Communication data leakage detection and protection method combined with deep learning

Abstract

The invention discloses a communication data leakage detection and protection method combined with deep learning, and belongs to the technical field of communication security, and the method specifically comprises the following steps: collecting chat records, extracting keywords and emotional tendencies by using a natural language processing technology, inputting a deep learning model, and training based on annotation data, dividing work and private chat records; after a private communication encryption instruction is obtained, a private chat record is segmented into data blocks, hash values are generated and stored in block chain nodes, a symmetric encryption algorithm is used for encryption, and a secret key is customized by an employee; calculating the proportion of the two types of chat records, and starting network flow simulation if the proportion exceeds a threshold value; monitoring an access interface in real time, judging abnormal access according to identity permission, request frequency and the like, extracting a hash value when the access is abnormal, and generating a bait record according to the identity and returning the bait record; and finally, the access risk is assessed through the block chain smart contract, and if continuous abnormality occurs, a data self-destruction program is triggered to encrypt the associated data block and terminate the connection, so that the communication data security is ensured.

Description

Technical Field

[0001] The present invention relates to the field of communication security technology, and in particular to a communication data leakage detection and protection method combined with deep learning. Background Art

[0002] At present, although there are some communication data protection methods, there are still many shortcomings. Traditional data encryption methods mainly focus on encrypting the static storage and transmission process of data, and have weak detection and protection capabilities for abnormal behavior during data access. When abnormal access is detected, they can only take simple access blocking measures, which cannot effectively confuse attackers and increase the difficulty for attackers to obtain real data. Summary of the invention

[0003] The purpose of the present invention is to provide a communication data leakage detection and protection method combined with deep learning to solve the following technical problems: Traditional data encryption methods focus on static data storage and transmission encryption, and have weak capabilities for detecting and protecting against abnormal data access behaviors. When anomalies are detected, simple blocking measures are often used, which makes it difficult to effectively confuse attackers and increase the difficulty for them to obtain data.

[0004] The purpose of the present invention can be achieved through the following technical solutions: A communication data leakage detection and protection method combined with deep learning, comprising the following steps: Collect users' chat records, extract keywords and sentiment trends from the chat records based on natural language processing technology, input keywords and sentiment trends into the deep learning model, train based on labeled data, and divide the chat records into work chat records and private chat records; After obtaining the user's private communication encryption instructions, the private chat records are divided into several data blocks, a corresponding hash value is generated for each data block, and the hash value and data block are stored on the blockchain node. The data block is encrypted using a symmetric encryption algorithm, and the encryption key form is customized by the employee; Calculate the ratio of private chat records to work chat records in a unit time. When the ratio is greater than a preset threshold, start the network traffic simulation mode to simulate the work traffic characteristics of the set type. Monitor the access interface of communication data in real time, capture the metadata of access requests, extract the identity authority, request frequency and operation behavior track of the visitor, and determine whether it is an abnormal access. When abnormal access is detected, extract the hash value of the data block from the blockchain, and dynamically generate a bait record containing false keywords based on the visitor's identity authority, and return the bait record and the real hash value to the access end; Access behavior is assessed for risk through blockchain smart contracts. If several consecutive abnormal accesses are detected, the data self-destruction program is triggered to encrypt the associated data blocks and terminate the connection.

[0005] As a further solution of the present invention: it also includes dynamically increasing the generation intensity of network traffic simulation when abnormal access is detected, injecting virtual meeting feature packets into workflow traffic, generating forged email sending and receiving records matching employee positions, and establishing a traffic feature confusion matrix to align real private communication traffic with simulated traffic in terms of latency and data packet size; when a visitor attempts to perform traffic analysis, a protocol reflection attack is triggered, redirecting the parsing instructions of the access end to a preset virtual protocol parser, and returning response data with a compliant format but invalid content.

[0006] As a further solution of the present invention: the blockchain node adopts a distributed storage architecture, and the data blocks and hash values ​​are dispersedly stored on multiple storage nodes.

