit pattern and pseudo-randomness identification on the encrypted data stream identification model comprises the following steps: Constructing the parameters of the pseudo-random number generator according to the encrypted data stream identification model to generate the encrypted data stream pseudo-random number generator; Dynamic entropy value monitoring is performed according to the encrypted data stream pseudo-random number generator to generate a pseudo-random dynamic entropy value for the encrypted data stream; Perform pseudo-randomness detection according to the pseudo-random dynamic entropy value of the encrypted data stream to generate a pseudo-randomness detection result of the encrypted data stream; Perform homomorphic encryption feature recognition according to the encrypted data stream recognition model to generate homomorphic encryption feature recognition data; Perform homomorphic computing based on homomorphic encryption feature recognition data to generate encrypted data stream homomorphic computing data; According to the encrypted data stream and the square calculation data, the implicit pattern is refined to generate the encrypted data stream implicit data; The encrypted data stream pseudo-randomness detection result and the encrypted data stream implicit data are compared and superimposed on each other to generate the encrypted data stream identification result.

[0019] The present invention can provide a high-quality random number generation method for encrypted data streams by constructing parameters of a pseudo-random number generator according to an encrypted data stream identification model to generate an encrypted data stream pseudo-random number generator. The pseudo-random number generator is not only a core component of an encryption algorithm, but also the random numbers generated by it are crucial to the security of the encrypted stream. By accurately constructing the parameters of the pseudo-random number generator, the randomness and unpredictability of the encrypted data stream can be ensured, thereby providing a stable random number basis for subsequent encrypted stream analysis. Dynamic entropy value monitoring is performed based on the generated pseudo-random number generator to generate a pseudo-random dynamic entropy value of the encrypted data stream. In this process, the entropy value, as an indicator for measuring the randomness and complexity of information, can effectively reflect the entropy value change in the encrypted data stream. By monitoring the dynamic entropy value, the potential regularity and deviation in the encrypted data stream can be identified in time, thereby revealing the security loopholes of the encryption protocol. This process not only helps to improve the accuracy of data stream identification, but also can continuously maintain efficient identification capabilities in long-term data stream changes. In the pseudo-randomness detection link, pseudo-randomness detection is performed based on the pseudo-random dynamic entropy value of the encrypted data stream to generate a pseudo-randomness detection result of the encrypted data stream. Through the systematic detection of pseudo-randomness, it is possible to accurately determine whether the encrypted data stream meets the ideal pseudo-randomness characteristics. This step is particularly important for identifying weakly encrypted or pseudo-encrypted data streams, which helps to discover potential anomalies in the data stream and accelerate the identification of different encryption strategies. Relying on the encrypted data stream identification model, homomorphic encryption feature identification data is generated, and encrypted data stream homomorphic computing data is generated through homomorphic computing. Through homomorphic encryption feature identification, homomorphic encryption information in the encrypted data stream can be effectively extracted, thereby providing more technical support for subsequent encrypted stream analysis. The homomorphic computing technology ensures that the encrypted data stream is effectively calculated under the premise of privacy protection, making data analysis and processing safer and more efficient. According to the encrypted data stream homomorphic computing data, the implicit pattern is refined to generate the encrypted data stream implicit data. This process deeply mines the implicit patterns in the encrypted data stream and extracts the deep-level features that are not visible in the data stream, thereby providing a more comprehensive analysis perspective for the encrypted data stream. Through this refinement, the potential laws in the encrypted data stream can be captured more accurately, improving the accuracy of identification. Finally, the encrypted data stream pseudo-randomness detection results and the encrypted data stream implicit data are compared and superimposed on the external behavior to generate the encrypted data stream identification results. By combining the pseudo-randomness detection results with the implicit data and comparing and superimposing the external behavior, the comprehensive effect of encrypted data stream identification can be further improved. This process integrates multiple levels of features and comprehensively considers the characteristics of different types of encrypted data streams, thereby greatly improving the accuracy and reliability of identification.

[0020] Preferably, step S4 comprises the following steps: Step S41: performing recognition accuracy evaluation based on the encrypted data flow recognition model to generate an encrypted data flow recognition evaluation result; Step S42: Perform visual analysis on the encrypted data flow identification evaluation result to generate encrypted data flow identification result visualization data; Step S43: construct an accuracy report based on the visualization data of the encrypted data stream recognition result to generate a recognition accuracy report.

[0021] The present invention generates an encrypted data flow recognition evaluation result by evaluating the recognition accuracy based on the encrypted data flow recognition model. By scientifically evaluating the accuracy of the encrypted data flow recognition model, the performance of the model when processing the encrypted data flow can be comprehensively reflected from a quantitative perspective, providing a basis for subsequent model optimization and adjustment. This evaluation result not only reflects the overall performance of the model, but also reveals the recognition ability of the model in different types of encrypted traffic, thereby providing clear guidance for further optimization directions. By visually analyzing the encrypted data flow recognition evaluation results, encrypted data flow recognition result visualization data is generated. Visual analysis not only improves the intuitiveness of the evaluation results, but also helps researchers or engineers to more easily understand the recognition effect of the model. For example, the performance differences of the model under different data sets and different encryption types can be intuitively displayed through visual charts, so that the advantages and disadvantages of the model are clear at a glance. This process reduces the difficulty of data analysis by converting complex recognition evaluation results into easy-to-understand visual forms, enhances the in-depth understanding of the results, helps to discover potential problems, and provides a basis for subsequent decision-making. Accuracy report construction is performed based on the encrypted data flow recognition result visualization data to generate a recognition accuracy report. The construction of the accuracy report is a summary of the recognition evaluation process, presenting the key data and evaluation results of the recognition process in a systematic and standardized way. The accuracy report can review the recognition process in detail, thereby helping users or system developers to more clearly understand the performance of the model in actual applications, and then make necessary optimization and adjustments to the model. The report not only contains quantitative accuracy indicators, but also combines visual data for in-depth analysis, making the report content more comprehensive, accurate and practical.

[0022] In this specification, a system for identifying an encrypted data stream is provided, which is used to perform the above-mentioned method for identifying an encrypted data stream. The system for identifying an encrypted data stream includes: The data acquisition and preprocessing module is used to acquire the encrypted data stream set; perform data preprocessing on the encrypted data stream set to generate an encrypted data stream preprocessing data set; The feature extraction and model learning module is used to extract data stream features from the encrypted data stream preprocessing data set and generate a refined encrypted data stream feature set; perform pattern encryption algorithm learning based on the refined encrypted data stream feature set and generate an encrypted data stream recognition model; The implicit pattern recognition and parameter updating module is used to perform implicit pattern and pseudo-randomness recognition on the encrypted data flow recognition model to generate the encrypted data flow recognition result; based on the encrypted data flow recognition result, the recognition parameters of the encrypted data flow recognition model are updated to complete the construction of the encrypted data flow recognition model; The accuracy evaluation and report generation module is used to evaluate the recognition accuracy based on the encrypted data stream recognition model and generate an encrypted data stream recognition accuracy report.

