A risk-driven adaptive data encryption method

Abstract

The present invention provides a risk-driven adaptive data encryption method, which belongs to the field of data security technology based on deep learning. First, by collecting contextual information such as communication behavior sequences, topological structures and device states, multi-dimensional input features are constructed. Secondly, a communication risk intelligent assessment module based on echo state networks and multi-head attention mechanisms is designed to achieve joint identification of communication behavior types and risk levels. After that, an encryption strategy decision module composed of a rule tree and a policy neural network is constructed. According to the identification results, the optimal perturbation level, camouflage level, encryption algorithm and channel type strategy combination is obtained within a limited strategy space. Finally, structural perturbation, behavior camouflage and data encryption encapsulation are executed according to the strategy results, and secure transmission is carried out through a covert channel. The present invention breaks through the limitations of traditional communication encryption technology, such as lack of context modeling, uncontrollable strategy acquisition and coarse encryption granularity, and has significant technical advantages.

Description

Technical Field

[0001] The present invention belongs to the field of data security technology based on deep learning, and in particular relates to a risk-driven adaptive data encryption method. Background Art

[0002] With the rapid proliferation of heterogeneous communication devices in scenarios like smart terminals and the Industrial Internet of Things, network communication data is exhibiting new characteristics such as complex behavior patterns, dynamic and changing communication structures, and highly uncertain contextual environments. In this context, traditional communication protection mechanisms that rely on static encryption configurations or unified policy templates are no longer able to meet practical security needs. On the one hand, attack methods are becoming increasingly intelligent and sophisticated. Attackers can identify traffic, restore data, and even track behavior by learning patterns in communication behavior, structure, and paths, thereby circumventing the protection boundaries of traditional encryption methods. On the other hand, existing encryption systems generally lack the ability to dynamically perceive communication context risks and are unable to adaptively adjust encryption policies based on communication scenarios, behavior types, and device status. This leads to a difficult balance between insufficient protection and wasted resources. Therefore, there is an urgent need to design an intelligent system capable of both communication risk identification and encryption policy adaptation. This system can collaboratively generate and execute customized scrambling and encryption encapsulation operations based on communication context and risk level, thereby achieving dual protection at both the communication behavior and structure levels, significantly improving anti-identification and anti-inference capabilities, and ensuring transmission security.

[0003] Currently, encryption protection technologies for communication security can be divided into the following three categories:

[0004] (1) Preset encryption method based on static configuration: This method usually configures fixed encryption algorithms (such as AES-128, SM4, etc.) for various communication tasks. Some systems select different encryption strengths according to the type of communication business, but the overall strategy is fixed and lacks dynamic adjustment capabilities. In actual complex environments, when the communication risk level increases or the behavior pattern is abnormal, this type of method is difficult to respond in time and can be easily bypassed by attackers through traffic feature recognition and pattern matching, resulting in encryption failure. In addition, since the strategy cannot be adjusted according to the communication context, it often results in insufficient protection and waste of resources.

[0005] (2) Policy decision-making methods based on rules or expert systems: This type of method mainly generates encryption parameter configurations based on behavior categories and preset conditions through manually defined rule trees, conditional paths, or policy templates, and has a certain degree of explainability and controllability. However, this method relies on fixed rules and lacks self-adaptation capabilities in the face of the diversification of communication behavior patterns and the evolution of attack methods. The policy response is delayed, and the rule base is difficult to expand and the maintenance cost is high. At the same time, the output policy lacks personalization and optimality, making it difficult to achieve an effective balance between security and system resources.

[0006] (3) End-to-end policy learning method based on neural network: This method uses structures such as convolutional neural networks and multi-layer perceptrons to build a mapping model, attempting to directly learn and predict encryption policy parameters from communication data. It has certain modeling capabilities and data-driven advantages; however, in actual applications, this type of model mostly relies only on the original communication data input, ignoring key contextual information such as topology structure and device status, so its expression ability is limited; at the same time, the lack of external rule constraint mechanism leads to poor controllability of the output strategy, which is prone to unexpected results; therefore, in complex policy space or multi-objective tasks, the training stability of this type of model is poor and its security robustness is difficult to guarantee. Summary of the Invention

[0007] To address the above issues, the present invention proposes a risk-driven adaptive data encryption method, which includes the following steps:

[0008] S1, acquires communication behavior sequences, communication topology features, and device status features in real time to construct multi-dimensional input features;

[0009] S2: Input the multi-dimensional input features into the trained communication risk intelligent assessment module, and output the communication risk level and behavior type. The communication risk intelligent assessment module is a three-stage modeling framework that comprehensively perceives the behavior evolution pattern and contextual constraints during the communication process and jointly identifies the communication behavior type and potential risk level.

[0010] S3: Input the communication risk level and behavior type obtained in S2 into the trained encryption strategy collaborative decision-making module, and output encryption strategy parameters. The encryption strategy collaborative decision-making module is composed of a rule tree and a strategy neural network. The rule tree outputs a strategy candidate range and structure template based on the communication risk level and behavior type, guiding the strategy neural network to obtain the optimal perturbation level, camouflage level, encryption algorithm, and channel configuration in a limited space.

[0011] S4, based on the encryption strategy parameter results, performs semantic perturbation, path camouflage and data encryption encapsulation operations; and the scrambled and encrypted communication content is sent through a designated covert channel, and the receiving end restores the original data according to the perturbation parameters.