[0007] As a further solution of the present invention: the natural language processing technology includes lexical analysis, syntactic analysis and semantic analysis. Lexical analysis decomposes the chat record text into individual words and morphemes; syntactic analysis determines the grammatical relationship between words and constructs the grammatical structure of the sentence; semantic analysis understands the actual meaning of the sentence and text, and extracts keywords and emotional tendencies in the chat record.

[0008] As a further solution of the present invention: the deep learning model is based on a neural network architecture of an attention mechanism, and the labeled chat record data is divided into a training set and a validation set. The training set is used for preliminary learning of model parameters, and the validation set is used to adjust the hyperparameters of the model. The cross entropy loss function is used to measure the difference between the model prediction results and the true labels, and the model parameters are updated through the back propagation algorithm.

[0009] As a further solution of the present invention: in the network traffic simulation: The simulated set type of work traffic characteristics include file transfer traffic, video conferencing traffic, and email sending and receiving traffic; for file transfer traffic, the transmission rate, data packet size, and transmission time interval of different file types are simulated; for video conferencing traffic, the bandwidth occupancy, frame rate, and resolution changes of audio and video streams are simulated; for email sending and receiving traffic, the sending and receiving frequency of emails, email size, and attachment type are simulated.

[0010] As a further solution of the present invention: the process of determining whether it is an abnormal access is: The visitor's identity permissions are used to determine whether he has system administrator permissions or ordinary user permissions. If he is an ordinary user, it will be directly marked as abnormal access. For system administrators, the visitor's access behavior is obtained. If there are high-frequency queries, non-working hours access, and cross-departmental data retrieval, it will be marked as abnormal access.

[0011] As a further solution of the present invention: the bait record containing false keywords dynamically generated according to the visitor's identity authority includes: Visitors are divided into visitors of the same level and high-level visitors according to the identity permissions. For visitors of the same level, semantically contradictory bait records are generated, and the key sensitive information in the real private chat records is replaced with words that are obviously inconsistent with the context semantics; for high-level visitors, highly simulated bait records are generated, and semantically reasonable but false texts are generated based on the keyword distribution and sentence structure of the real data based on the pre-trained language model; and when returning the bait record, data lineage obfuscation is performed synchronously. When modifying the timestamp label of the data block, the timestamp is randomly offset to create a logical fault with the original communication timing. When embedding a forged protocol identifier in the data block header, an identifier that is the same as the working business protocol is selected.

[0012] As a further solution of the present invention: the data self-destruction program includes: Perform multiple layers of overwrite encryption on the associated data blocks to generate an irreversible garbled sequence, send a forged data corruption error code to the access end, and terminate the connection.

[0013] Beneficial effects of the present invention: (1) The present invention uses natural language processing technology and a deep learning model based on an attention mechanism to accurately distinguish chat records into work chat records and private chat records. For private chat records, they will be divided into multiple data blocks, and a corresponding hash value will be generated for each data block. These data blocks and hash values ​​will adopt a distributed storage architecture, and the data blocks will be encrypted using a symmetric encryption algorithm, thereby enhancing the security and privacy of private chat records.

[0014] (2) The present invention uses a network traffic simulation mode to simulate the traffic characteristics of normal working scenarios, confuse the real private communication traffic, and reduce the risk of it being monitored and analyzed. In terms of abnormal detection and response, the access interface of communication data is monitored in real time, and multiple factors such as the visitor's identity authority, request frequency, and operation behavior trajectory are comprehensively considered to accurately determine whether there is abnormal access.

[0015] (3) Once the present invention detects abnormal access, it will generate different types of decoy records based on the identity and authority of the visitor, and perform data lineage obfuscation operations at the same time, effectively confusing attackers and increasing the difficulty of obtaining real data. When continuous abnormal access is detected, the intensity of network traffic simulation will be dynamically increased, virtual meeting feature packets will be injected, fake email sending and receiving records matching the employee's position will be generated, and a traffic feature confusion matrix will be established to make the real private communication traffic and simulated traffic highly consistent in terms of latency, data packet size and other dimensions. If the visitor attempts to perform traffic analysis, a protocol reflection attack will be triggered, and its parsing instructions will be redirected to the preset virtual protocol parser, returning response data with a compliant format but invalid content.