[0023] The beneficial effect of the present invention is that the steps of obtaining an encrypted data stream set and performing preprocessing effectively eliminate the noise and redundant information in the original data, and provide a cleaner and more standardized data basis for subsequent feature extraction. The preprocessing stage significantly improves the quality of the data set by removing irrelevant information and filling missing data, ensuring the reliability of subsequent analysis. In the data stream feature refinement and extraction stage, a refined feature set of the encrypted data stream is generated according to the extraction method of refined features. This process is to more accurately capture the potential information in the data by carefully analyzing various features of the data stream, such as temporal, pattern features, and the internal regularity of encrypted data. The optimization of this stage not only improves the model's recognition ability for encrypted data, but also effectively reduces feature redundancy, reduces the amount of calculation and model training time, and lays a solid foundation for further algorithm learning. Based on the process of learning the pattern encryption algorithm based on the refined feature set, an encrypted data stream recognition model is generated through in-depth learning of the feature set. The model has strong adaptability and recognition ability, and can effectively identify different encryption methods and encryption strengths. The implicit pattern and pseudo-randomness recognition stage further enhances the model's understanding of the inherent structure of the encrypted data stream, and improves its recognition accuracy and flexibility for irregular encryption patterns. In the recognition accuracy evaluation stage, a comprehensive evaluation is performed on the generated encrypted data stream recognition model to obtain accurate recognition results and generate a detailed accuracy report. This process ensures the reliability and stability of the model in real applications, and can efficiently and accurately complete the recognition task of the encrypted data stream, thereby ensuring the security and efficiency of data processing in practical applications. Therefore, the present invention solves the problems of insufficient processing accuracy and limited recognition ability in traditional encrypted data stream recognition by refining feature extraction, model optimization, and accuracy evaluation and other multi-level means, and improves the recognition accuracy and robustness of complex encryption patterns. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1A flowchart of steps for identifying an encrypted data stream; Figure 2 for Figure 1 Detailed implementation steps of step S2 in the flowchart; Figure 3 for Figure 1 Detailed implementation steps of step S3 in FIG. Figure 4 for Figure 1 Detailed implementation steps of step S4 in FIG. The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0025] The following is a clear and complete description of the technical method of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by technicians in this field without creative work are within the scope of protection of the present invention.

[0026] In addition, the accompanying drawings are only schematic illustrations of the present invention and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. The functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor methods and / or microcontroller methods.

[0027] It should be understood that, although the terms "first", "second", etc. may be used herein to describe various units, these units should not be limited by these terms. These terms are used only to distinguish one unit from another unit. For example, without departing from the scope of the exemplary embodiments, the first unit may be referred to as the second unit, and similarly the second unit may be referred to as the first unit. The term "and / or" used herein includes any and all combinations of one or more of the listed associated items.

[0028] To achieve this, please refer to Figures 1 to 4 , a method for identifying an encrypted data stream, the method comprising the following steps: Step S1: obtaining an encrypted data stream set; performing data preprocessing on the encrypted data stream set to generate an encrypted data stream preprocessing data set; Step S2: extracting data stream features from the encrypted data stream preprocessing data set to generate an encrypted data stream refinement feature set; learning a pattern encryption algorithm based on the encrypted data stream refinement feature set to generate an encrypted data stream recognition model; Step S3: Perform implicit pattern and pseudo-randomness recognition on the encrypted data flow recognition model to generate an encrypted data flow recognition result; based on the encrypted data flow recognition result, update the recognition parameters of the encrypted data flow recognition model to complete the construction of the encrypted data flow recognition model; Step S4: Evaluate the recognition accuracy based on the encrypted data stream recognition model and generate an encrypted data stream recognition accuracy report.

[0029] The beneficial effect of the present invention is that the steps of obtaining an encrypted data stream set and performing preprocessing effectively eliminate the noise and redundant information in the original data, and provide a cleaner and more standardized data basis for subsequent feature extraction. The preprocessing stage significantly improves the quality of the data set by removing irrelevant information and filling missing data, ensuring the reliability of subsequent analysis. In the data stream feature refinement and extraction stage, a refined feature set of the encrypted data stream is generated according to the extraction method of refined features. This process is to more accurately capture the potential information in the data by carefully analyzing various features of the data stream, such as temporal, pattern features, and the internal regularity of encrypted data. The optimization of this stage not only improves the model's recognition ability for encrypted data, but also effectively reduces feature redundancy, reduces the amount of calculation and model training time, and lays a solid foundation for further algorithm learning. Based on the process of learning the pattern encryption algorithm based on the refined feature set, an encrypted data stream recognition model is generated through in-depth learning of the feature set. The model has strong adaptability and recognition ability, and can effectively identify different encryption methods and encryption strengths. The implicit pattern and pseudo-randomness recognition stage further enhances the model's understanding of the inherent structure of the encrypted data stream, and improves its recognition accuracy and flexibility for irregular encryption patterns. In the recognition accuracy evaluation stage, a comprehensive evaluation is performed on the generated encrypted data stream recognition model to obtain accurate recognition results and generate a detailed accuracy report. This process ensures the reliability and stability of the model in real applications, and can efficiently and accurately complete the recognition task of the encrypted data stream, thereby ensuring the security and efficiency of data processing in practical applications. Therefore, the present invention solves the problems of insufficient processing accuracy and limited recognition ability in traditional encrypted data stream recognition by refining feature extraction, model optimization, and accuracy evaluation and other multi-level means, and improves the recognition accuracy and robustness of complex encryption patterns.