[0012] Preferably, the communication behavior sequence Used to reflect the dynamic changes in communication behavior, including timestamps , data direction , source port , Destination Port , application identification , Data packet length ;

[0013] Communication topology characteristics Reflects the interaction relationship between the terminal and external nodes, including the connection frequency of the peer node , path hop count Node activity ;

[0014] Device status characteristics Provides resource constraints and network environment context for the communication process, including current CPU utilization , battery percentage , Network connection type .

[0015] Preferably, the data set for training the communication risk intelligent assessment module and the encryption strategy collaborative decision module is constructed in the following manner:

[0016] Data collection cycle ,During this time period, a total of N communication behavior sequence features are collected, and communication topology feature data and device status feature data are counted;

[0017] For the data samples collected during the sampling period, network security experts determine the risk level of the communication. , and communication behavior types Among them, the risk level ,and The higher the value, the greater the potential risk; Communication behavior type These include login authentication, payment transactions, chat message transmission, file upload / download, cloud synchronization / data backup, application updates and patch acquisition, domain name resolution / route switching, and unknown or abnormal communication behavior;

[0018] Network security experts combine the policy knowledge base to select the optimal policy label for each set of communication input, including the disturbance level , camouflage level , encryption algorithm type and channel type ; Among them, the disturbance level , represents the intensity of the disturbance in the communication data structure; and Indicates no disturbance, Indicates maximum disturbance; camouflage level ,and Indicates that no masquerade strategy is enabled. Indicates full-strength camouflage; encryption algorithm type Including AES-128 algorithm, AES-256 algorithm, SM4 algorithm and ChaCha20 algorithm; channel type Including TLS protocol, WebSocket channel, proxy relay and VPN-Tunnel tunnel.

[0019] Preferably, the communication risk intelligent assessment module includes a behavior dynamic perception channel, a context state representation unit and a feature fusion and risk identification unit;

[0020] The behavior dynamics perception channel takes the time series data of communication behavior as input, uses a multi-level echo state network (ESN) to build a behavior dynamics modeling channel, and extracts deep dynamic features in the behavior evolution process;

[0021] The context state representation unit is used to perceive and encode non-temporal context information during the communication process to complete the static background features of risk judgment;

[0022] After completing the temporal modeling of the communication behavior and the static perception of the context state, the feature fusion and risk identification unit is used for fusion modeling and joint output of the two types of features to complete the synchronous identification of the communication behavior type and risk level.

[0023] Preferably, the behavior dynamics perception channel is specifically:

[0024] The first ESN layer uses communication behavior time series data As input, the initial time series feature representation is obtained ; After that, the second ESN layer receives and As input, it constructs an enhanced expression of short-term behavior features and outputs intermediate representation features ; The third ESN layer is 、 and As input, high-order behavior state representation is obtained through progressive dynamic memory modeling ;at last, The fully connected layer is mapped to a unified latent space, and the nonlinear expression capability is introduced through the ReLU activation function, and finally the dynamic semantic features of the behavior of the channel are obtained. .

[0025] Preferably, the context state representation unit is specifically:

[0026] Communication topology data and device status data The splicing is used as input and high-dimensional representation mapping is performed through two serial multi-layer perceptron structures; and each multi-layer perceptron is connected to the ReLU activation function to enhance nonlinearity, and finally the context state feature is obtained. .

[0027] Preferably, the feature fusion and risk identification unit is specifically:

[0028] The behavior dynamic semantic features obtained by the behavior dynamic perception channel The context state features obtained by the context state representation unit Perform channel splicing to obtain a complete fusion feature vector ; Then, the multi-head attention mechanism is used to capture the correlation between different behavioral dimensions and contextual factors, highlight the information most relevant to risk prediction, and obtain attention features ;then, Input to the fully connected layer and use the ReLU activation function to achieve nonlinear transformation at the semantic level to obtain high-order fusion features ;

[0029] Finally, the high-order fusion feature Finally, there are two output branches: one uses layer normalization and Softmax activation function to output the communication behavior type recognition result ; Secondly, the Dropout layer is used to suppress overfitting and output the risk level detection results in a linear activation manner .

[0030] Preferably, the strategy neural network is specifically:

[0031] First, the identified communication risk level , Communication behavior type Device Status Characteristics Spliced into a set of multi-dimensional policy context vectors , and then to enhance the nonlinear modeling capability, the vector After two fully connected layers and a ReLU activation function, projection mapping is performed to output the policy semantic representation features. ;

[0032] After that, layer normalization and Softmax activation function are used to output the probability distribution of the encryption algorithm. , and the probability distribution of channel types ; Use the Dropout layer and Sigmoid activation function to output the disturbance level prediction result , and the prediction results of camouflage level ;

[0033] Finally, through the mask vector Constrain the output space of the strategy neural network and obtain the final adaptive encryption strategy result:

[0034] ;

[0035] in, To predict the best encryption algorithm, is the best channel type, is the optimal disturbance level, The best camouflage level.

