Self-adaptive data encryption method based on risk driving

Abstract

The invention provides an adaptive data encryption method based on risk driving, and belongs to the technical field of data security based on deep learning. The method comprises the following steps: firstly, constructing a multi-dimensional input feature by collecting context information such as a communication behavior sequence, a topological structure and an equipment state; secondly, designing a communication risk intelligent assessment module based on an echo state network and a multi-head attention mechanism to realize joint identification of communication behavior types and risk levels; then, constructing an encryption strategy decision module composed of a rule tree and a strategy neural network cooperatively, and obtaining an optimal disturbance level, a disguise level, an encryption algorithm, a channel type and other strategy combinations in a limited strategy space according to an identification result; and finally, executing structure disturbance, behavior camouflage and data encryption packaging according to a strategy result, and performing secure transmission through a hidden channel. The method breaks through the limitations of lack of context modeling, uncontrollable strategy acquisition, extensive encryption granularity and the like in the traditional communication encryption technology, and has remarkable technical advantages.

Description

Technical Field

[0001] The present invention belongs to the technical field of data security based on deep learning, and particularly relates to a risk-driven adaptive data encryption method. Background Art

[0002] With the rapid popularization of heterogeneous communication devices in scenarios such as smart terminals and industrial Internet of Things, network communication data presents new characteristics such as complex behavior patterns, dynamically changing communication structures, and highly uncertain context environments. In this context, traditional communication protection mechanisms that rely on static encryption configurations or unified policy templates are difficult to meet the actual security requirements. On the one hand, the attack means are becoming increasingly intelligent and refined, and attackers can identify traffic, restore data, and even track behaviors through pattern learning of communication behaviors, structures, and paths, thus bypassing the protection boundaries of traditional encryption means. On the other hand, existing encryption systems generally lack the ability to dynamically perceive communication context risks and cannot adaptively adjust encryption policies according to communication scenarios, behavior types, and device states, resulting in difficulty in achieving an effective balance between insufficient protection and resource waste. Therefore, there is an urgent need to design an intelligent system with communication risk identification and encryption policy adaptation capabilities, which can synergistically generate and execute customized scrambling camouflage and encryption encapsulation operations based on the perception of communication context and risk levels, so as to achieve dual protection at the communication behavior and structure levels, and significantly improve anti-identification, anti-inference, and transmission security.

[0003] Currently, the encryption protection technologies for communication security can be mainly divided into the following three categories: (1) Preset encryption methods based on static configuration: This method usually configures fixed encryption algorithms (such as AES-128, SM4, etc.) for various communication tasks. Some systems select different encryption intensities according to the types of communication services, but the overall strategy is fixed and lacks the ability of dynamic adjustment. In the actual complex environment, when the communication risk level increases or the behavior pattern is abnormal, such methods are difficult to respond in a timely manner and are easily bypassed by attackers through traffic feature recognition and pattern matching, resulting in encryption failure. In addition, due to the inability of the strategy to be adjusted according to the communication context, problems of coexistence of insufficient protection and resource waste often occur. (2) Policy decision-making methods based on rules or expert systems: This type of method mainly generates encryption parameter configurations according to behavior categories and preset conditions through manually defined rule trees, conditional paths, or policy templates, and has certain interpretability and controllability. However, this method relies on fixed rules, lacks self-adaptation ability in the face of diverse communication behavior patterns and evolving attack methods, has a lag in policy response, and is difficult to expand the rule base and has a high maintenance cost. At the same time, the output policies lack personalization and optimality and are difficult to achieve an effective balance between security and system resources. (3)End-to-End Policy Learning Method Based on Neural Network: This method constructs a mapping model using structures such as convolutional neural networks and multi-layer perceptrons, attempting to directly learn and predict encryption policy parameters from communication data, with certain modeling capabilities and data-driven advantages. However, in practical applications, such models mostly rely only on the input of raw communication data, ignoring key context information such as topological structure and device status, so their expressive ability is limited. At the same time, the lack of an external rule constraint mechanism leads to poor controllability of the output policy and is prone to unexpected results. Therefore, in complex policy spaces or multi-objective tasks, the training stability of such models is poor and their security and robustness are difficult to guarantee. Summary of the Invention

[0004] In view of the above problems, the present invention proposes an adaptive data encryption method based on risk driving, including the following processes: S1. Obtain communication behavior sequences, communication topology features, and device status features in real time to construct multi-dimensional input features; S2. Input the multi-dimensional input features into the trained communication risk intelligent evaluation module to output the communication risk level and behavior type. The communication risk intelligent evaluation module is a three-stage modeling framework that comprehensively perceives the behavior evolution pattern and context constraint conditions in the communication process and jointly identifies the communication behavior type and potential risk level; S3. Input the communication risk level and behavior type obtained in S2 into the trained encryption policy collaborative decision-making module to output encryption policy parameters. The encryption policy collaborative decision-making module consists of a rule tree and a policy neural network. The rule tree outputs the policy candidate range and structure template according to the communication risk level and behavior type, guiding the policy neural network to obtain the best perturbation level, camouflage level, encryption algorithm, and channel configuration in the limited space; S4. Based on the encryption policy parameter results, perform semantic perturbation, path camouflage, and data encryption and encapsulation operations; and the scrambled and encrypted communication content is sent through a specified covert channel, and the receiving end restores the original data according to the perturbation parameters.

[0005] Preferably, the communication behavior sequence is used to reflect the dynamic change process of communication behavior, including time stamps , data direction , source port , target port , application identifier , data packet length ; The communication topology features reflect the interaction relationship between the terminal and external nodes, including the connection frequency of the peer node , path hop count , node activity ; Device status characteristics Provides the resource constraints and network environment background of the communication process, including the current CPU utilization , battery power percentage , network connection type .