[0030] In the embodiment of the present invention, reference Figure 1FIG. 1 is a flow chart of steps of a method for identifying an encrypted data stream according to the present invention. In this example, the method for identifying an encrypted data stream includes the following steps: Step S1: obtaining an encrypted data stream set; performing data preprocessing on the encrypted data stream set to generate an encrypted data stream preprocessing data set; In an embodiment of the present invention, an encrypted data stream set is obtained, and a data stream containing encrypted information is obtained by data acquisition technology. These data streams are usually characterized by high frequency, high capacity and diversity, and come from different communication protocols and encryption methods. The obtained encrypted data stream set provides rich raw data for subsequent processing. When the encrypted data stream set is preprocessed, redundant information and noise in the data stream are first removed. Specifically, non-encrypted transmission data is removed by traffic filtering technology, and irrelevant control information and data packet headers are excluded. Then, the data stream is split into several data packets using packetization technology, so that the encrypted information in each data packet can be processed independently. In order to ensure the efficiency and accuracy of subsequent analysis, it is also necessary to analyze the timing characteristics of the data stream, synchronize the timestamp information, convert it into quantifiable time series data, and further refine the time attributes of each data packet. In this process, traffic reorganization and decoding will be performed according to actual needs, so that each data packet in the encrypted data stream set can adapt to different decoding algorithms and their specific encryption methods. Through these data processing means, the various information in the encrypted data stream set can be uniformly converted into a data format that is easy to analyze subsequently, that is, an encrypted data stream preprocessing data set. The preprocessed data set not only contains the encrypted information extracted from the original data stream, but also includes the data after standardization and formatting, making subsequent operations such as encrypted data stream feature extraction, pattern recognition, and encryption algorithm learning smoother.

[0031] Step S2: extracting data stream features from the encrypted data stream preprocessing data set to generate an encrypted data stream refinement feature set; learning a pattern encryption algorithm based on the encrypted data stream refinement feature set to generate an encrypted data stream recognition model; In the embodiment of the present invention, the encrypted data stream preprocessing data set is first subjected to data stream feature refinement extraction. The core technical means of this process is to accurately extract key traffic features from the original data stream to provide support for subsequent pattern recognition. Specifically, each data packet in the encrypted data stream is first analyzed one by one to extract its basic features such as time, size, interval, frequency, etc. In addition, advanced features of the encrypted data packet are further extracted, such as traffic fluctuations, packet length distribution, packet header identifier, encryption algorithm features, etc. These features play an important role in understanding the behavior pattern of the encrypted data stream and the regularity in the encryption process. Further, in order to more accurately identify the regularity of the encrypted data stream, the refinement extraction not only includes static features, but also covers dynamic features, such as the transmission speed of the data packet, the delay between data packets, and the change pattern that occurs during the transmission process. These features are normalized, normalized or standardized to eliminate the deviation caused by differences in data flow, data packet size, etc. Through feature extraction technology, the original data stream is converted into data in a high-dimensional feature space to form an encrypted data stream refinement feature set, providing a multi-dimensional information basis for subsequent analysis. After obtaining the refined feature set of the encrypted data stream, the next step is to use the feature set to learn the pattern encryption algorithm. The technical means used in this process include machine learning and deep learning algorithms, especially supervised learning methods based on these refined feature sets, such as support vector machines (SVM), decision trees, K-nearest neighbor (KNN) algorithms, and deep neural networks (DNN). These algorithms can continuously optimize the model through the training process, learn the potential patterns of encrypted data streams, and automatically identify different encryption patterns and their characteristics. By learning the refined feature set of encrypted data streams, an encrypted data stream recognition model is generated, which can effectively identify and classify different encrypted data streams with high accuracy and robustness.

[0032] Step S3: Perform implicit pattern and pseudo-randomness recognition on the encrypted data flow recognition model to generate an encrypted data flow recognition result; based on the encrypted data flow recognition result, update the recognition parameters of the encrypted data flow recognition model to complete the construction of the encrypted data flow recognition model; In the embodiment of the present invention, it is first necessary to identify the hidden pattern and pseudo-randomness of the encrypted data stream recognition model, which is a key process to further optimize the recognition accuracy and robustness of the encrypted data stream. Specifically, the technical means of hidden pattern recognition rely on modeling and identifying potential patterns in the data stream that are difficult to directly observe. Hidden patterns are usually manifested as certain common features or irregular fluctuations between different encrypted data streams. These patterns are related to the generation algorithm of the data stream, the encryption method or other variables in the transmission process. In order to effectively identify hidden patterns, technical means include methods such as high-order statistical analysis, frequency domain analysis and adaptive filtering, which can mine potential associations that cannot be directly observed in the encrypted data stream. For example, through time series analysis, using wavelet transform, Fourier transform and other technologies, the periodic and non-periodic components of the encrypted data stream can be analyzed at different scales, thereby revealing its potential hidden patterns. Pseudo-randomness recognition mainly focuses on judging the quality and behavior patterns of the pseudo-random number generator in the encrypted data stream. Pseudo-randomness is one of the foundations of encryption algorithms. The generation of pseudo-random numbers and their distribution characteristics are crucial to the encryption strength and the security of data streams. The information entropy analysis method commonly used to identify pseudo-randomness can determine whether it conforms to the ideal random distribution by measuring the entropy value of the data in the encrypted data stream. Specifically, the pseudo-randomness identification process includes steps such as information entropy calculation, periodicity detection and difference analysis. The use of these technologies can effectively identify the pseudo-randomness characteristics in the encrypted data stream and evaluate whether it has regularity or systematic deviations. Based on the above implicit pattern and pseudo-randomness identification results, the parameters of the encrypted data stream identification model are updated next. At this time, technical means include using feedback mechanisms, incremental learning and online learning algorithms to dynamically adjust the parameters of the recognition model and optimize its recognition ability for new data streams. The incremental learning method allows the model to gradually adjust the parameters of the model according to the new information when receiving new recognition results, without the need to retrain all the data, so as to improve the generalization ability and recognition accuracy of the model. The parameter update process is mainly carried out through gradient descent, optimization algorithm or genetic algorithm, etc., to ensure that the recognition model can maintain a high recognition accuracy in a constantly changing data stream environment.

[0033] Step S4: Evaluate the recognition accuracy based on the encrypted data stream recognition model and generate an encrypted data stream recognition accuracy report.