[0036] Preferably, the rule tree is a multi-layer conditional judgment structure that uses the communication risk level and the communication behavior type as input conditions to perform layer-by-layer conditional path matching and outputs decision information for constraining the strategy neural network reasoning space, including:

[0037] (1) Determination of strategy candidate range: including disturbance level and camouflage level The value range and optional encryption algorithm The set is used to construct the mask vector and inject it into the output layer of the policy neural network to achieve the softmax output space restriction; specifically including:

[0038] The first layer is the policy strength assessment layer, which is based on the communication risk level. It is divided into three intervals;

[0039] The second layer is the encryption algorithm recommendation layer, based on the communication risk level and behavior type Jointly determine the optional encryption algorithm ;

[0040] The third layer is the channel adaptation selection layer, which is based on the behavior type. Select candidate channel type , used to control the stealth and resource efficiency of communication paths

[0041] (2) Constructing a mask based on the policy candidate range : To constrain the output space of the strategy neural network, convert the candidate set obtained by the rule tree into a mask vector , and injected into the output layer of the model for control;

[0042] For two discrete variables, encryption algorithm and channel type, a Boolean mask with the same length as the output dimension is constructed. The mask value 1 indicates that the category is allowed by the rule tree, and the mask value 0 indicates that the output is prohibited. Multiply the original output of the model element-wise to achieve probability normalization and prediction selection only within the scope of the rule tree;

[0043] (3) Determine the structural template: Determine a set of optimal recommended strategy combinations based on the strategy candidate range:

[0044] ;

[0045] in, and They are the recommended disturbance level and recommended camouflage level, calculated by The median and the median of the candidate range The median value of the candidate range is obtained; To recommend an encryption algorithm, the highest priority is selected from the candidate set of encryption algorithms recommended by the rule tree according to the security priority. Similarly, To recommend the channel type, the highest priority item is also selected from the candidate set.

[0046] Preferably, the S4 includes three execution stages: structural perturbation processing, behavior camouflage, encryption encapsulation and channel scheduling;

[0047] In the structural disturbance processing stage, according to the disturbance level output by the strategy , dynamically perform multi-level perturbation operations:

[0048] When the disturbance level is low, When , the system only performs basic field rearrangement and field renaming, breaking up the structural characteristics of the communication message;

[0049] When the disturbance level is medium, When, pseudo field injection and fixed pattern interference are further added;

[0050] When the disturbance level is high, When ,performing semantic level perturbations that change the communication structure template, thus enhancing the unrecognizable nature of the traffic;

[0051] Behavior camouflage execution phase, according to the camouflage level in the strategy Control the external manifestation of communication behavior and improve the ability to resist traffic analysis:

[0052] When , only low-frequency port perturbation and path randomization are performed;

[0053] When , open the relay jump proxy mechanism and switch the source IP and TTL disturbance;

[0054] When the system simulates typical application communication behaviors, it constructs communication rhythm interference on the time series to achieve behavioral-level mimicry camouflage;

[0055] In the encryption encapsulation and channel scheduling phase, the best encryption algorithm type is obtained. and optimal channel type , start the corresponding encryption algorithm, and select the corresponding communication channel for data encapsulation and transmission to ensure the encryption integrity and path concealment of the transmission process.

[0056] Preferably, all scrambled and encrypted contents in the encryption encapsulation and channel scheduling stages are accompanied by descrambling parameter indexes or indicators to ensure that the receiving end can perform secure decoding and restoration.

[0057] Compared with the prior art, the invention has the following innovative features and beneficial effects:

[0058] (1) Construction of a multimodal communication context feature system: Introducing three types of heterogeneous data, namely communication behavior sequence, communication topology structure, and device status, as context input, to build a multidimensional feature modeling system for risk identification, achieving comprehensive perception of the dynamics of communication behavior, structural relevance, and resource background constraints;

[0059] (2) Design of an intelligent communication risk assessment model: In view of the strong temporal sequence and contextual heterogeneity of communication behavior, a multi-layer echo state network (ESN) is used to extract the dynamic features of communication behavior. Contextual state encoding and multi-head attention mechanism are introduced to perform feature fusion and importance modeling, thereby achieving joint identification of behavior type and risk level, and improving the lightweight and practicality of the model.

[0060] (3) Policy acquisition architecture based on the collaboration of rule tree and policy neural network: This invention combines an interpretable rule tree mechanism with a learnable policy neural network to form a controlled policy space reasoning structure. The rule tree defines the policy candidate range based on the communication risk level and behavior type, and the neural network outputs policy parameters such as disturbance level, camouflage level, encryption algorithm, and channel type based on it, thus achieving the unity of rationality and controllability of policy acquisition.

[0061] (4) Policy-driven layered scrambling and covert encryption execution mechanism: The present invention divides policy execution into three layers of operations: structural perturbation, behavioral camouflage, and encryption encapsulation. It dynamically adjusts the structure, behavioral characteristics, and channel paths of communication messages according to different policy combinations, comprehensively improving the anti-identification, anti-traffic analysis, and path concealment of encrypted communications, and is suitable for fine-grained security protection needs in multiple types of communication scenarios.

[0062] The present invention breaks through the limitations of traditional communication encryption technology such as lack of context modeling, uncontrollable policy acquisition, and coarse encryption granularity by constructing a four-stage closed-loop architecture of "context perception-risk assessment-strategy coordination-encryption execution", and has significant technical and practical advantages. On the one hand, the system can obtain differentiated strategy combinations according to communication scenarios, behavior types and risk levels to achieve adaptive, secure and controllable communication encryption solutions. On the other hand, strategy execution covers two levels: structural disturbance and behavioral camouflage, effectively enhancing the robustness and concealment of encrypted communications in highly dynamic and highly adversarial environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 A logic flow chart for the overall implementation of the present invention.