[0006] Preferably, the construction method of the data set for training the communication risk intelligent assessment module and the encryption policy collaborative decision-making module includes: With a data collection period , within this time period, a total of N communication behavior sequence characteristics are collected, and the communication topology class feature data and device status feature data are statistically analyzed; For the data samples collected in this sampling period, the network security expert judges the risk level of this communication , as well as the communication behavior type ; among them, the risk level , and The higher it is, the greater the potential risk; the communication behavior type Includes login authentication, payment transactions, chat message transmission, file upload / download, cloud synchronization / data backup, application update and patch acquisition, domain name resolution / routing switching, and unknown or abnormal communication behaviors; The network security expert combines the policy knowledge base to select the optimal policy label for each group of communication inputs, including the perturbation level , the disguise level , the encryption algorithm type and the channel type ; among them, the perturbation level , indicating the intensity of the perturbation of the communication data structure; and Indicates no perturbation, Indicates the maximum perturbation; the disguise level , and Indicates that no disguise policy is enabled, Indicates full-strength disguise; the encryption algorithm type Includes the AES-128 algorithm, the AES-256 algorithm, the SM4 algorithm, and the ChaCha20 algorithm; the channel type Includes the TLS protocol, the WebSocket channel, the proxy relay, and the VPN-Tunnel tunnel.

[0007] Preferably, the communication risk intelligent assessment module includes a behavior dynamic perception channel, a context state representation unit, and a feature fusion and risk identification unit; The behavioral dynamic perception channel takes the time-series data of communication behaviors as input, constructs a behavioral dynamic modeling channel using a multi-level Echo State Network (ESN), and extracts deep dynamic features in the process of behavioral evolution; The context state representation unit is used to perceive and encode the non-time-series context information in the communication process, and complement the static background features for risk judgment; After completing the time-series modeling of communication behaviors and the static perception of context states, the feature fusion and risk identification unit is used for the fusion modeling and joint output of the two types of features to complete the synchronous identification of communication behavior types and risk levels.

[0008] Preferably, the behavioral dynamic perception channel is specifically as follows: The first ESN layer takes the time-series data of communication behaviors as input and obtains an initial time-series feature representation ; afterwards, the second ESN layer simultaneously receives and as input to construct an enhanced expression of short-term behavioral features and output an intermediate representation feature ; the third ESN layer takes , and as input, and through progressive dynamic memory modeling, obtains a high-order behavioral state representation ; finally, is mapped to a unified hidden space by a fully connected layer, and the ReLU activation function is introduced to introduce non-linear expression ability, and finally the channel obtains the behavioral dynamic semantic feature .

[0009] Preferably, the context state representation unit is specifically as follows: Taking the concatenation of communication topology data and device status data as input, and performing high-dimensional representation mapping through two serial multi-layer perceptron structures; moreover, a ReLU activation function is connected after each multi-layer perceptron to enhance non-linearity, and finally the context state feature is obtained.

[0010] Preferably, the feature fusion and risk identification unit is specifically as follows: Concatenate the behavioral dynamic semantic feature obtained from the behavioral dynamic perception channel and the context state feature obtained from the context state representation unit to obtain a complete fused feature vector ; subsequently, capture the correlation between different behavioral dimensions and context factors through a multi-head attention mechanism, highlight the information most relevant to risk prediction, and obtain an attention feature ; then, Input into the fully connected layer and implement non-linear transformation at the semantic level through the ReLU activation function to obtain high-order fusion features ; Finally, this high-order fusion feature Ultimately passes through two output branches: one adopts layer normalization and the Softmax activation function to output the recognition result of the communication behavior type ; the other suppresses overfitting through the Dropout layer and outputs the risk level detection result in a linear activation manner .

[0011] Preferably, the policy neural network is specifically: First, the recognized communication risk level , communication behavior type and device status features are concatenated into a group of multi-dimensional policy context vectors . After that, to enhance the non-linear modeling ability, this vector is projected through two fully connected layers and a ReLU activation function to output the policy semantic representation features ; After that, use layer normalization and the Softmax activation function to output the probability distribution of the encryption algorithm , and the probability distribution of the channel type ; use the Dropout layer and the Sigmoid activation function to output the prediction result of the perturbation level , and the prediction result of the camouflage level ; Finally, constrain the output space of the policy neural network through the mask vector to obtain the final adaptive encryption policy result: ; Among them, is the predicted best encryption algorithm, is the best channel type, is the best perturbation level, is the best camouflage level.

[0012] Preferably, the rule tree is a multi-layer conditional judgment structure. Using the communication risk level and communication behavior type as input conditions, perform conditional path matching layer by layer to output decision-making information for constraining the inference space of the policy neural network, including: (1) Determination of the policy candidate range: including the value range of the perturbation level and the camouflage level as well as the optional encryption algorithms A set is used to construct a mask vector and inject it into the output layer of the policy neural network to implement the softmax output space limitation; specifically including: The first layer is the policy strength evaluation layer, which divides according to the communication risk level into three intervals; The second layer is the encryption algorithm recommendation layer, which jointly determines the optional encryption algorithms according to the communication risk level and the behavior type ; The third layer is the channel adaptation selection layer, which selects candidate channel types according to the behavior type to control the concealment and resource efficiency of the communication path ; (2) Construct a mask based on the policy candidate range : To constrain the output space of the policy neural network, the candidate set obtained from the rule tree is converted into a mask vector and injected into the output layer of the model for control; For the two discrete variables of encryption algorithm and channel type, a boolean mask of the same length as the output dimension is constructed. A mask value of 1 indicates that the category is allowed by the rule tree, and a mask value of 0 indicates that the output is prohibited; this mask is multiplied element-wise with the original output of the model to achieve probability normalization and prediction selection only within the range defined by the rule tree; (3) Determine the structure template: Based on the policy candidate range, determine a set of optimal recommended policy combinations: ; ; Among them, and are the recommended perturbation level and the recommended camouflage level respectively, obtained by calculating the median of the candidate range and the median of the candidate range; is the recommended encryption algorithm, obtained by selecting the highest priority item from the encryption algorithm candidate set recommended by the rule tree; similarly, is the recommended channel type, also obtained by selecting the highest priority item from the candidate set.