[0034] In an embodiment of the present invention, one of the technical means for evaluating the recognition accuracy is to use a cross-validation method. Cross-validation is a commonly used model validation technique that can obtain the generalization ability of the model by dividing the data set into multiple subsets and training and testing the model on different subsets. The common K-fold cross-validation can reduce the deviation caused by data division through repeated training and validation, and further improve the reliability and robustness of the accuracy evaluation. This technical means can comprehensively evaluate the performance of the encrypted data stream recognition model when facing different data sets and different attack modes. In order to accurately quantify the performance of the model, other statistical methods such as precision, recall, F1 score, etc. are also used. These indicators can fully reflect the classification performance of the model, especially in the encrypted data stream recognition task, where precision and recall often need to be balanced, and the F1 score provides a comprehensive evaluation method. In addition, the confusion matrix is ​​also used to display the classification of the model in different categories, including true positive, false positive, true negative and false negative, to provide a basis for further analysis of the model's misclassification. The generation of the encrypted data stream recognition accuracy report needs to be combined with the above evaluation results and displayed through visualization tools. Commonly used technical means include drawing ROC curves (Receiver Operating Characteristic Curve) and AUC values ​​to measure the performance of the model under various thresholds. Through the analysis of AUC values, the overall performance of the encrypted data stream recognition model can be objectively evaluated, not limited to a specific classification threshold. The generation of the report usually combines the above various evaluation results for multi-dimensional analysis and presentation, thereby generating a detailed recognition accuracy report. The report content includes but is not limited to multiple performance indicators such as model accuracy, precision, recall rate, F1 score, AUC value, etc., and it is also necessary to describe the performance of the model on different data sets in detail, provide comparative analysis, and point out potential advantages and improvement directions. This process not only provides the necessary evaluation basis for the final encrypted data flow identification operation, but also provides data support and decision-making guidance for subsequent model optimization and improvement.

[0035] Preferably, step S1 comprises the following steps: Step S11: Obtain an encrypted data stream set; Step S12: performing stream encryption-group encryption hybrid classification on the encrypted data stream set to generate encrypted data stream classification data; Step S13: preprocess the encrypted data stream classification data to generate an encrypted data stream preprocessing data set.

[0036] In the embodiment of the present invention, the encrypted data stream transmitted through the network can be captured in real time through a network traffic monitoring tool or a packet sniffing technology. In this process, data collection needs to ensure the integrity and accuracy of the data to avoid information loss or interference from forged data. In addition, the acquired data set needs to meet certain quality standards, and the authenticity and validity of the data are usually ensured by verifying metadata such as the source, format, and timestamp of the data. Stream encryption and packet encryption are two common encryption methods, and the hybrid classification technology combines the characteristics of the two to identify and classify encryption modes. Specifically, stream encryption is suitable for processing longer data streams, while packet encryption processes fixed-length data blocks. The hybrid classification algorithm usually uses machine learning or deep learning technology to divide the encrypted data stream into two categories: stream encryption and packet encryption by analyzing the characteristics of the encrypted data stream (such as packet length, transmission delay, structure of the data stream, etc.). In this process, feature extraction of the data stream is crucial, and support for subsequent classification is usually provided by extracting statistical features, time series features, spectral features, etc. of the data stream. Common preprocessing techniques include denoising, de-duplication, formatting, and standardization. De-noising technology reduces the impact of external noise on subsequent analysis by filtering out irrelevant or erroneous data points; de-duplication technology ensures the uniqueness of data items in the data set and avoids model misjudgment due to duplicate data; formatting converts data from various sources into a unified format to ensure data consistency; standardization normalizes data so that data of different scales can be analyzed and modeled on the same basis.

[0037] Preferably, step S13 includes the following steps: Step S131: extracting the header timestamp information of the encrypted data stream classification data to generate the encrypted data stream header timestamp data; drawing the encrypted data stream header timestamp data as a time series icon to generate an encrypted data header timestamp two-dimensional graph; setting the unit cycle threshold value of the encrypted data header timestamp two-dimensional graph to generate the encrypted data header cycle threshold value; Step S132: segmenting the encrypted data stream classification data into unit periods based on the encrypted data header period threshold to generate encrypted data stream time series segmented data; Step S133: extracting the head and tail identifiers from the encrypted data stream classification data to generate encrypted data stream head and tail identifier extraction data; performing tail encryption signature verification on the encrypted data stream head and tail identifier extraction data using a preset encryption format character to generate encrypted data stream content mode division data; Step S134: Pack the encrypted data stream time series segmentation data and the encrypted data stream content mode division data into data sets, and pre-process the encrypted data stream data set.

[0038] In the embodiment of the present invention, by extracting the header information of each data packet in the encrypted data stream, especially the timestamp data, the time series characteristics of the encrypted data stream can be obtained. The timestamp data is the key to analyzing the behavior of the data stream, and it can reveal the transmission rate and timing regularity of the encrypted stream. Then, these header timestamp data are "time series icon drawing". This process is realized by data visualization technology, and the timestamp information can be converted into a two-dimensional graph to provide visualization support for subsequent analysis. After the time series graph is drawn, the graph is further "unit cycle threshold setting". This technical means defines the boundary conditions of the cycle, so that the cycle unit can be effectively demarcated in the subsequent data segmentation. This process determines the periodic characteristics through statistical methods such as Fourier transform or wavelet analysis. Specific methods include sliding window, peak detection or adaptive segmentation technology. These technologies can accurately divide the encrypted data stream into multiple time series segments according to the set cycle threshold, so as to obtain more fine-grained data segments, which is convenient for subsequent pattern learning and recognition. By parsing the head and tail parts of the encrypted data packet, key control information and identifiers can be extracted, which are usually used to further analyze the structure and protocol of the data stream. In addition, the "tail encryption signature verification" is performed through the preset "encryption format character". This technical means uses cryptographic algorithms (such as hashing, digital signatures, etc.) to verify the integrity and consistency of the data stream to ensure that the data has not been tampered with during transmission. In this way, a more accurate "encrypted data stream content pattern division data" can be obtained. The encrypted data stream time series segmentation data and the encrypted data stream content pattern division data are packaged into data sets. This technical means aims to structure and encapsulate the data extracted from different stages to form a unified data set. The data set packaging process usually uses compression technology or data structure optimization methods to organize data with different characteristics in a specific format for subsequent training and analysis.

[0039] As an example of the present invention, refer to Figure 2 As shown, in this example, step S2 includes: Step S21: extracting data stream features from the encrypted data stream preprocessing data set to generate an encrypted data stream refinement feature set; Step S22: performing dimensionality reduction processing on high-dimensional data according to the encrypted data stream refinement feature set to generate encrypted data stream dimensionality reduction data; Step S23: Perform pattern encryption algorithm learning based on the encrypted data stream dimensionality reduction data to generate an encrypted data stream recognition model.