[0016] (4) When the present invention detects multiple consecutive abnormal accesses, it will quickly trigger the data self-destruction program, perform multi-layer overwrite encryption on the associated data blocks, and generate an irreversible garbled sequence. At the same time, it will send a forged data corruption error code to the access end and terminate the connection, thereby ensuring the security and integrity of the communication data and minimizing the losses that may be caused by data leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The present invention will be further described below in conjunction with the accompanying drawings.

[0018] Figure 1 It is a schematic diagram of the process of the present invention. DETAILED DESCRIPTION

[0019] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0020] See also Figure 1 As shown, the present invention is a communication data leakage detection and protection method combined with deep learning, comprising the following steps: S1. Collect user chat records and extract keywords and sentiments with the help of natural language processing technology. Natural language processing technology is a complex and powerful tool set that includes three important components: lexical analysis, syntactic analysis, and semantic analysis.

[0021] As the first step, lexical analysis is like a meticulous text disassembler, breaking down the chat record text into individual words and morphemes. In this process, it will identify the content words and function words in the text, and distinguish different parts of speech, such as nouns, verbs, adjectives, etc. At the same time, some compound words and abbreviations will also be accurately split and identified. For example, for "AI technology", lexical analysis will split it into "AI" and "technology"; for "don't", it will be recognized as an abbreviation of "do" and "not". Through lexical analysis, we can convert complex text into basic language units, laying the foundation for subsequent analysis.

[0022] Syntactic analysis goes a step further on the basis of lexical analysis. Its task is to determine the grammatical relationship between words and construct the grammatical structure of sentences. This is like building a language building. It is necessary to clarify the connection mode and hierarchical relationship between each word. Syntactic analysis will identify the main components of the sentence, such as the subject, predicate, and object, as well as modifying components such as attributives, adverbials, and complements. For example, for the sentence "Xiao Ming is reading an interesting book in the library carefully", syntactic analysis will determine that "Xiao Ming" is the subject, "reading" is the predicate, "book" is the object, "in the library" is the adverbial, "carefully" is also an adverbial, and "an interesting book" is the attributive. Through syntactic analysis, we can understand the basic framework and logical structure of the sentence.

[0023] Semantic analysis is the core of natural language processing technology, which is dedicated to understanding the actual meaning of sentences and texts. Semantic analysis does not only stay at the level of vocabulary and grammar, but more importantly, it digs out the semantic information behind the text. It takes into account factors such as the semantics of words, the context of the context, and the cultural background of the language. For example, for some sentences with rhetoric such as metaphors and puns, semantic analysis can accurately interpret their true meaning. When extracting keywords, semantic analysis will select the words that best represent the core content of the text based on the theme and focus of the text; when judging the emotional tendency, it will analyze the positive, negative or neutral emotions expressed in the text. For example, for the sentence "This project is progressing very smoothly, and I am very happy", semantic analysis will extract keywords such as "project progress", "smooth", and "happy", and judge the emotional tendency of the text as positive.

[0024] After extracting keywords and sentiment, we input this information into the neural network architecture based on the attention mechanism. The attention mechanism is an important technology in the field of neural networks. It enables the model to dynamically focus on different parts of information when processing text, so as to better capture the key features and semantic relationships in the text. In order to train this neural network model, we divide the labeled chat record data into a training set and a validation set. The training set is like a "learning material" for the model. It contains a large number of chat record samples and corresponding classification labels (work chat records or private chat records) for the preliminary learning of model parameters. During the training process, the model will continuously adjust its own parameters to classify the samples in the training set as accurately as possible. The validation set plays the role of "testing learning results". It is used to adjust the hyperparameters of the model. Hyperparameters are parameters that need to be set in advance before model training, such as learning rate, batch size, etc. By evaluating the performance of the model on the validation set, we can try different hyperparameter combinations and find the optimal hyperparameter settings, thereby improving the generalization ability and classification accuracy of the model.