[0064] Figure 2 This is the network structure diagram of the communication risk intelligent assessment module of the present invention.

[0065] Figure 3 This is a structural diagram of the encryption strategy collaborative decision-making module of the present invention.

[0066] Figure 4 This is a graph showing the experimental results of the communication behavior recognition accuracy of the present invention.

[0067] Figure 5 This is a graph showing the experimental results of the communication risk level prediction accuracy of the present invention.

[0068] Figure 6 This is a graph showing the matching degree experimental results of the strategy output of the present invention.

[0069] Figure 7 Output stability test result graph for the strategy of the present invention. DETAILED DESCRIPTION

[0070] This paper proposes a risk-driven adaptive data encryption method. The overall technical process is as follows: Figure 1 As shown:

[0071] Communication context data collection and training dataset construction: Communication behavior sequences, communication topology, and device status are collected to construct multi-dimensional input features. Expert annotation and simulation analysis are combined to determine communication risk levels, behavior types, and corresponding optimal encryption strategies, forming a communication risk identification dataset and a policy configuration annotation dataset.

[0072] Design of a communications risk intelligent assessment module: This module is based on an echo state network (ESN) and a multi-head attention mechanism. It takes collected communication behavior sequences, communication topology, and device status as input and outputs communication risk levels and behavior types. Furthermore, the model is trained based on a constructed communications risk identification dataset to produce a trained communications risk intelligent assessment module, providing a decision-making basis for subsequent policy parameter configuration.

[0073] Design of an encryption policy collaborative decision-making module: This module consists of a rule tree and a policy neural network (PolicyNet). The rule tree outputs a policy candidate range and structural template based on the communication risk level and behavior type, guiding the policy neural network to obtain the optimal perturbation level, camouflage level, encryption algorithm, and channel configuration within a limited space, which is then used to drive communication execution. In addition, this module is trained based on a constructed policy configuration annotated dataset.

[0074] An adaptive encryption execution module is constructed based on policy results: semantic perturbation, path camouflage, and data encryption encapsulation operations are performed according to the obtained policy parameters; and the scrambled and encrypted communication content is sent through a designated covert channel to achieve dual protection of the communication structure and behavior layer. The receiving end can restore the original data according to the perturbation parameters.

[0075] The present invention will be further described below with reference to specific embodiments.

[0076] 1. Communication Context Data Collection and Training Dataset Construction

[0077] To achieve dynamic perception and risk assessment of communication behaviors, this paper first constructs a communication context data collection method and training dataset. By systematically collecting communication behavior sequences, communication topology structures, and device operating status information, and combining expert experience with simulation analysis, it obtains risk levels and behavior labels, providing a data foundation for subsequent model training. Specifically, the following steps are involved:

[0078] 1. Communication context feature selection: The present invention first selects multi-dimensional context features that can effectively characterize the communication process. This feature set mainly includes three types of multi-dimensional context information collected by communication terminals during the communication process, including:

[0079] (1) Communication behavior sequence characteristics Used to reflect the dynamic changes in communication behavior, including timestamps , data direction , source port , Destination Port , application identification , Data packet length ,Right now ;

[0080] (2) Communication topology characteristics Reflects the interaction relationship between the terminal and external nodes, including the connection frequency of the peer node , path hop count Node activity ,Right now ;

[0081] (3) Equipment status characteristics Provides resource constraints and network environment context for the communication process, including current CPU utilization , battery percentage , Network connection type ,Right now ;

[0082] 2. Communication data collection: Construct multi-dimensional input based on the determined context features; specifically, the data collection cycle is , a total of N communication behavior sequence features are collected during this time period to obtain communication behavior time series data ,and ;in Indicates the The communication behavior sequence characteristics collected times, and ;

[0083] In addition, during the data collection cycle Internal statistics of communication topology characteristics, including the total frequency of peer node connections , total path hops , and the node activity in the current cycle , and constitute the communication topology data ,and ;

[0084] Similarly, during the data collection cycle Internal statistics of device status characteristics, including the average CPU usage in the current period , average percentage of power , and the main network connection types , and constitute the device status data ,and ;

[0085] 3. Construction of communication risk identification data set: This invention is based on the collected communication behavior time series data , and periodic statistics (including communication topology data and device status data ), build a communication risk identification dataset for training the communication risk intelligent assessment module;

[0086] Specifically, for the data samples collected during the sampling period, network security experts determine the risk level of the communication. , and communication behavior types Among them, the risk level ,and The higher the value, the greater the potential risk; Communication behavior type These include login authentication, payment transactions, chat message transmission, file upload / download, cloud synchronization / data backup, application updates and patch acquisition, domain name resolution / route switching, and unknown or abnormal communication behavior;

[0087] Therefore, the input data of each communication risk identification dataset is , the output recognition result is Based on this principle, Group;

[0088] 4. Construction of policy configuration annotation data set: This invention is based on the collected device status data , and risk level and communication behavior types Construct a policy configuration annotation dataset for training the encryption policy collaborative decision-making module, thereby achieving scenario-oriented adaptive policy acquisition;

[0089] Specifically, network security experts combine the policy knowledge base to select the optimal policy label for each set of communication input, including the disturbance level. , camouflage level , encryption algorithm type and channel type ; Among them, the disturbance level , represents the intensity of the disturbance in the communication data structure; and Indicates no disturbance, Indicates maximum disturbance; camouflage level ,and Indicates that no masquerade strategy is enabled. Indicates full-strength camouflage; encryption algorithm type Including AES-128 algorithm, AES-256 algorithm, SM4 algorithm and ChaCha20 algorithm; channel type Including TLS (HTTPS) protocol, WebSocket channel, proxy relay (Proxy) and VPN-Tunnel tunnel;

[0090] Therefore, the input data of each set of strategy configuration annotation dataset is ; Output recognition result is Based on this principle, Group Policy configuration annotation dataset.