[0040] In an embodiment of the present invention, multi-dimensional features in the encrypted data stream are extracted by in-depth analysis of the preprocessed data set. These features include traffic statistical characteristics, timing characteristics, protocol behavior characteristics, etc., and a more accurate feature set can be refined by analyzing the header, body, and interaction mode of the encrypted data stream. These features usually rely on information theory, statistics, and pattern recognition methods, such as entropy-based feature extraction, frequency analysis, and statistical properties of data packets, to help extract more meaningful information from the encrypted data stream from the original data. Since the refined feature set of the encrypted data stream often has high dimensions and complex structures, directly processing these data leads to low computational efficiency and overfitting problems. In order to solve these problems, dimensionality reduction techniques such as principal component analysis (PCA), t-SNE, linear discriminant analysis (LDA), or autoencoders are usually used to map high-dimensional data to low-dimensional space. Dimensionality reduction not only helps to reduce data redundancy, but also can improve computational efficiency while retaining the main information, which is particularly critical for subsequent algorithm learning. Through the reduced-dimensional data set, the inherent patterns and structures in the data can be more effectively revealed, thereby laying a solid foundation for the training of the recognition model of the encrypted data stream. Based on the reduced-dimensional data, the pattern learning is performed to generate the encrypted data stream recognition model. At this time, the technology used is usually machine learning or deep learning algorithms, such as support vector machine (SVM), decision tree, random forest, neural network, etc. Based on the feature data after dimensionality reduction, the algorithm learns the characteristics and patterns of the encrypted data stream from the data through the training process. The learning of encryption algorithm patterns not only relies on traditional classification technology, but also can be combined with time series analysis methods (such as recursive neural network RNN, long short-term memory network LSTM) to capture the time dependency in the data stream, thereby improving the model's recognition ability of encrypted data stream patterns.

[0041] Preferably, step S21 includes the following steps: Step S211: acquiring standard encryption mode data; performing data stream transmission speed statistics on the encrypted data stream preprocessing data set to generate encrypted data stream transmission speed data; performing non-random information entropy structure analysis on the encrypted data stream transmission speed data to generate encrypted data stream information entropy structure data; Step S212: periodically analyzing and processing the encrypted data stream information entropy structure data, and comparing it with the standard encryption mode data to generate encrypted data stream feature data; Step S213: Perform wavelet transform on the encrypted data stream feature data to extract high-frequency signal patterns and generate a refined feature set for the encrypted data stream.

[0042] In an embodiment of the present invention, encrypted data stream transmission speed data is generated by performing data stream transmission speed statistics on the encrypted data stream preprocessing data set. This technical means mainly relies on statistical analysis of the timing characteristics of the data stream. In this process, the transmission rate of the encrypted data stream is first recorded, which is usually calculated by the data packet size and transmission time in the sampling time window. Based on this statistical data, the transmission rate of the data stream can be further analyzed in time series to provide basic information for subsequent feature extraction and data stream behavior analysis. The encrypted data stream transmission speed data is subjected to non-random information entropy structure analysis to generate encrypted data stream information entropy structure data. Information entropy, as a core concept in information theory, is used to measure the uncertainty and complexity of information in data. In this step, the transmission rate of the encrypted data stream is analyzed using an information entropy calculation method to reveal the potential structural patterns and laws in the encrypted data stream. Specifically, information entropy analysis helps identify hidden patterns or laws in the data stream by quantifying the randomness of the data stream, thereby providing a basis for subsequent data processing and pattern recognition. The encrypted data stream information entropy structure data is periodically analyzed and processed, and compared with the standard encryption mode data to generate encrypted data stream feature data. Periodicity analysis is an important technique in signal processing, which aims to extract periodic components from complex data sequences. By performing periodic analysis on information entropy structure data, the periodic behavior patterns in the encrypted data stream can be revealed, especially the differences from the standard encryption mode. Comparison with the standard encryption mode data can help construct the feature data of the encrypted data stream, providing an important reference for subsequent feature classification and pattern recognition. By performing wavelet transform on the feature data of the encrypted data stream to extract the high-frequency signal pattern, a refined feature set of the encrypted data stream is generated. Wavelet transform is an important signal processing technique and is widely used in the frequency domain analysis of signals. In this step, the high-frequency signal components in the encrypted data stream are extracted using wavelet transform, thereby revealing the rapidly changing features in the data stream. The advantage of wavelet transform is that it can perform localized analysis in both the time and frequency domains, especially for capturing the instantaneous changes of the signal. Through this processing, the refined feature set of the encrypted data stream can be further extracted, making the features of the encrypted stream clearer and providing more accurate input data for subsequent model learning and recognition.

[0043] Preferably, step S23 includes the following steps: Step S231: Performing graph neural network training on the dimensionality reduction data of the encrypted data stream to generate encrypted data stream feature training data; performing recursive neural network training on the dimensionality reduction data of the encrypted data stream to generate encrypted data stream timing analysis training data; Step S232: using the encrypted data stream feature training data and the encrypted data stream timing analysis training data as inputs to a preset multi-level neural network model to perform protocol identification multi-scale encryption learning, and generate a preliminary encrypted data stream identification model; Step S233: Iterate the long-term trend convolution processing of the preliminary encrypted data flow recognition model to generate an encrypted data flow recognition model.

[0044] In an embodiment of the present invention, encrypted data stream feature training data is generated by inputting the dimension reduction data of the encrypted data stream into a graph neural network (GNN) for training. This process converts the dimension-reduced data into a graph structure representation. Through the training of the graph neural network, the potential structural information and relationship features in the data stream can be extracted. GNN has a strong advantage in processing non-Euclidean data structures, and can propagate information through the relationship between nodes and edges, thereby learning complex encrypted data stream features. In this stage, by training the data flow graph structure, training data that can effectively describe the encrypted data stream features is constructed. At the same time, the dimension-reduced encrypted data stream is also input into a recurrent neural network (RNN) for timing analysis training to generate encrypted data stream timing analysis training data. RNN is particularly good at processing sequence data. It can effectively capture the time dependency in the data stream and identify the regular changes in the timing of the encrypted data stream. By inputting the encrypted data stream timing information into the RNN, the dynamic behavior pattern in the data stream can be identified, providing key timing features for the subsequent encrypted data stream recognition model. The encrypted data stream feature training data and time series analysis training data extracted from the graph neural network and recursive neural network are sent as input data to the preset multi-level neural network (MLNN) for multi-scale encryption protocol learning. This stage combines the advantages of graph neural networks and recursive neural networks, and uses multi-level neural networks to process and learn data of different scales, thereby achieving in-depth learning of encryption protocols. Through a multi-layer structure, MLNN can gradually extract different levels of information in the data and adapt to complex encryption protocol modes, so that the recognition ability of encrypted data streams is effectively improved. The encrypted data stream recognition model is further optimized by iterating the long-term trend convolution processing of the preliminary encrypted data stream recognition model. The convolution operation helps to extract local features in the data, while the long-term trend convolution can capture the long-term dependencies and trend changes in the data. Through iterative optimization, the process can continuously adjust the parameters in the recognition model, improve the accuracy and robustness of encrypted data stream recognition, and enable the model to better adapt to complex encryption protocols in practical applications.