[0025] In order to measure the difference between the model prediction result and the true label, we use the cross entropy loss function. The cross entropy loss function is a commonly used loss function that can effectively measure the difference between two probability distributions. In our model, the prediction result is the model's probability estimate of whether the chat record belongs to work chat record or private chat record, and the true label is the actual classification. By calculating the cross entropy loss, we can know the degree of deviation between the model's prediction and the actual situation. In order to allow the model to continuously learn and improve, we use the back propagation algorithm to update the model parameters. The back propagation algorithm is an optimization algorithm based on gradient descent. It will back propagate errors according to the gradient information of the loss function, adjust the various parameters in the model, and gradually reduce the value of the loss function, thereby improving the classification performance of the model. After such a series of operations, our model can accurately divide chat records into work chat records and private chat records, providing an important foundation for subsequent data processing and security protection.

[0026] S2. After obtaining the user's private communication encryption instructions, the system will carefully segment these private chat records into several data blocks for the convenience of subsequent processing and storage. This segmentation is not done randomly, but is based on certain rules and algorithms to ensure that the size of each data block is moderate, which is convenient for management and can ensure the integrity and independence of the data.

[0027] After the data blocks are segmented, the system generates a corresponding hash value for each data block. The hash value is like a "digital fingerprint" of the data block. It is a unique identifier obtained by calculating the content of the data block through a specific hash algorithm. No matter how slightly the content of the data block changes, its corresponding hash value will be significantly different. This feature makes the hash value extremely valuable in data verification and integrity checking. By comparing the hash values ​​of data blocks, we can quickly determine whether the data has been tampered with during transmission or storage.

[0028] Next, the system will store the generated hash values ​​and data blocks on the blockchain nodes. The blockchain nodes here use a distributed storage architecture, which is an advanced and secure storage method. In a distributed storage architecture, data blocks and hash values ​​are not stored in a specific location, but are distributed on multiple storage nodes. This decentralized storage method brings many advantages. On the one hand, it greatly improves the security of data. Because even if a storage node fails or is attacked, it will not affect the storage and use of the entire data, and other storage nodes can still provide data services normally. On the other hand, the distributed storage architecture also enhances the reliability and availability of data. Multiple storage nodes can back up and verify data with each other to ensure data integrity and consistency.

[0029] To further enhance data security, the system uses symmetric encryption algorithms to encrypt data blocks. Symmetric encryption algorithms are a common and effective encryption method that uses the same key to encrypt and decrypt data. In this process, the form of encryption keys is customized by employees based on their needs and preferences. Employees can choose to use complex password combinations, biometric identification information (such as fingerprints, facial recognition, etc.) or other personalized encryption methods to generate encryption keys. This customized setting method gives employees greater control and security, allowing them to protect the security of private chat records based on their actual situation.

[0030] S3. Accurately monitor and analyze the proportion of different types of chat records in a unit time. Specifically, calculate the ratio of private chat records to work chat records in a unit time. The unit time can be flexibly set according to actual needs, such as an hour, half a day or a day as a statistical cycle. At the end of each unit time, the system will comprehensively sort out and classify all chat records generated in the time period, accurately distinguish between private chat records and work chat records, and count their respective numbers or data volumes. Then, a simple mathematical calculation is used to derive the proportional relationship between the two. This ratio can intuitively reflect the employee's time allocation for work and private communication during the time period.

[0031] In order to better balance employee privacy protection and corporate network security management, a threshold is pre-set. This threshold is determined after considering the business characteristics, nature of work, security requirements and other factors of the enterprise. When the calculated ratio of private chat records to work chat records per unit time is greater than the preset threshold, it means that the employee spent more time on private communication during this period of time, and there may be a certain risk of privacy leakage. At this time, the system will quickly start the network traffic simulation mode.

[0032] The core goal of the network traffic simulation mode is to simulate the characteristics of a set type of work traffic, so as to confuse the real private communication traffic and make it difficult for the outside world to distinguish the transmission of private chat records from the network traffic. The specific simulated work traffic types mainly include file transfer traffic, video conferencing traffic, and email sending and receiving traffic.