[0013] Preferably, the S4 includes three execution stages: structural perturbation processing, behavior camouflage, encryption encapsulation, and channel scheduling; In the structural perturbation processing stage, according to the perturbation level output by the policy , dynamic multi-level perturbation operations are performed: When the perturbation level is low, that is , the system only performs basic field rearrangement and field renaming to disrupt the structural characteristics of the communication message; When the perturbation level is medium, that is When it is [a certain condition], further add pseudo-field injection and fixed-pattern interference; When the perturbation level is high, that is When it is [a certain condition], perform semantic-level perturbation of the communication structure template to enhance the unrecognizability of the traffic; During the execution stage of behavior camouflage, according to the camouflage level in the policy Control the external manifestation of the communication behavior to enhance the anti-traffic analysis ability: When it is [a certain condition], only perform low-frequency port perturbation and path randomization; When it is [a certain condition], enable the relay hop proxy mechanism and switch the source IP and TTL perturbation; When it is [a certain condition], the system simulates the communication behavior of typical applications and constructs communication rhythm interference in the time series to achieve behavior-level mimicry camouflage; In the encryption encapsulation and channel scheduling stage, according to the obtained best encryption algorithm type and the best channel type , start the corresponding encryption algorithm and select the corresponding communication channel for data encapsulation and transmission to ensure the encryption integrity and path concealment during the transmission process.

[0014] Preferably, all scrambling and encryption contents in the encryption encapsulation and channel scheduling stage are accompanied by a descrambling parameter index or indicator to ensure that the receiving end can perform secure decoding and restoration.

[0015] Compared with the prior art, the innovation points and beneficial effects of the present invention include: (1) Construction of a multi-modal communication context feature system: Introduce three types of heterogeneous data, namely communication behavior sequences, communication topology structures, and device states, as context inputs, and construct a multi-dimensional feature modeling system for risk recognition to achieve a comprehensive perception of the dynamics, structural relevance, and resource background constraints of communication behaviors; (2) Design of a communication risk intelligent assessment model: Aiming at the strong temporal sequence and context heterogeneity of communication behaviors, use a multi-layer echo state network (ESN) to extract the dynamic features of communication behaviors, and introduce context state encoding and multi-head attention mechanisms for feature fusion and importance modeling, so as to achieve the joint recognition of behavior types and risk levels, and improve the lightweight and practicality of the model; (3) A policy acquisition architecture that combines a rule tree and a policy neural network: The present invention combines an interpretable rule tree mechanism and a learnable policy neural network to form a controlled policy space inference structure; the rule tree limits the policy candidate range according to the communication risk level and behavior type, and the neural network outputs policy parameters such as perturbation level, camouflage level, encryption algorithm, and channel type on this basis, realizing the unity of the rationality and controllability of policy acquisition; (4)Strategy-driven hierarchical scrambling and covert encryption execution mechanism: The present invention divides the strategy execution into three layers of operations: structural perturbation, behavior disguise, and encryption encapsulation. It dynamically adjusts the structure, behavior characteristics, and communication path of communication messages according to different strategy combinations, comprehensively improving the anti-identification, anti-traffic analysis ability, and path concealment of encrypted communication, and is applicable to the fine-grained security protection requirements in multiple types of communication scenarios.

[0016] The present invention breaks through the limitations of traditional communication encryption technologies, such as the lack of context modeling, uncontrollable strategy acquisition, and rough encryption granularity, by constructing a four-stage closed-loop architecture of "context awareness - risk assessment - strategy collaboration - encryption execution", and has significant technical and practical advantages. On the one hand, the system can obtain differentiated strategy combinations according to communication scenarios, behavior types, and risk levels, realizing an adaptive, secure, and controllable communication encryption scheme. On the other hand, the strategy execution covers two levels of structural perturbation and behavior disguise, effectively enhancing the robustness and concealment of encrypted communication in high-dynamic and high-adversarial environments. Brief Description of the Drawings

[0017] Figure 1 is the overall implementation logic flow chart of the present invention.

[0018] Figure 2 is the network structure diagram of the communication risk intelligent assessment module of the present invention.

[0019] Figure 3 is the structure diagram of the encryption strategy collaborative decision-making module of the present invention.

[0020] Figure 4 is the experimental result diagram of the communication behavior recognition accuracy rate of the present invention.

[0021] Figure 5 is the experimental result diagram of the communication risk level prediction accuracy rate of the present invention.

[0022] Figure 6 is the experimental result diagram of the strategy output matching degree of the present invention.

[0023] Figure 7 is the experimental result diagram of the strategy output stability of the present invention. Detailed Embodiments

[0024] The present invention proposes an adaptive data encryption method based on risk drive, and the overall technical route process is as Figure 1 shown: Collection of communication context data and construction of training data sets: Collect communication behavior sequences, communication topologies, and device states to construct multi-dimensional input features; at the same time, combine expert annotation and simulation analysis to obtain communication risk levels, behavior types, and corresponding optimal encryption strategies, forming a communication risk recognition data set and a strategy configuration annotation data set; Design of Communication Risk Intelligent Assessment Module: This module is composed of an Echo State Network (ESN) and a multi-head attention mechanism; it takes the collected communication behavior sequences, communication topologies, and device states as inputs and outputs the communication risk level and behavior type; in addition, the model is trained based on the constructed communication risk identification dataset to obtain a trained communication risk intelligent assessment module, providing a decision-making basis for subsequent policy parameter configuration; Design of Encryption Policy Collaborative Decision-making Module: This module consists of a rule tree and a Policy Neural Network (PolicyNet). The rule tree outputs the policy candidate range and structure template based on the obtained communication risk level and behavior type, thereby guiding the policy neural network to obtain the optimal perturbation level, camouflage level, encryption algorithm, and channel configuration in a limited space and using them to drive communication execution; in addition, this module is trained based on the constructed policy configuration annotation dataset; Construction of Adaptive Encryption Execution Module Based on Policy Results: Perform semantic perturbation, path camouflage, and data encryption and encapsulation operations according to the obtained policy parameters; and the scrambled and encrypted communication content is sent through a specified covert channel to achieve double protection of the communication structure and behavior layer, and the receiving end can restore the original data according to the perturbation parameters.