[0045] As an example of the present invention, refer to Figure 3 As shown, in this example, step S3 includes: Step S31: performing implicit pattern and pseudo-randomness recognition on the encrypted data stream recognition model to generate an encrypted data stream recognition result; Step S32: Adaptively update the encrypted data flow identification result to generate an adaptive hybrid protocol identification result; update the identification parameters of the encrypted data flow identification model based on the adaptive hybrid protocol identification result, thereby completing the construction of the encrypted data flow identification model and the adaptive traffic identification strategy; Step S33: Based on the adaptive hybrid protocol recognition result, the recognition parameters of the encrypted data flow recognition model are updated, thereby completing the construction of the encrypted data flow recognition model and the adaptive traffic recognition strategy.

[0046] In the embodiment of the present invention, the encrypted data flow recognition model is subjected to implicit pattern and pseudo-randomness recognition. This process extracts potential implicit pattern and pseudo-randomness features from the encrypted data flow by applying statistical analysis and machine learning techniques. These features are manifested as periodicity, randomness or special patterns in the data flow, which can help identify different encryption protocols and their variants. Implicit pattern recognition models the complex behavior of the encrypted data flow to discover potential patterns that have not yet been revealed, while pseudo-randomness recognition mainly distinguishes between real encryption flows and pseudo-encryption flows by evaluating the degree of randomness of the encryption flow. Therefore, through these technologies, the generated encrypted data flow recognition results provide a basis for subsequent traffic updates and recognition model optimization. The encrypted data flow recognition results are adaptively updated to generate adaptive hybrid protocol recognition results. This process is based on the encrypted data flow results identified in the early stage, combined with the adaptive algorithm to adjust the network traffic in real time. Through the adaptive mechanism, the system can dynamically adjust the recognition strategy of the encryption protocol according to the change of traffic, so that the model can adapt to the changing network environment in a timely manner. This process dynamically monitors and analyzes the traffic pattern, identifies different encryption protocols and their mixed use patterns, and thus constructs an adaptive traffic recognition strategy. Based on the results of adaptive hybrid protocol recognition, the recognition parameters of the encrypted data flow recognition model are updated to complete the optimization and construction of the model. This process adjusts the model parameters in real time through a feedback mechanism, thereby enhancing the model's ability to recognize complex encryption protocols and traffic changes. The parameter update of the model usually relies on algorithm optimization techniques, such as gradient descent or Bayesian optimization. By analyzing the results of adaptive hybrid protocol recognition, the model can achieve efficient learning of different encryption protocols and traffic characteristics, further improving recognition accuracy and adaptability.

[0047] Preferably, performing implicit pattern and pseudo-randomness identification on the encrypted data stream identification model comprises the following steps: Constructing the parameters of the pseudo-random number generator according to the encrypted data stream identification model to generate the encrypted data stream pseudo-random number generator; Dynamic entropy value monitoring is performed according to the encrypted data stream pseudo-random number generator to generate a pseudo-random dynamic entropy value for the encrypted data stream; Perform pseudo-randomness detection according to the pseudo-random dynamic entropy value of the encrypted data stream to generate a pseudo-randomness detection result of the encrypted data stream; Perform homomorphic encryption feature recognition according to the encrypted data stream recognition model to generate homomorphic encryption feature recognition data; Perform homomorphic computing based on homomorphic encryption feature recognition data to generate encrypted data stream homomorphic computing data; According to the encrypted data stream and the square calculation data, the implicit pattern is refined to generate the encrypted data stream implicit data; The encrypted data stream pseudo-randomness detection result and the encrypted data stream implicit data are compared and superimposed on each other to generate the encrypted data stream identification result.

[0048] In the embodiment of the present invention, the parameters of the pseudo-random number generator are constructed by using the encrypted data stream identification model to generate the encrypted data stream pseudo-random number generator. This process extracts and analyzes the parameters of the encrypted data stream, and uses statistical features and encryption mode design to generate a pseudo-random number generator. The construction of the pseudo-random number generator needs to be based on factors such as periodicity and entropy value in the encrypted data stream, and a random number stream that meets the encryption requirements is generated by a pseudo-random number generation algorithm in cryptography (such as a linear congruential generator, etc.). Then, dynamic entropy value monitoring is performed based on the pseudo-random number generator to generate a pseudo-random dynamic entropy value of the encrypted data stream. Dynamic entropy value monitoring is to monitor the changes in randomness in the data stream by calculating the entropy value at each moment in the encrypted data stream to determine whether the encrypted stream has high security and unpredictability. Next, the pseudo-randomness detection verifies the pseudo-randomness in the encrypted data stream, detects whether it meets the preset pseudo-randomness standard, and generates the encrypted data stream pseudo-randomness detection result. This process usually uses entropy value testing, frequency analysis and other methods to evaluate the degree of randomness of the data stream. Through these steps, the difference between the pseudo-encrypted stream and the real encrypted stream can be detected. Homomorphic encryption feature recognition is performed according to the encrypted data stream recognition model to generate homomorphic encryption feature recognition data. This process uses the mathematical theory of homomorphic encryption to decode and analyze the encrypted data stream, extract the encryption features of the data, and deconstruct and reconstruct the encryption features of the data through the homomorphic encryption algorithm. These feature recognition data can be used in the subsequent homomorphic calculation steps to generate encrypted data stream homomorphic calculation data. Through homomorphic calculation, the system can perform certain specific operations in the encrypted data stream without decrypting the data, thereby protecting data privacy. On this basis, the encrypted data stream is processed by implicit pattern refinement to generate encrypted data stream implicit data. Implicit pattern refinement refers to extracting potential, unmanifested rules and patterns from the encrypted stream in order to deeply explore the potential features of the data. The encrypted data stream recognition result is generated by performing external behavior comparison and superposition on the pseudo-randomness detection results of the encrypted data stream and the implicit data. This process uses data fusion and pattern recognition technology to combine pseudo-randomness detection and implicit data, and through weighted calculation and multi-dimensional comparison, comprehensively evaluates the recognition results of the encrypted data stream, and finally forms an accurate recognition and classification of the encrypted stream.