[0033] For the simulation of file transfer traffic, the system will fully consider the characteristics of different file types. In actual work scenarios, there are many types of files, such as Word and Excel files in the document category, JPEG and PNG files in the image category, and MP4 and AVI files in the video category. Different types of files have different transmission rates, data packet sizes, and transmission time intervals during the transmission process. The system will analyze and simulate these characteristics in detail. For example, for large-sized video files, the simulation has a relatively slow transmission rate, a large data packet, and a possibly long transmission time interval; while for small-sized document files, the simulation has a faster transmission rate, a smaller data packet, and a shorter transmission time interval. Through this precise simulation, the characteristics of file transfer traffic are highly similar to real work scenarios.

[0034] In simulating video conference traffic, the system will focus on the relevant parameters of audio and video streams. In video conferences, the bandwidth occupancy, frame rate, and resolution changes of audio and video streams are important characteristic indicators. Video conferences of different sizes and needs will have different bandwidth occupancy. For example, small departmental internal meetings may have relatively low bandwidth occupancy, while large company-wide meetings require higher bandwidth support. The frame rate and resolution will also be adjusted according to the actual situation of the meeting. High-definition video conferences require higher frame rates and resolutions, which will occupy more bandwidth resources accordingly. Based on these actual situations, the system will simulate the video conference traffic characteristics that meet the work scenarios, including dynamic changes in bandwidth, frame rate adjustments, and resolution switching.

[0035] For the simulation of email sending and receiving traffic, the system simulates the sending and receiving frequency of emails, email size, and attachment types. In corporate work, the sending and receiving frequency of emails varies greatly under different positions and business needs. Some departments may send and receive a large number of emails every day, while others may send and receive relatively few. The size of emails will also vary depending on the content and attachments. It may contain simple text information or large file attachments. The system will simulate a reasonable sending and receiving frequency of emails based on the daily email usage habits of the company, and perform diversified simulations of email size and attachment types. For example, the system simulates sending emails with attachments of different formats (such as documents, pictures, compressed packages, etc.), and adjusts the size of the email according to the actual situation, so that the email sending and receiving traffic is consistent with the real work scenario.

[0036] S4. Strategy for real-time monitoring of communication data access interfaces. The communication data access interface is the key channel for data to enter and exit the system, just like a door to protect data security. Any access request to communication data needs to go through this interface. By monitoring this interface in real time, we can capture the detailed information of each access request in a timely manner.

[0037] When an access request arrives, the system will quickly capture its metadata. Metadata is like the "identity card" of the access request, which contains key information such as the visitor's identity authority, request frequency, and operation behavior track. Among them, the visitor's identity authority clarifies the visitor's role in the system and the scope of operations that can be performed; the request frequency reflects the number of times the visitor initiates requests within a certain period of time; the operation behavior track records the visitor's specific operation process and path in the system.

[0038] Next, the system will make a preliminary judgment based on the identity and permissions of the visitor, and divide the visitor into two categories: system administrator permissions and ordinary user permissions. Ordinary users usually have only limited access rights in the system, mainly to meet their daily work needs. If the visitor is an ordinary user, due to the limited scope of their permissions, access to communication data should follow specific rules and processes. Once an ordinary user is detected to initiate an access request, the system will directly mark it as an abnormal access. This is because ordinary users usually do not have the permission to access communication data at will, and such access may mean the risk of data leakage or the user account being stolen.

[0039] For system administrators, although they have higher permissions in the system, it does not mean that all their access behaviors are legal. The system will further obtain the details of the administrator's access behavior and carefully review whether their operations comply with normal work specifications. If the administrator is found to have high-frequency queries, non-working hours access, cross-departmental data retrieval and other behaviors, the system will also mark it as abnormal access. High-frequency queries may be excessive data collection, which poses a risk of data abuse; non-working hours access may imply that the administrator uses his position to perform improper data operations; cross-departmental data retrieval may violate the company's data security and privacy regulations, because data from different departments usually have different access rights and confidentiality requirements.