[0025] The present invention will be further described below with reference to specific embodiments.

[0026] I. Collection of Communication Context Data and Construction of Training Dataset To achieve dynamic perception and risk judgment of communication behaviors, the present invention first constructs a communication context data collection method and a training dataset. By systematically collecting communication behavior sequences, communication topology structures, and device operation status information, and combining expert experience and simulation analysis, the risk level and behavior labels are obtained, providing a data basis for subsequent model training. The specific steps are as follows: 1. Selection of Communication Context Features: The present invention first selects multi-dimensional context features that can effectively characterize the communication process. This feature set mainly includes three categories of multi-dimensional context information collected during the communication process of communication terminals, including: (1) Communication Behavior Sequence Features Used to reflect the dynamic change process of communication behaviors, including timestamp , data direction , source port , target port , application identifier , packet length , that is ; (2) Communication Topology Features Reflect the interaction relationship between the terminal and external nodes, including the connection frequency of the peer node , path hop count 、 Node activity , that is ; (3) Device status characteristics provides the resource constraints and network environment background of the communication process, including the current CPU utilization , battery power percentage , network connection type , that is ; 2. Communication data collection: Construct multi-dimensional input based on the determined context characteristics; specifically, the data collection period is , and within this time period, a total of N communication behavior sequence characteristics are collected to obtain communication behavior time-series data , and ; where represents the communication behavior sequence characteristics collected in the th collection, and ; In addition, within the data collection period , statistical communication topology class feature data is collected, including the total connection frequency of the peer node , the total number of path hops , and the node activity within the current period , and form communication topology data , and ; Similarly, within the data collection period , statistical device status feature data is collected, including the average CPU occupancy rate within the current period , the average power percentage value , and the main network connection type , and form device status data , and ; 3. Construction of communication risk identification dataset: The present invention constructs a communication risk identification dataset based on the collected communication behavior time-series data , and periodic statistical information (including communication topology data and device status data ), for training the communication risk intelligent evaluation module; Specifically, for the data samples collected in this sampling period, the risk level of this communication is judged by network security experts , as well as the communication behavior type ; among them, the risk level , and the higher it is, the greater the potential risk; the communication behavior type Including login authentication, payment transactions, chat message transmission, file upload / download, cloud synchronization / data backup, application update and patch acquisition, domain name resolution / routing switching, and unknown or abnormal communication behaviors; Therefore, the input data for each set of communication risk identification data sets is , and the output identification result is ; Based on this principle, a total of sets are produced; 4. Construction of the policy configuration annotation data set: The present invention constructs a policy configuration annotation data set based on the collected device status data , as well as the risk level and the communication behavior type to train the encryption policy collaborative decision-making module, so as to achieve scenario-oriented adaptive policy acquisition; Specifically, network security experts combine the policy knowledge base to select the optimal policy labels for each set of communication inputs, including the perturbation level , the disguise level , the encryption algorithm type and the channel type ; Among them, the perturbation level represents the intensity of the perturbation of the communication data structure; and represents no perturbation, represents the maximum perturbation; the disguise level , and represents not enabling any disguise strategy, represents full-strength disguise; the encryption algorithm type includes the AES-128 algorithm, the AES-256 algorithm, the SM4 algorithm, and the ChaCha20 algorithm; the channel type includes the TLS (HTTPS) protocol, the WebSocket channel, the proxy relay (Proxy), and the VPN-Tunnel tunnel; Therefore, the input data for each set of policy configuration annotation data sets is ; the output identification result is ; Based on this principle, a total of sets of policy configuration annotation data sets are produced.