[0091] 2. Design of the Communication Risk Intelligent Assessment Module

[0092] In view of the dynamic change characteristics of heterogeneous multi-source communication context information, the present invention designs a three-stage modeling framework, which is composed of a behavior dynamic perception channel, a context state representation unit, and a feature fusion and risk identification unit. This module can fully perceive the behavior evolution pattern and context constraints in the communication process, and realize the joint identification of communication behavior type and potential risk level; the network structure of the communication risk intelligent assessment module is as follows: Figure 2 As shown;

[0093] 1. Behavior Dynamics Perception Channel Design: During communication, user behavior exhibits significant temporal correlation and phased changes. Therefore, this paper uses time-series data of communication behavior as input and employs a multi-level echo state network (ESN) to construct a behavior dynamics modeling channel, thereby efficiently extracting deep dynamic features during behavior evolution.

[0094] Specifically, the first ESN layer uses communication behavior timing data As input, the initial time series feature representation is obtained ; After that, the second ESN layer receives and As input, it constructs an enhanced expression of short-term behavior features and outputs intermediate representation features ; The third ESN layer is 、 and As input, high-order behavior state representation is obtained through progressive dynamic memory modeling This structure can enhance the model's ability to perceive long-term dependencies on behavioral evolution paths and improve its sensitivity to abnormal behavioral mutations.

[0095] at last, The fully connected layer is mapped to a unified latent space, and the nonlinear expression capability is introduced through the ReLU activation function, and finally the dynamic semantic features of the behavior of the channel are obtained. ;

[0096] 2. Contextual state representation unit design: This unit is used to perceive and encode non-temporal contextual information during the communication process, complementing the static background features for risk assessment;

[0097] Specifically, the unit uses communication topology data and device status data The splicing is used as input and high-dimensional representation mapping is performed through two serial multi-layer perceptron structures; and each multi-layer perceptron is connected to the ReLU activation function to enhance nonlinearity, and finally the context state feature is obtained. ;

[0098] 3. Feature Fusion and Risk Identification Unit Design: After completing the temporal modeling of communication behavior and the static perception of contextual status, the feature fusion and risk identification unit is used to fuse the two types of features and output them together to simultaneously identify the communication behavior type and risk level.

[0099] Specifically, the obtained behavioral dynamic semantic features and the obtained context state features Perform channel splicing to obtain a complete fusion feature vector ; Then, the multi-head attention mechanism is used to capture the correlation between different behavioral dimensions and contextual factors, thereby highlighting the information most relevant to risk prediction and obtaining attention features ;then, Input to the fully connected layer and use the ReLU activation function to achieve nonlinear transformation at the semantic level to obtain high-order fusion features ;

[0100] Finally, the high-order fusion feature Finally, there are two output branches: one uses layer normalization and Softmax activation function to output the communication behavior type recognition result ; Secondly, the Dropout layer is used to suppress overfitting and output the risk level detection results in a linear activation manner ;

[0101] 4. Communication risk intelligent assessment module training: Based on the constructed risk identification dataset, the communication behavior type identification results and risk level test results , the cross entropy loss and mean square error loss functions are used to quantify the training error of the model respectively; the Adam optimizer is used to update the parameters during the training process, and the gradient clipping mechanism is combined to avoid gradient explosion. Finally, a trained communication risk intelligent assessment module is obtained, which can be directly used for communication behavior type identification and risk level detection.

[0102] 3. Design of the Encryption Strategy Collaborative Decision-making Module

[0103] In response to the diverse security risks and resource constraints faced by different communication behavior scenarios, this paper designs an encryption strategy based on rule constraints and neural network collaborative reasoning, which is composed of a rule tree and a strategy neural network decision unit; this module can obtain the communication behavior type recognition results. and risk level test results Based on this, an adaptive encryption strategy combination (including perturbation level, camouflage level, encryption algorithm type and channel configuration method) is obtained to drive the subsequent encryption execution process; the structure of the encryption strategy collaborative decision module is as follows Figure 3 shown.