[0049] As an example of the present invention, refer to Figure 4 As shown, in this example, step S4 includes: Step S41: performing recognition accuracy evaluation based on the encrypted data flow recognition model to generate an encrypted data flow recognition evaluation result; Step S42: Perform visual analysis on the encrypted data flow identification evaluation result to generate encrypted data flow identification result visualization data; Step S43: construct an accuracy report based on the visualization data of the encrypted data stream recognition result to generate a recognition accuracy report.

[0050] In the embodiment of the present invention, the recognition accuracy evaluation is to classify and predict the data stream using the encrypted data stream recognition model, and evaluate the performance of the model based on the comparison between the actual result and the predicted result. This process is usually carried out through common classification evaluation indicators such as accuracy, recall, F1 value, confusion matrix, etc. At the data level, the evaluation process first extracts a part of the data from the encrypted data stream set as a test set, compares the recognition result output by the model with the real label of the test set, and calculates the classification accuracy of the model to obtain the recognition accuracy. The key to this evaluation is to ensure the reliability of the evaluation through statistical methods such as cross-validation, and use statistical inference methods to analyze the significance of the evaluation results. The encrypted data stream recognition evaluation results are visualized and analyzed, and the evaluation results of the model are mainly presented through data visualization technology. This process converts the numerical results (such as accuracy, error rate, etc.) obtained by the evaluation into intuitive graphical displays, such as using line charts, bar charts, heat maps, etc. to display the recognition effects under different categories and different model parameters, so that the evaluation results are easier to understand and analyze. This process usually relies on data visualization tools and libraries, such as Matplotlib, Seaborn, etc., which can display the evaluation results in graphics and facilitate analysts to quickly identify the pros and cons of the model. The accuracy report is constructed based on the visualization data of the encrypted data stream recognition results to generate a recognition accuracy report. This step summarizes the aforementioned visualization data and model evaluation indicators into a comprehensive report. At the data level, the report construction process includes not only a summary of the recognition accuracy, but also an analysis of misclassified samples, potential improvement directions for the model, and comparison of the effects of different models or algorithms. The construction of the report usually relies on report generation tools, which combine graphical data with text descriptions to form a structured result document, thereby providing a basis for further optimization.

[0051] In this specification, a system for identifying an encrypted data stream is provided, which is used to perform the above-mentioned method for identifying an encrypted data stream. The system for identifying an encrypted data stream includes: The data acquisition and preprocessing module is used to acquire the encrypted data stream set; perform data preprocessing on the encrypted data stream set to generate an encrypted data stream preprocessing data set; The feature extraction and model learning module is used to extract data stream features from the encrypted data stream preprocessing data set and generate a refined encrypted data stream feature set; perform pattern encryption algorithm learning based on the refined encrypted data stream feature set and generate an encrypted data stream recognition model; The implicit pattern recognition and parameter updating module is used to perform implicit pattern and pseudo-randomness recognition on the encrypted data flow recognition model to generate the encrypted data flow recognition result; based on the encrypted data flow recognition result, the recognition parameters of the encrypted data flow recognition model are updated to complete the construction of the encrypted data flow recognition model; The accuracy evaluation and report generation module is used to evaluate the recognition accuracy based on the encrypted data stream recognition model and generate an encrypted data stream recognition accuracy report.

[0052] The beneficial effect of the present invention is that the steps of obtaining an encrypted data stream set and performing preprocessing effectively eliminate the noise and redundant information in the original data, and provide a cleaner and more standardized data basis for subsequent feature extraction. The preprocessing stage significantly improves the quality of the data set by removing irrelevant information and filling missing data, ensuring the reliability of subsequent analysis. In the data stream feature refinement and extraction stage, a refined feature set of the encrypted data stream is generated according to the extraction method of refined features. This process is to more accurately capture the potential information in the data by carefully analyzing various features of the data stream, such as temporal, pattern features, and the internal regularity of encrypted data. The optimization of this stage not only improves the model's recognition ability for encrypted data, but also effectively reduces feature redundancy, reduces the amount of calculation and model training time, and lays a solid foundation for further algorithm learning. Based on the process of learning the pattern encryption algorithm based on the refined feature set, an encrypted data stream recognition model is generated through in-depth learning of the feature set. The model has strong adaptability and recognition ability, and can effectively identify different encryption methods and encryption strengths. The implicit pattern and pseudo-randomness recognition stage further enhances the model's understanding of the inherent structure of the encrypted data stream, and improves its recognition accuracy and flexibility for irregular encryption patterns. In the recognition accuracy evaluation stage, a comprehensive evaluation is performed on the generated encrypted data stream recognition model to obtain accurate recognition results and generate a detailed accuracy report. This process ensures the reliability and stability of the model in real applications, and can efficiently and accurately complete the recognition task of the encrypted data stream, thereby ensuring the security and efficiency of data processing in practical applications. Therefore, the present invention solves the problems of insufficient processing accuracy and limited recognition ability in traditional encrypted data stream recognition by refining feature extraction, model optimization, and accuracy evaluation and other multi-level means, and improves the recognition accuracy and robustness of complex encryption patterns.

[0053] Therefore, the embodiments should be regarded as illustrative and non-restrictive from all points, and the scope of the present invention is limited by the appended claims rather than the above description, and it is intended that all changes falling within the meaning and range of equivalent elements of the application documents are included in the present invention.

[0054] The above description is only a specific embodiment of the present invention, so that those skilled in the art can understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but should conform to the widest scope consistent with the principles and novel features invented herein.

Claims

1. A method for identifying an encrypted data stream, characterized in that: The following steps are involved: Step S1: obtaining an encrypted data stream set; performing data preprocessing on the encrypted data stream set to generate an encrypted data stream preprocessing data set; Step S2: extracting data stream features from the encrypted data stream preprocessing data set to generate an encrypted data stream refinement feature set; Perform pattern encryption algorithm learning based on the encrypted data stream refinement feature set to generate an encrypted data stream recognition model; Step S3: Perform implicit pattern and pseudo-randomness recognition on the encrypted data stream recognition model to generate an encrypted data stream recognition result; Based on the encrypted data flow recognition result, the recognition parameters of the encrypted data flow recognition model are updated, thereby completing the construction of the encrypted data flow recognition model; Step S4: Evaluate the recognition accuracy based on the encrypted data stream recognition model and generate an encrypted data stream recognition accuracy report.