[0040] When the system detects abnormal access, it immediately initiates a series of countermeasures. First, the hash value of the data block is extracted from the blockchain. As a secure and reliable distributed ledger technology, the blockchain stores the hash values ​​of data blocks, which are important indicators of data integrity. By extracting the hash value, the system can ensure the integrity and authenticity of the data in subsequent operations.

[0041] At the same time, according to the identity and permissions of the visitor, they are further divided into the same-level visitors and high-level visitors. For the same-level visitors, they are usually at the same permission level as the owner of the accessed data, and their understanding of the data is relatively limited. For this type of visitor, the system will generate semantically contradictory bait records. Specifically, the key sensitive information in the real private chat records is replaced with words that are obviously inconsistent with the context semantics. For example, the content about "salary negotiation" in the chat record is replaced with "travel plan", making the information obtained by the visitor semantically confusing and unable to obtain real and effective sensitive information.

[0042] As for high-level visitors, they may have a deeper understanding of the system and data and have stronger discernment. In order to confuse such visitors, the system will generate highly simulated bait records. This process is based on a pre-trained language model, which has been trained on a large amount of text data and can learn the patterns and rules of language. The system will use the pre-trained language model to generate semantically reasonable but false text based on the keyword distribution and sentence structure of the real data. The bait records generated in this way are very similar to the real data in form and semantics, but actually contain false information, which can effectively mislead high-level visitors.

[0043] When returning the decoy record, the system will also synchronously perform a data lineage obfuscation operation. The purpose of this operation is to further increase the difficulty for attackers to analyze and obtain real data. Specifically, it includes two aspects: First, modify the timestamp label of the data block. The timestamp records the time when the data is generated or modified, and is an important part of the data lineage relationship. The system will randomly offset the timestamp, causing a logical fault with the original communication sequence. For example, the timestamp of the data block originally generated at 10 am is changed to 3 pm, making it difficult for attackers to restore the real communication process based on the time sequence. Second, embed a forged protocol identifier in the header of the data block. The protocol identifier is used to identify the transmission protocol and format of the data. The system will select the same identifier as the working business protocol. In this way, the attacker will mistakenly believe that the data obtained is normal working business data, thereby further confusing his judgment.

[0044] Finally, the system will return the carefully processed decoy record and the real hash value to the access end. The return of the real hash value is to allow the access end to verify the integrity of the data, while the decoy record effectively protects the real communication data from being leaked. Through this series of measures, we can take effective response strategies in time when abnormal access is detected, and maximize the security and privacy of communication data.

[0045] S5. Blockchain smart contract is an automated contract based on blockchain technology. It can automatically execute corresponding operations according to preset rules, and its operation process has the characteristics of being tamper-proof, open and transparent, providing reliable protection for risk assessment of access behavior.

[0046] Based on blockchain smart contracts, each access behavior is recorded and analyzed in detail. It will comprehensively consider multiple key factors, such as the identity of the visitor, access time, access frequency, access data content, etc., and assign a risk score to each access behavior through the built-in risk assessment algorithm. This score can intuitively reflect the potential risk level of the access behavior.

[0047] During the continuous monitoring process, if the smart contract detects several consecutive abnormal access situations, it means that there may be a serious security threat. Abnormal access may be manifested as frequent login attempts by unauthorized users, abnormally high-frequency queries on sensitive data, abnormal access during non-working hours, etc. Once this happens, the system will quickly trigger the data self-destruction program.

[0048] The data self-destruction program is the last line of defense to ensure data security. When the program is triggered, the system will immediately perform multi-layer overwrite encryption operations on the associated data blocks. Multi-layer overwrite encryption is a highly secure encryption method that encrypts data blocks multiple times, using different encryption algorithms and keys each time. In this way, the original information in the data block will be completely disrupted, generating an irreversible garbled sequence. Even if an attacker obtains this data, he cannot restore the original valid information through decryption.