[0104] 1. Rule tree decision method: In order to achieve a strategy space limitation with strong interpretability and high controllability, the present invention designs a rule tree structure with multi-layer condition judgment, based on the communication risk level. Communication behavior type It uses the input conditions to match the conditional paths layer by layer, and finally outputs two types of decision information used to constrain the reasoning space of the strategy neural network; specifically, it includes:

[0105] (1) Determination of strategy candidate range: including disturbance level and camouflage level The value range of 、 ), and optional encryption algorithms A set of (e.g. {AES-256, SM4}) with channel type A collection (e.g., {TLS, VPN}) is used to construct a mask vector and inject it into the policy neural network output layer to implement softmax output space restriction; specifically, it includes:

[0106] ①The first layer is the strategy strength assessment layer, based on the communication risk level Divided into three intervals:

[0107] like , then it indicates low-risk communication, disturbance level The candidate range is , the candidate range of camouflage level is ;

[0108] like , then it means medium risk communication, disturbance level The candidate range is , the candidate range of camouflage level is ;

[0109] like , it indicates high-risk communication, disturbance level The candidate range is , the candidate range of camouflage level is ;

[0110] In addition, if the communication behavior type For critical tasks (including login authentication, payment transactions, unknown or abnormal communication behaviors), the candidate range of disguise level The upper limit of the ratio is increased by 0.1 and does not exceed 1.0;

[0111] ②The second layer is the encryption algorithm recommendation layer, based on the communication risk level and behavior type Jointly determine the optional encryption algorithm :

[0112] like , this is a low-risk situation and no joint judgment is required, so the alternative lightweight algorithm is: ;

[0113] like , this is a medium risk situation, and joint behavior type judgment is required to balance security and resource consumption. No joint judgment is required; when the behavior type For chat message transmission, cloud synchronization, application update and patch acquisition, and domain name resolution / routing switching, ;when When uploading / downloading files, ;also, ;

[0114] like , this is a high-risk situation, and we should pay extra attention to the high-risk behavior types, namely For login authentication, payment transactions, unknown or abnormal communication behavior, ;also, ;

[0115] ③The third layer is the channel adaptation selection layer, which selects the channel based on the behavior type. Select candidate channel type , used to control the stealth and resource efficiency of the communication path, as follows:

[0116] If the behavior type For chat message transmission, cloud synchronization / data backup, application update and patch acquisition, domain name resolution / route switching, , suitable for lightweight data streams;

[0117] If the behavior type For file upload / download, login authentication or payment transactions, , improve encryption depth and relay protection capabilities;

[0118] If the behavior type For unknown or abnormal communication behavior, , to enhance anonymity and resistance to traffic analysis;

[0119] (2) Constructing a mask based on the policy candidate range :To constrain the output space of the strategy neural network, the present invention converts the candidate set obtained by the rule tree into a mask vector , and injected into the output layer of the model for control;

[0120] Specifically, for two discrete variables, encryption algorithm and channel type, a Boolean mask with the same length as the output dimension is constructed. The mask value 1 indicates that the category is allowed by the rule tree, and the mask value 0 indicates that the output is prohibited. Multiply the original model output element-wise, thereby performing probability normalization and prediction selection only within the scope of the rule tree, improving the security and rationality of the strategy;

[0121] (3) Determine the structural template: Determine a set of optimal recommended strategy combinations based on the strategy candidate range:

[0122] ;

[0123] in, and They are the recommended disturbance level and recommended camouflage level, calculated by The median and the median of the candidate range The median value of the candidate range is obtained; To recommend an encryption algorithm, the highest priority is selected from the candidate set of encryption algorithms recommended by the rule tree according to the security priority. Similarly, To recommend the channel type, the highest priority item is also selected from the candidate set.

[0124] 2. Decision Neural Network Construction: The policy neural network constructed by the present invention is used to combine device status data, communication behavior type, and communication risk level within the policy candidate range defined by the rule tree to obtain policy output results including disturbance level, camouflage level, encryption algorithm type, and channel configuration method. Therefore, this module has the characteristics of strong semantic expression ability and structural control mechanism, and can achieve a highly consistent and controllable policy acquisition process. Specifically, it includes the following contents:

[0125] First, the identified communication risk level , Communication behavior type and the device state feature vector Spliced into a set of multi-dimensional policy context vectors , and then to enhance the nonlinear modeling capability, the vector After two fully connected layers and a ReLU activation function, projection mapping is performed to output the policy semantic representation features. ;

[0126] After that, layer normalization and Softmax activation function are used to output the probability distribution of the encryption algorithm. , and the probability distribution of channel types ; Use the Dropout layer and Sigmoid activation function to output the disturbance level prediction result , and the prediction results of camouflage level ;

[0127] Finally, through the mask vector Constrain the output space of the strategy neural network and obtain the final adaptive encryption strategy result:

[0128] ;

[0129] in, To predict the best encryption algorithm, is the best channel type, is the optimal disturbance level, The best camouflage level.

[0130] 3. Training of the encryption strategy collaborative decision module: During the training process, the model introduces a structural template supervision mechanism to further improve the consistency of the strategy output, and combines the recommended strategies obtained by the rule tree Match the model output; specifically, the prediction result is calculated by L2 distance Combined with recommended strategies The error between them is used as an additional loss function to improve the semantic rationality and task fit of the strategy.

[0131] Finally, the encryption policy collaborative decision-making module is trained based on the constructed policy configuration annotated dataset. The Adam optimizer is used to update the parameters during the training process, and finally a trained encryption policy collaborative decision-making module is obtained, which can directly obtain the adaptive encryption policy.