2. The method for identifying an encrypted data stream according to claim 1, characterized in that: Step S1 includes the following steps: Step S11: Obtain an encrypted data stream set; Step S12: performing stream encryption-group encryption hybrid classification on the encrypted data stream set to generate encrypted data stream classification data; Step S13: preprocess the encrypted data stream classification data to generate an encrypted data stream preprocessing data set.

3. The method for identifying an encrypted data stream according to claim 2, characterized in that: Step S13 includes the following steps: Step S131: extracting the header timestamp information of the encrypted data stream classification data to generate the encrypted data stream header timestamp data; drawing the encrypted data stream header timestamp data as a time series icon to generate an encrypted data header timestamp two-dimensional graph; setting the unit cycle threshold value of the encrypted data header timestamp two-dimensional graph to generate the encrypted data header cycle threshold value; Step S132: segmenting the encrypted data stream classification data into unit periods based on the encrypted data header period threshold to generate encrypted data stream time series segmented data; Step S133: extracting the head and tail identifiers from the encrypted data stream classification data to generate encrypted data stream head and tail identifier extraction data; performing tail encryption signature verification on the encrypted data stream head and tail identifier extraction data using a preset encryption format character to generate encrypted data stream content mode division data; Step S134: Pack the encrypted data stream time series segmentation data and the encrypted data stream content mode division data into data sets, and pre-process the encrypted data stream data set.

4. The method for identifying an encrypted data stream according to claim 1, characterized in that: Step S2 includes the following steps: Step S21: extracting data stream features from the encrypted data stream preprocessing data set to generate an encrypted data stream refinement feature set; Step S22: performing dimensionality reduction processing on high-dimensional data according to the encrypted data stream refinement feature set to generate encrypted data stream dimensionality reduction data; Step S23: Perform pattern encryption algorithm learning based on the encrypted data stream dimensionality reduction data to generate an encrypted data stream recognition model.

5. The method for identifying an encrypted data stream according to claim 4, characterized in that: Step S21 includes the following steps: Step S211: acquiring standard encryption mode data; performing data stream transmission speed statistics on the encrypted data stream preprocessing data set to generate encrypted data stream transmission speed data; performing non-random information entropy structure analysis on the encrypted data stream transmission speed data to generate encrypted data stream information entropy structure data; Step S212: periodically analyzing and processing the encrypted data stream information entropy structure data, and comparing it with the standard encryption mode data to generate encrypted data stream feature data; Step S213: Perform wavelet transform on the encrypted data stream feature data to extract high-frequency signal patterns and generate a refined feature set for the encrypted data stream.

6. The method for identifying encrypted data stream according to claim 4, characterized in that: Step S23 includes the following steps: Step S231: Performing graph neural network training on the dimensionality reduction data of the encrypted data stream to generate encrypted data stream feature training data; performing recursive neural network training on the dimensionality reduction data of the encrypted data stream to generate encrypted data stream timing analysis training data; Step S232: using the encrypted data stream feature training data and the encrypted data stream timing analysis training data as inputs to a preset multi-level neural network model to perform protocol identification multi-scale encryption learning, and generate a preliminary encrypted data stream identification model; Step S233: Iterate the long-term trend convolution processing of the preliminary encrypted data flow recognition model to generate an encrypted data flow recognition model.

7. The method for identifying an encrypted data stream according to claim 1, characterized in that: Step S3 includes the following steps: Step S31: performing implicit pattern and pseudo-randomness recognition on the encrypted data stream recognition model to generate an encrypted data stream recognition result; Step S32: Adaptively update the encrypted data flow identification result to generate an adaptive hybrid protocol identification result; update the identification parameters of the encrypted data flow identification model based on the adaptive hybrid protocol identification result, thereby completing the construction of the encrypted data flow identification model and the adaptive traffic identification strategy; Step S33: Based on the adaptive hybrid protocol recognition result, the recognition parameters of the encrypted data flow recognition model are updated, thereby completing the construction of the encrypted data flow recognition model and the adaptive traffic recognition strategy.

8. The method for identifying encrypted data stream according to claim 7, characterized in that: The implicit pattern and pseudo-randomness identification of the encrypted data stream identification model includes the following steps: Constructing the parameters of the pseudo-random number generator according to the encrypted data stream identification model to generate the encrypted data stream pseudo-random number generator; Dynamic entropy value monitoring is performed according to the encrypted data stream pseudo-random number generator to generate a pseudo-random dynamic entropy value for the encrypted data stream; Perform pseudo-randomness detection according to the pseudo-random dynamic entropy value of the encrypted data stream to generate a pseudo-randomness detection result of the encrypted data stream; Perform homomorphic encryption feature recognition according to the encrypted data stream recognition model to generate homomorphic encryption feature recognition data; Perform homomorphic computing based on homomorphic encryption feature recognition data to generate encrypted data stream homomorphic computing data; According to the encrypted data stream and the square calculation data, the implicit pattern is refined to generate the encrypted data stream implicit data; The encrypted data stream pseudo-randomness detection result and the encrypted data stream implicit data are compared and superimposed on each other to generate the encrypted data stream identification result.

9. The method for identifying an encrypted data stream according to claim 1, characterized in that: Step S4 includes the following steps: Step S41: performing recognition accuracy evaluation based on the encrypted data flow recognition model to generate an encrypted data flow recognition evaluation result; Step S42: Perform visual analysis on the encrypted data flow identification evaluation result to generate encrypted data flow identification result visualization data; Step S43: construct an accuracy report based on the visualization data of the encrypted data stream recognition result to generate a recognition accuracy report.

10. A system for identifying encrypted data streams, characterized in that: For executing the method for identifying an encrypted data stream as claimed in claim 1, the system for identifying an encrypted data stream comprises: The data acquisition and preprocessing module is used to acquire the encrypted data stream set; perform data preprocessing on the encrypted data stream set to generate an encrypted data stream preprocessing data set; The feature extraction and model learning module is used to extract data stream features from the encrypted data stream preprocessing data set and generate a refined encrypted data stream feature set; perform pattern encryption algorithm learning based on the refined encrypted data stream feature set and generate an encrypted data stream recognition model; The implicit pattern recognition and parameter updating module is used to perform implicit pattern and pseudo-randomness recognition on the encrypted data flow recognition model to generate the encrypted data flow recognition result; based on the encrypted data flow recognition result, the recognition parameters of the encrypted data flow recognition model are updated to complete the construction of the encrypted data flow recognition model; The accuracy evaluation and report generation module is used to evaluate the recognition accuracy based on the encrypted data stream recognition model and generate an encrypted data stream recognition accuracy report.

Images