[0027] II. Design of the communication risk intelligent assessment module In view of the dynamic change characteristics of heterogeneous multi-source communication context information, the present invention designs a three-stage modeling framework, which is overall composed of a behavior dynamic perception channel, a context state characterization unit, and a feature fusion and risk identification unit. This module can comprehensively perceive the behavior evolution pattern and context constraint conditions in the communication process, and realize the joint identification of the communication behavior type and the potential risk level; the network structure of the communication risk intelligent assessment module is as shown in Figure 2as shown; 1. Design of Behavioral Dynamic Perception Channel: During the communication process, user behaviors exhibit obvious temporal correlation and phased changes. Therefore, this invention uses the time-series data of communication behaviors as input and constructs a behavioral dynamic modeling channel using a multi-level Echo State Network (ESN) to efficiently extract deep dynamic features during the behavior evolution process; Specifically, the first ESN layer takes the time-series data of communication behaviors as input and obtains an initial time-series feature representation ; Subsequently, the second ESN layer simultaneously receives and as input to construct an enhanced expression of short-term behavior features and output an intermediate representation feature ; The third ESN layer takes , and as input and obtains a high-order behavior state representation through progressive dynamic memory modeling; This structure can enhance the model's ability to perceive long-term dependencies in the behavior evolution path and improve the response sensitivity to abnormal behavior mutations; Finally, is mapped to a unified latent space by a fully connected layer, and the ReLU activation function is introduced to introduce non-linear expression ability, and finally the channel's behavioral dynamic semantic features are obtained; 2. Design of Context State Representation Unit: This unit is used to perceive and encode non-time-series context information during the communication process to complement the static background features for risk judgment; Specifically, this unit takes the concatenation of communication topology data and device status data as input and performs high-dimensional representation mapping through two serial multi-layer perceptron structures; Moreover, a ReLU activation function is connected after each multi-layer perceptron to enhance non-linearity, and finally the context state features are obtained; 3. Design of Feature Fusion and Risk Identification Unit: After completing the time-series modeling of communication behaviors and the static perception of context states, the feature fusion and risk identification unit is used for the fusion modeling and joint output of the two types of features to complete the synchronous identification of communication behavior types and risk levels; Specifically, the obtained behavioral dynamic semantic features and the obtained context state features are concatenated in channels to obtain a complete fusion feature vector ; Subsequently, the multi-head attention mechanism is used to capture the correlation between different behavior dimensions and context factors, thereby highlighting the information most relevant to risk prediction and obtaining the attention features ; Then, Input to the fully connected layer and perform a non-linear transformation at the semantic level through the ReLU activation function to obtain high-order fusion features ; Finally, this high-order fusion feature Finally, it passes through two output branches: one uses layer normalization and the Softmax activation function to output the recognition result of the communication behavior type ; the other suppresses overfitting through the Dropout layer and outputs the risk level detection result in a linear activation manner ; 4. Training of the communication risk intelligent evaluation module: Based on the constructed risk recognition data set, for the recognition result of the communication behavior type and the risk level detection result , respectively use the cross-entropy loss and the mean square error loss function to quantify the training error of the model; during the training process, the Adam optimizer is used for parameter update, and the gradient clipping mechanism is combined to avoid gradient explosion. Finally, a trained communication risk intelligent evaluation module is obtained, which can be directly used for the recognition of communication behavior types and the detection of risk levels.

[0028] III. Design of the encryption policy collaborative decision-making module To address the diverse security risks and resource constraints faced by different communication behavior scenarios, the present invention designs an encryption policy based on the collaborative reasoning of rule constraints and neural networks, which is composed of a rule tree and a policy neural network decision unit as a whole; this module can, based on the obtained recognition result of the communication behavior type and the risk level detection result , obtain an adaptive combination of encryption policies (including the perturbation level, the disguise level, the encryption algorithm type, and the channel configuration method), thereby driving the subsequent encryption execution process; the structure of the encryption policy collaborative decision-making module is as Figure 3 shown.

[0029] 1. Rule tree decision-making method: To achieve a policy space limitation with strong interpretability and high controllability, the present invention designs a rule tree structure with multi-layer conditional judgments, using the communication risk level and the communication behavior type as input conditions to perform layer-by-layer conditional path matching, and finally output two types of decision-making information for restricting the inference space of the policy neural network; specifically including:[[]] (1) Determination of the policy candidate range: including the value ranges of the perturbation level and the disguise level (such as , ), as well as the set of optional encryption algorithms (such as {AES-256, SM4}) and the channel type A set (such as {TLS, VPN}) for constructing a mask vector and injecting it into the output layer of the policy neural network to achieve softmax output space limitation; specifically including: ① The first layer is the policy strength evaluation layer, which divides into three intervals according to the communication risk level : If , it indicates low-risk communication, and the candidate range of the perturbation level is , and the candidate range of the disguise level is ; If , it indicates medium-risk communication, and the candidate range of the perturbation level is , and the candidate range of the disguise level is ; If , it indicates high-risk communication, and the candidate range of the perturbation level is , and the candidate range of the disguise level is ; In addition, if the communication behavior type belongs to critical tasks (including login authentication, payment transactions, unknown or abnormal communication behaviors), then the upper limit of the candidate range of the disguise level is increased by 0.1 and does not exceed 1.0; ② The second layer is the encryption algorithm recommendation layer, which jointly determines the optional encryption algorithms according to the communication risk level and the behavior type : If , in this case, it is a low-risk situation and no joint judgment is required, so the alternative lightweight algorithm is: ; If , in this case, it is a medium-risk situation, and joint judgment with the behavior type is required to balance security and resource consumption. When the behavior type is chat message transmission, cloud synchronization, application update and patch acquisition, and domain name resolution / routing switching, ; when is file upload / download, ; in addition, ; If , in this case, it is a high-risk situation, and extra attention is paid to high-risk behavior types, that is, when it is login authentication, payment transaction, unknown or abnormal communication behavior, ; in addition, ; ③ The third layer is the channel adaptation selection layer, which selects candidate channel types according to the behavior type to control the concealment and resource efficiency of the communication path, as follows: If the behavior type is chat message transmission, cloud synchronization / data backup, application update and patch acquisition, domain name resolution / routing switching, it is applicable to lightweight data streams; If the behavior type is file upload / download, login authentication or payment transaction, the encryption depth and relay protection capabilities are enhanced; If the behavior type is unknown or abnormal communication behavior, the anonymity and anti-traffic analysis capabilities are enhanced; (2) Construct a mask based on the policy candidate range: To constrain the output space of the policy neural network, the present invention converts the candidate set obtained from the rule tree into a mask vector and injects it into the output layer of the model for control; Specifically, for two discrete variables of encryption algorithms and channel types, a Boolean mask of the same length as the output dimension is constructed. A mask value of 1 indicates that the category is allowed by the rule tree, and a mask value of 0 indicates that the output is prohibited; this mask is multiplied element-wise with the original output of the model, so as to realize probability normalization and prediction selection only within the range defined by the rule tree, and improve the security and rationality of the policy; (3) Determine the structure template: Based on the policy candidate range, determine a set of optimal recommended policy combinations: ; Among them, ; where and are the recommended perturbation level and recommended disguise level respectively, obtained by calculating the median of the candidate range and the median of the candidate range; is the recommended encryption algorithm, obtained by selecting the highest priority item from the candidate set of encryption algorithms recommended by the rule tree; similarly, is the recommended channel type, also obtained by selecting the highest priority item from the candidate set.