[0132] 4. Design of Adaptive Encryption Execution Module

[0133] Based on the best encryption strategy combination results (including perturbation level , camouflage level , encryption algorithm type Channel configuration ), this invention builds an encryption strategy execution mechanism for actual communication tasks, achieving dual-layer protection of communication data structure and behavior pattern, ensuring communication privacy, anti-identification and transmission integrity; this module mainly includes three execution stages: structure perturbation processing, behavior camouflage, encryption encapsulation and channel scheduling, as follows:

[0134] Structural disturbance processing stage: according to the disturbance level output by the strategy , dynamically perform multi-level perturbation operations:

[0135] When the disturbance level is low, When , the system only performs basic field rearrangement and field renaming, breaking up the structural characteristics of the communication message;

[0136] When the disturbance level is medium, When, pseudo field injection and fixed pattern interference are further added;

[0137] When the disturbance level is high, When performing semantic-level perturbations that change the communication structure template, the unrecognizable nature of the traffic is enhanced.

[0138] Behavior camouflage execution phase: according to the camouflage level in the strategy Control the external manifestation of communication behavior and improve the ability to resist traffic analysis:

[0139] When , only low-frequency port perturbation and path randomization are performed;

[0140] When , open the relay jump proxy mechanism and switch the source IP and TTL disturbance;

[0141] When the communication behavior of a typical application is simulated, the system constructs communication rhythm interference on the time series to achieve behavioral-level mimicry camouflage.

[0142] Encryption encapsulation and channel scheduling phase: Based on the best encryption algorithm type and optimal channel type , start the corresponding encryption algorithm, and select the corresponding communication channel for data encapsulation and transmission to ensure the encryption integrity and path concealment of the transmission process;

[0143] In addition, all scrambled and encrypted content is accompanied by a descrambling parameter index or indicator to ensure that the receiving end can securely decode and restore it; therefore, the module can achieve differentiated protection and context adaptation for each communication stream, and enhance the anti-identification and anti-attack capabilities of encrypted communications in real-world scenarios.

[0144] 5. Performance Verification of Communication Risk-Driven Adaptive Encryption Method

[0145] In order to verify the application effect of the communication risk-driven adaptive encryption method proposed in the present invention in various communication scenarios, especially its ability to accurately identify communication behaviors, perceive risk levels, and generate reasonable encryption strategies, the present invention designed and implemented a series of simulation experiments covering actual threat scenarios in typical communication tasks, and introduced specific comparison algorithms for performance comparison analysis.

[0146] Specifically, this experiment constructs a simulated data set based on the eight types of communication behaviors defined in the patent, including: (1) login and authentication: such as system login and identity authentication; (2) payment transactions: such as mobile payment and transfer operations; (3) chat message transmission: such as text or voice communication in instant messaging applications; (4) file upload / download: such as FTP transmission and cloud disk synchronization; (5) cloud synchronization / data backup: such as background automatic backup and cross-end data synchronization; (6) application update and patch acquisition: such as device firmware update and patch download request; (7) domain name resolution / route switching: such as DNS query and dynamic change of network routing; (8) unknown or abnormal communication behavior: such as abnormal port access, high-frequency burst request, frequent change of communication path, etc.

[0147] In addition, this experiment compares the proposed method with two representative algorithms: a policy learning model based on a gated recurrent unit (GRU) and a policy acquisition model based on a multi-layer perceptron (MLP). The experiment comprehensively evaluates the proposed method based on the following four performance indicators: communication identification and encryption policy generation:

[0148] (1) Communication behavior recognition accuracy: This measures the model's ability to classify eight types of communication behaviors. The calculation method is the ratio of the number of correctly predicted samples of each type to the total number of samples. The higher the value, the better the recognition accuracy.

[0149] (2) Communication risk level prediction accuracy: used to evaluate the model's prediction accuracy for the communication context risk level. This is calculated based on the consistency between the expert-annotated risk level and the model output. A difference of less than 5% between the two indicates that the prediction result is valid. Therefore, a higher value indicates a higher prediction accuracy.

[0150] (3) Strategy output matching: used to measure the closeness between the strategy network output and the expert preset strategy label. Specifically, the reverse normalized score is calculated by the Euclidean distance error between the four types of strategy parameters (disturbance level, camouflage level, encryption algorithm, channel type) and the label. The higher the index, the closer the strategy generated by the model is to the ideal configuration, and the better the effect.

[0151] (4) Strategy output stability: Examine the fluctuation range of the model output strategy under different communication cycles for similar behavioral tasks, count the variance of strategy parameters in continuous tasks and reverse quantify the score. The higher the value, the stronger the consistency of strategy generation.

[0152] Figures 4 to 7 The following is a line graph of the evaluation results of the above four indicators in eight communication behavior scenarios, which respectively shows the performance differences between the method of the present invention and the two comparison algorithms of GRU and MLP in various tasks.

[0153] Experimental results show that the proposed method performs well overall in communication behavior recognition tasks, maintaining recognition accuracy above 0.90 across all communication types. It maintains a particularly high level of recognition (accuracy reaching 0.88) in scenarios involving "unknown or anomalous communication behavior," demonstrating excellent anomaly perception capabilities. In contrast, the GRU model exhibits certain instability when processing highly dynamic behaviors, resulting in fluctuations in recognition accuracy. The MLP model, due to its simplified structure, exhibits weaker overall recognition capabilities and struggles to effectively distinguish complex behavioral features.

[0154] Secondly, in terms of communication risk level prediction, the present invention relies on the ESN's modeling advantages of time series features and combines contextual state representation to effectively improve the model's ability to judge risk levels; compared with the GRU and MLP methods, the average recognition accuracy of the method in multiple typical scenarios is approximately 12% and 20% higher, respectively, verifying the effectiveness of the proposed structure in risk modeling.