[0049] At the same time, the system will send a fake data corruption error code to the access end. This error code will make the access end mistakenly believe that the data has been damaged during transmission or storage, and thus give up further acquisition and analysis of the data. In addition, the system will immediately terminate the connection with the access end, cutting off the attacker's way to continue to obtain data, minimizing the losses caused by data leakage.

[0050] S6. When the system detects abnormal access, it means that the current data security is facing severe challenges. In order to further strengthen the protection of real private communication traffic, the system will dynamically increase the generation intensity of network traffic simulation. Network traffic simulation is an effective security protection method. It masks the real private communication traffic by simulating normal workflow traffic, making it difficult for attackers to distinguish the real data transmission from the network traffic.

[0051] In the process of improving the intensity of network traffic simulation, the system will inject virtual conference feature packages into the workflow traffic. The virtual conference feature package contains various network traffic features required to simulate real conference scenarios, such as periodic screen sharing requests, transmission of audio and video streams, interaction of conference control commands, etc. These features can make the simulated workflow traffic more realistic and highly similar to the real conference traffic features.

[0052] At the same time, the system will also generate fake email sending and receiving records that match the employee's position. Employees in different positions have different email usage patterns in their daily work. The system will simulate email sending and receiving records that match their work characteristics based on the employee's position information. For example, for employees in sales positions, emails related to customer communication, quotation, order confirmation, etc. will be simulated; for employees in technical positions, emails related to technical discussions, problem feedback, code updates, etc. will be simulated. By generating these fake email sending and receiving records, the complexity and confusion of network traffic are further increased.

[0053] In order to make it more difficult to distinguish between real private communication traffic and simulated traffic, the system will create a traffic feature confusion matrix. This matrix will conduct a detailed analysis and comparison of real private communication traffic and simulated traffic in terms of latency, packet size, and other dimensions. By adjusting the parameters of the simulated traffic, the simulated traffic is highly aligned with the real private communication traffic in these dimensions. For example, the packet size distribution of the simulated traffic is made similar to that of the real private communication traffic, and the latency characteristics of the two are made as consistent as possible. In this way, it is difficult for attackers to distinguish the real private communication traffic from these characteristics when performing traffic analysis.

[0054] When a visitor attempts to analyze network traffic to obtain the real communication content, the system triggers a protocol reflection attack. Protocol reflection attack is a clever counterattack strategy that redirects the parsing instructions issued by the access end to a preset virtual protocol parser. This virtual protocol parser returns response data with a compliant format but invalid content. In other words, although the response data conforms to the normal protocol specifications in format, the content contained in it is false and has no practical meaning. At the same time, the system will also implant misleading error messages in the logs of the access end. These error messages will make visitors mistakenly believe that there is a problem with their own analysis method, or that the unstable network environment has caused the data parsing to fail, thereby effectively concealing the existence of the protection system and further increasing the difficulty for attackers to obtain real data.

[0055] The above is a detailed description of an embodiment of the present invention, but the content is only a preferred embodiment of the present invention and cannot be considered to limit the scope of implementation of the present invention. All equivalent changes and improvements made within the scope of the present invention should still fall within the scope of the patent coverage of the present invention.

Claims

1. A communication data leakage detection and protection method combined with deep learning, characterized in that: The following steps are involved: Collect users' chat records, extract keywords and sentiment trends from the chat records based on natural language processing technology, input keywords and sentiment trends into the deep learning model, train based on labeled data, and divide the chat records into work chat records and private chat records; After obtaining the user's private communication encryption instructions, the private chat records are divided into several data blocks, a corresponding hash value is generated for each data block, and the hash value and data block are stored on the blockchain node. The data block is encrypted using a symmetric encryption algorithm, and the encryption key form is customized by the employee; Calculate the ratio of private chat records to work chat records in a unit time. When the ratio is greater than a preset threshold, start the network traffic simulation mode to simulate the work traffic characteristics of the set type. Monitor the access interface of communication data in real time, capture the metadata of access requests, extract the identity authority, request frequency and operation behavior track of the visitor, and determine whether it is an abnormal access. When abnormal access is detected, extract the hash value of the data block from the blockchain, and dynamically generate a bait record containing false keywords based on the visitor's identity authority, and return the bait record and the real hash value to the access end; Access behavior is assessed for risk through blockchain smart contracts. If several consecutive abnormal accesses are detected, the data self-destruction program is triggered to encrypt the associated data blocks and terminate the connection.