[0030] 2. Construction of Decision Neural Network: The policy neural network constructed in the present invention is used to obtain a policy output result including a perturbation level, a camouflage level, an encryption algorithm type, and a channel configuration method within the range of policy candidates defined by the rule tree, in combination with device status data, communication behavior types, and communication risk levels. Therefore, this module has the characteristics of strong semantic expression ability and structural control mechanism, and can achieve a policy acquisition process with high consistency and controllability. The specific content is as follows: First, the identified communication risk level , communication behavior type and device status feature vector are concatenated into a group of multi-dimensional policy context vectors . Then, to enhance the non-linear modeling ability, this vector is projected and mapped through two fully connected layers and a ReLU activation function to output policy semantic representation features ; After that, layer normalization and the Softmax activation function are used to output the probability distribution of the encryption algorithm , and the probability distribution of the channel type ; The Dropout layer and the Sigmoid activation function are used to output the prediction result of the perturbation level , and the prediction result of the camouflage level ; Finally, the output space of the policy neural network is constrained by a mask vector to obtain the final adaptive encryption policy result: ; Among them, is the predicted best encryption algorithm, is the best channel type, is the best perturbation level, is the best camouflage level.

[0031] 3. Training of Encryption Policy Collaborative Decision Module: During the training process, the model introduces a structural template supervision mechanism to further improve the consistency of the policy output, and matches the recommended policy combination obtained from the rule tree with the model output. Specifically, the error between the prediction result and the recommended policy combination is calculated through the L2 distance, and this error is used as an additional loss function to improve the semantic rationality and task fit of the policy; Finally, the encryption policy collaborative decision module is trained based on the constructed policy configuration annotation data set. During the training process, the Adam optimizer is used to update the parameters, and finally the trained encryption policy collaborative decision module is obtained, which can directly obtain the adaptive encryption policy.

[0032] IV. Design of Adaptive Encryption Execution Module Based on the obtained optimal encryption policy combination results (including the perturbation level , disguise level , encryption algorithm type and channel configuration method ), the present invention constructs an encryption policy execution mechanism for actual communication tasks, realizing double-layer protection of the communication data structure and behavior pattern, and ensuring communication privacy, anti-identification and transmission integrity; this module mainly includes three execution stages: structural perturbation processing, behavior disguise, encryption encapsulation and channel scheduling, which are specifically as follows: Structural perturbation processing stage: According to the perturbation level output by the policy , dynamically execute multi-level perturbation operations: When the perturbation level is low, that is , the system only performs basic field rearrangement and field renaming to scatter the structural features of the communication message; When the perturbation level is medium, that is , pseudo-field injection and fixed pattern interference are further added; When the perturbation level is high, that is , execute semantic-level perturbation of changing the communication structure template to enhance the non-identifiability of the traffic.

[0033] Behavior disguise execution stage: Control the external manifestation of the communication behavior according to the disguise level in the policy to enhance the anti-traffic analysis ability: When , only perform low-frequency port perturbation and path randomization; When

[0034] , the relay hop proxy mechanism is enabled and the source IP and TTL perturbation are switched; When , the system simulates typical application communication behaviors and constructs communication rhythm interference in the time series to achieve behavior-level mimicry disguise. Encryption encapsulation and channel scheduling stage: According to the obtained optimal encryption algorithm type

[0035] and the optimal channel type , start the corresponding encryption algorithm, and select the corresponding communication channel for data encapsulation and transmission to ensure encryption integrity and path concealment during the transmission process; In addition, all scrambled and encrypted contents are attached with descrambling parameter indexes or indicators to ensure that the receiving end can perform secure decoding and restoration; therefore, this module can achieve differential protection and context adaptation for each communication flow, and enhance the anti-identification and anti-attack capabilities of encrypted communication in real scenarios.

[0035] V. Performance Verification of the Communication Risk-Driven Adaptive Encryption Method To verify the application effect of the communication risk-driven adaptive encryption method proposed in the present invention in multi-type communication scenarios, especially its ability to accurately identify communication behaviors, perceive risk levels, and generate reasonable encryption strategies, the present invention designs and implements a series of simulation experiments covering actual threat scenarios in typical communication tasks, and introduces specific comparison algorithms for performance comparative analysis.

[0036] Specifically, this experiment constructs a simulation dataset based on the eight types of communication behavior defined in the patent, including: (1) Login authentication: such as system login and identity verification; (2) Payment transaction: such as mobile payment and transfer operation; (3) Chat message transmission: such as text or voice communication in instant messaging applications; (4) File upload / download: such as FTP transmission and cloud disk synchronization; (5) Cloud synchronization / data backup: such as background automatic backup and cross-device data synchronization; (6) Application update and patch acquisition: such as device firmware update and patch download request; (7) Domain name resolution / routing switch: such as DNS query and dynamic change of network routing; (8) Unknown or abnormal communication behavior: such as abnormal port access, high-frequency burst requests, and frequent changes in communication paths, etc.

[0037] In addition, this experiment compares the method of the present invention with the following two specific representative algorithms: the policy learning model based on gated recurrent unit (GRU) and the policy acquisition model based on multi-layer perceptron (MLP); and the experiment selects the following four performance indicators for comprehensive evaluation from two aspects of communication recognition and encryption policy generation: (1) Communication behavior recognition accuracy: It measures the classification ability of the model for eight types of communication behaviors. The calculation method is the proportion of the number of correctly predicted samples of each type in the total number of samples. The higher the value, the better the recognition accuracy; (2) Communication risk level prediction accuracy: It is used to evaluate the prediction accuracy of the model for the risk level of communication context. It is calculated based on the consistency between the expert-annotated risk level and the model output. If the difference between the two is less than 5%, it indicates that the prediction result is valid. Therefore, the higher the value, the higher the prediction accuracy; (3) Policy output matching degree: It is used to measure the closeness between the output of the policy network and the expert-prescribed policy label. Specifically, the reverse normalization score is calculated through the Euclidean distance error between four types of policy parameters (perturbation level, disguise level, encryption algorithm, channel type) and the label. The higher the index, the closer the policy generated by the model is to the ideal configuration, and the better the effect; (4) Policy output stability: It examines the fluctuation range of the model output policy for the same type of behavior task in different communication cycles, and statistically calculates the variance of the policy parameters in continuous tasks and reversely quantifies the score. The higher the value, the stronger the consistency of policy generation;

[0038] Figures 4 to 7 It is a line chart of the evaluation results of the above four types of indicators in eight types of communication behavior scenarios, respectively showing the performance differences between the method of the present invention and two comparison algorithms, GRU and MLP, in various tasks.

[0039] From the experimental results, the method of the present invention shows excellent overall performance in the communication behavior recognition task. The recognition accuracy remains above 0.90 in various communication types, and especially in the scenario of "unknown or abnormal communication behavior", it can still maintain a relatively high recognition level (the accuracy rate reaches 0.88), reflecting good abnormal perception ability. In contrast, the GRU model has certain instability in dealing with high-dynamic behaviors, and the recognition accuracy fluctuates. The MLP model has relatively weak overall recognition ability due to its simplified structure and is difficult to effectively distinguish complex behavior features.

[0040] Secondly, in terms of predicting the communication risk level, relying on the modeling advantage of ESN for time series features and combining with context state representation, the present invention effectively improves the model's ability to judge the risk level. Compared with the GRU and MLP methods, the average recognition accuracy of the method of the present invention is about 12% and 20% higher respectively in multiple typical scenarios, verifying the effectiveness of the proposed structure in risk modeling.

[0041] In addition, for the policy output matching degree index, through the collaborative design of the rule tree constraint mechanism and the policy neural network, this method makes the output policy closer to the expert annotation results. Especially, the deviation from the ideal policy is the smallest in terms of the perturbation level and the encryption algorithm parameters, showing high consistency and scenario adaptation ability. Although the comparison algorithm GRU has certain learning ability, it is easily interfered by context changes, while the MLP has large output fluctuations due to the lack of structural guidance and the matching degree is significantly lower.

[0042] Finally, in terms of the stability of the policy output, the method of the present invention shows stronger result consistency in most task types. In periodic tasks such as "chat messages" and "file transfer", the variance of the policy output is the smallest in consecutive communication cycles, indicating that the model has good policy retention ability, significantly superior to the unstable performance of the GRU model in long-term dependence modeling and the high sensitivity of the MLP structure to input changes.

[0043] In summary, the experimental results fully verify that the communication risk-driven adaptive encryption method proposed by the present invention has high recognition accuracy, strong risk perception ability, policy output close to reality, and good stability and controllability in multiple types of communication behavior scenarios. This method can effectively cope with the dynamic changes and diverse security requirements in heterogeneous communication systems, and has engineering implementation value and application promotion prospects.

[0044] The above are only the preferred embodiments of the present application and are not intended to limit the present application. For those skilled in the art, various changes and modifications can be made to the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included within the protection scope of the present application.

[0045] Although the specific implementation manners of the present invention are described above, it is not a limitation on the protection scope of the present invention. Those skilled in the art should understand that, based on the technical solutions of the present invention, various modifications or deformations that can be made by those skilled in the art without creative efforts are still within the protection scope of the present invention.

Claims

1. A risk-driven adaptive data encryption method, characterized in that, It includes the following processes: S1. Obtain communication behavior sequences, communication topology features, and device status features in real time to construct multi-dimensional input features; S2. Input the multi-dimensional input features into the trained communication risk intelligent assessment module to output the communication risk level and behavior type; the communication risk intelligent assessment module is a three-stage modeling framework that comprehensively perceives the behavior evolution pattern and context constraint conditions during the communication process and jointly identifies the communication behavior type and potential risk level; S3. Input the communication risk level and behavior type obtained in S2 into the trained encryption policy collaborative decision-making module to output encryption policy parameters; the encryption policy collaborative decision-making module consists of a rule tree and a policy neural network. The rule tree outputs the policy candidate range and structure template according to the communication risk level and behavior type, guiding the policy neural network to obtain the best perturbation level, camouflage level, encryption algorithm, and channel configuration in the limited space; S4. Based on the encryption policy parameter results, perform semantic perturbation, path camouflage, and data encryption and encapsulation operations; and the scrambled and encrypted communication content is sent through a specified covert channel, and the receiving end restores the original data according to the perturbation parameters.

2. The risk-driven adaptive data encryption method according to claim 1, characterized in that: Communication behavior sequence Used to reflect the dynamic change process of communication behavior, including timestamps , data direction , source port , destination port , application identifier , packet length ; Communication topology features Reflect the interaction relationship between the terminal and external nodes, including the connection frequency of peer nodes , number of path hops , node activity ; Device status characteristics Provides the resource constraints and network environment background of the communication process, including the current CPU utilization , battery power percentage , network connection type .