2. According to the method for detecting and protecting communication data leakage combined with deep learning in claim 1, it is characterized in that: It also includes dynamically increasing the generation intensity of network traffic simulation when abnormal access is detected, injecting virtual meeting feature packets into workflow traffic, generating fake email sending and receiving records that match employee positions, and establishing a traffic feature confusion matrix to align real private communication traffic with simulated traffic in terms of latency and packet size. When a visitor attempts to perform traffic analysis, a protocol reflection attack is triggered, redirecting the parsing instructions of the access end to the preset virtual protocol parser, which returns response data with a compliant format but invalid content.

3. According to the method of claim 1, the method is characterized in that: The blockchain node adopts a distributed storage architecture, and data blocks and hash values ​​are dispersedly stored on multiple storage nodes.

4. According to the method for detecting and protecting communication data leakage combined with deep learning in claim 1, it is characterized in that: The natural language processing technology includes lexical analysis, syntactic analysis and semantic analysis. Lexical analysis decomposes the chat record text into individual words and morphemes; syntactic analysis determines the grammatical relationship between words and constructs the grammatical structure of the sentence; Semantic analysis understands the actual meaning of sentences and texts, and extracts keywords and sentiment tendencies from chat records.

5. According to the method for detecting and protecting communication data leakage combined with deep learning in claim 1, it is characterized in that: The deep learning model is based on a neural network architecture with an attention mechanism. The labeled chat record data is divided into a training set and a validation set. The training set is used for preliminary learning of model parameters, and the validation set is used to adjust the hyperparameters of the model. The cross entropy loss function is used to measure the difference between the model prediction results and the true labels, and the model parameters are updated through the back propagation algorithm.

6. The communication data leakage detection and protection method combined with deep learning according to claim 1 is characterized in that: In the network traffic simulation: The simulated set types of work traffic characteristics include file transfer traffic, video conferencing traffic, and email sending and receiving traffic; for file transfer traffic, the transmission rate, data packet size, and transmission time interval of different file types are simulated; For video conferencing traffic, the bandwidth usage, frame rate, and resolution changes of audio and video streams are simulated; for email sending and receiving traffic, the sending and receiving frequency of emails, email size, and attachment type are simulated.

7. The communication data leakage detection and protection method combined with deep learning according to claim 1 is characterized in that: The process of determining whether it is an abnormal access is: The visitor's identity permissions are used to determine whether he has system administrator permissions or ordinary user permissions. If he is an ordinary user, it will be directly marked as abnormal access. For system administrators, the visitor's access behavior is obtained. If there are high-frequency queries, non-working hours access, and cross-departmental data retrieval, it will be marked as abnormal access.

8. A communication data leakage detection and protection method combined with deep learning according to claim 7, characterized in that: The bait record containing false keywords dynamically generated according to the visitor's identity authority includes: Visitors are divided into visitors of the same level and high-level visitors according to the identity permissions. For visitors of the same level, semantically contradictory bait records are generated, and the key sensitive information in the real private chat records is replaced with words that are obviously inconsistent with the context semantics; for high-level visitors, highly simulated bait records are generated, and semantically reasonable but false texts are generated based on the keyword distribution and sentence structure of the real data based on the pre-trained language model; and when returning the bait record, data lineage obfuscation is performed synchronously. When modifying the timestamp label of the data block, the timestamp is randomly offset to create a logical fault with the original communication timing. When embedding a forged protocol identifier in the data block header, an identifier that is the same as the working business protocol is selected.

9. The method for detecting and protecting communication data leakage combined with deep learning according to claim 1, characterized in that: The data self-destruction procedure includes: Perform multiple layers of overwrite encryption on the associated data blocks to generate an irreversible garbled sequence, send a forged data corruption error code to the access end, and terminate the connection.

Images