3. The risk-driven adaptive data encryption method according to claim 2, characterized in that: The construction method of the data set for training the communication risk intelligent assessment module and the encryption policy collaborative decision-making module includes: With a data collection period , a total of N communication behavior sequence features are collected within this time period, and communication topology class feature data and device status feature data are statistically analyzed; For the data samples collected in this sampling period, the risk level of this communication is judged by cybersecurity experts , as well as the type of communication behavior ; among them, the risk level , and the higher it is, the greater the potential risk; the type of communication behavior includes login authentication, payment transactions, chat message transmission, file upload / download, cloud synchronization / data backup, application update and patch acquisition, domain name resolution / routing switch, and unknown or abnormal communication behaviors; Network security experts combine a policy knowledge base to select the optimal policy tags for each set of communication inputs, including the perturbation level , the disguise level , the encryption algorithm type and the channel type ; among them, the perturbation level indicates the intensity of the perturbation of the communication data structure; and indicates no perturbation, indicates the maximum perturbation; the disguise level , and indicates that no disguise policy is enabled, indicates full-strength disguise; the encryption algorithm type includes the AES-128 algorithm, the AES-256 algorithm, the SM4 algorithm, and the ChaCha20 algorithm; the channel type includes the TLS protocol, the WebSocket channel, the proxy relay, and the VPN-Tunnel tunnel.

4. The risk-driven adaptive data encryption method according to claim 1, characterized in that: The communication risk intelligent assessment module includes a behavior dynamic perception channel, a context state representation unit, and a feature fusion and risk identification unit; The behavior dynamic perception channel takes the time-series data of communication behaviors as input, constructs a behavior dynamic modeling channel using a multi-level echo state network (ESN), and extracts deep dynamic features during the behavior evolution process; The context state representation unit is used to perceive and encode the non-time-series context information during the communication process to complement the static background features for risk judgment; After completing the time-series modeling of communication behaviors and the static perception of context states, the feature fusion and risk identification unit is used for the fusion modeling and joint output of the two types of features to complete the synchronous identification of communication behavior types and risk levels.

5. The risk-driven adaptive data encryption method according to claim 4, characterized in that, The behavior dynamic perception channel is specifically: The first ESN layer takes the communication behavior time-series data as input and obtains the initial time-series feature representation ; then, the second ESN layer simultaneously receives and as input to construct an enhanced expression of short-term behavior features and output the intermediate representation features ; the third ESN layer takes , and as input, and through progressive dynamic memory modeling, obtains the high-order behavior state representation ; finally is mapped to a unified latent space by the fully connected layer, and the ReLU activation function is introduced to introduce non-linear expression ability, and finally the behavioral dynamic semantic features of this channel are obtained.

6. The risk-driven adaptive data encryption method according to claim 4, characterized in that, The context state representation unit is specifically: With communication topology data and device status data concatenated as input, high-dimensional representation mapping is performed through two serial multi-layer perceptron structures; and, after each multi-layer perceptron, a ReLU activation function is connected to enhance non-linearity, and finally context state features are obtained .

7. The risk-driven adaptive data encryption method according to claim 4, characterized in that, The feature fusion and risk identification unit is specifically: The behavioral dynamic semantic features obtained from the behavioral dynamic perception channel and the context state features obtained from the context state representation unit are concatenated in channels to obtain a complete fused feature vector ; Subsequently, the multi-head attention mechanism is used to capture the correlation between different behavioral dimensions and context factors, highlight the information most relevant to risk prediction, and obtain the attention features ; Then it is input into the fully connected layer and the ReLU activation function is used to achieve non-linear transformation at the semantic level to obtain high-order fused features ; Finally, this high-order fusion feature finally passes through two output branches: one uses layer normalization and the Softmax activation function to output the recognition result of the communication behavior type ; the other suppresses overfitting through the Dropout layer and outputs the risk level detection result in a linear activation manner .

8. The risk-driven adaptive data encryption method according to claim 1, characterized in that: The policy neural network is specifically: First, the identified communication risk level , communication behavior type and device status characteristics are concatenated into a group of multi-dimensional policy context vectors . Then, to enhance the non-linear modeling ability, this vector is projected and mapped through two fully connected layers and a ReLU activation function to output the policy semantic representation features ; After that, the probability distribution of the encryption algorithm is output using layer normalization and the Softmax activation function , as well as the probability distribution of the channel type ; the prediction result of the perturbation level is output using the Dropout layer and the Sigmoid activation function , as well as the prediction result of the camouflage level ; Finally, through the mask vector constrain the output space of the policy neural network to obtain the final adaptive encryption policy result: ； Among them, is the predicted best encryption algorithm, is the best channel type, is the best perturbation level, is the best camouflage level.

9. A risk-driven adaptive data encryption method as claimed in claim 1, wherein: S4 includes three execution stages: structural perturbation processing, behavior camouflage, encryption and encapsulation, and channel scheduling; During the structural perturbation processing stage, according to the perturbation level output by the strategy , dynamically execute multi-level perturbation operations: When the disturbance level is low, that is the system only performs basic field rearrangement and field renaming to break up the structural features of the communication message; When the disturbance level is medium, i.e., , pseudo-field injection and fixed-pattern jamming are further added; When the perturbation level is high, i.e., semantic-level perturbations to the communication structure template are performed to enhance the unrecognizability of the traffic; During the behavior camouflage execution phase, according to the camouflage level in the policy Control the external manifestation of communication behavior and enhance the anti-traffic analysis ability: When it is, only low-frequency port perturbation and path randomization are performed; When it is time, enable the relay hop proxy mechanism and switch the source IP and TTL perturbation; When the system simulates the communication behavior of typical applications and constructs the interference of the communication rhythm on the time series to achieve behavioral mimicry camouflage; Sealing and channel scheduling phase, according to the obtained optimal encryption algorithm type and the optimal channel type , start the corresponding encryption algorithm, and select the corresponding communication channel for data encapsulation and transmission to ensure the encryption integrity and path concealment of the transmission process.

10. A risk-driven adaptive data encryption method as claimed in claim 9, wherein: In the encryption and encapsulation and channel scheduling stage, all scrambled and encrypted content is attached with a descrambling parameter index or indicator to ensure that the receiving end can perform secure decoding and restoration.

Images