[0155] Furthermore, regarding the policy output matching metric, this method, through the collaborative design of a rule tree constraint mechanism and a policy neural network, ensures that the output policy more closely matches the expert annotation results. In particular, the deviation from the ideal policy in terms of perturbation level and encryption algorithm parameters is minimized, demonstrating high consistency and scenario adaptability. The comparative algorithm, GRU, while possessing certain learning capabilities, is susceptible to interference from contextual changes, while MLP, lacking structural guidance, results in large output fluctuations and a significantly lower matching degree.

[0156] Finally, in terms of policy output stability, the proposed method demonstrates stronger result consistency in most task types. In periodic tasks such as "chat messaging" and "file transfer," the policy output has the smallest variance over consecutive communication cycles, indicating that the model has good policy retention capabilities, significantly outperforming the unstable performance of the GRU model in long-term dependency modeling and the high sensitivity of the MLP structure to input changes.

[0157] In summary, experimental results fully demonstrate that the communication risk-driven adaptive encryption method proposed in this paper exhibits high recognition accuracy, strong risk perception, realistic policy output, and good stability and controllability across multiple communication behavior scenarios. This method can effectively address the dynamic changes and diverse security requirements in heterogeneous communication systems, demonstrating its engineering value and promising application prospects.

[0158] The above description is merely a preferred embodiment of the present application and is not intended to limit the present application. Various modifications and variations are possible for those skilled in the art. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present application shall be included within the scope of protection of the present application.

[0159] Although the above describes the specific implementation methods of the present invention, it does not limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art on the basis of the technical solution of the present invention without creative work are still within the scope of protection of the present invention.

Claims

1. A risk-driven adaptive data encryption method, characterized in that: The following processes are included: S1, acquires communication behavior sequences, communication topology features, and device status features in real time to construct multi-dimensional input features; S2: Input the multi-dimensional input features into the trained communication risk intelligent assessment module, and output the communication risk level and behavior type. The communication risk intelligent assessment module is a three-stage modeling framework, including a behavior dynamic perception channel, a context state representation unit, and a feature fusion and risk identification unit. It comprehensively perceives the behavior evolution pattern and context constraints during the communication process and jointly identifies the communication behavior type and potential risk level. S3: Input the communication risk level and behavior type obtained in S2 into the trained encryption strategy collaborative decision-making module, and output encryption strategy parameters. The encryption strategy collaborative decision-making module is composed of a rule tree and a strategy neural network. The rule tree outputs a strategy candidate range and structure template based on the communication risk level and behavior type, guiding the strategy neural network to obtain the optimal perturbation level, camouflage level, encryption algorithm, and channel configuration in a limited space. S4, based on the encryption strategy parameter results, performs semantic perturbation, path camouflage and data encryption encapsulation operations; and the scrambled and encrypted communication content is sent through a designated covert channel, and the receiving end restores the original data according to the perturbation parameters.

2. The risk-driven adaptive data encryption method according to claim 1, wherein: Communication behavior sequence Used to reflect the dynamic changes in communication behavior, including timestamps , data direction , source port , Destination Port , application identification , Data packet length ; Communication topology characteristics Reflects the interaction between the terminal and external nodes, including the connection frequency of the peer node , path hop count Node activity ; Device status characteristics Provides resource constraints and network environment context for the communication process, including current CPU utilization , battery percentage , Network connection type .

3. The risk-driven adaptive data encryption method according to claim 2, wherein: The dataset used to train the communication risk intelligent assessment module and the encryption strategy collaborative decision-making module is constructed in the following ways: Data collection cycle ,During this time period, a total of N communication behavior sequence features are collected, and the communication topology feature data and device status feature data are counted; For this collection cycle The collected data samples are used by network security experts to determine the risk level of the communication. , and communication behavior types Among them, the risk level ,and The higher the value, the greater the potential risk; Communication behavior type These include login authentication, payment transactions, chat message transmission, file upload / download, cloud synchronization / data backup, application updates and patch acquisition, domain name resolution / route switching, and unknown or abnormal communication behavior; Network security experts combine the policy knowledge base to select the optimal policy label for each set of communication input, including the disturbance level , camouflage level , encryption algorithm type and channel type ; Among them, the disturbance level , represents the intensity of the disturbance of the communication data structure; and Indicates no disturbance, Indicates maximum disturbance; camouflage level ,and Indicates that no masquerade strategy is enabled. Indicates full-strength camouflage; encryption algorithm type Including AES-128 algorithm, AES-256 algorithm, SM4 algorithm and ChaCha20 algorithm; channel type Including TLS protocol, WebSocket channel, proxy relay and VPN-Tunnel tunnel.

4. The risk-driven adaptive data encryption method according to claim 1, wherein: The behavior dynamics perception channel takes the time series data of communication behavior as input, uses a multi-level echo state network (ESN) to build a behavior dynamics modeling channel, and extracts deep dynamic features in the behavior evolution process; The context state representation unit is used to perceive and encode non-temporal context information during the communication process to complete the static background features of risk judgment; After completing the temporal modeling of the communication behavior and the static perception of the context state, the feature fusion and risk identification unit is used for fusion modeling and joint output of the two types of features to complete the synchronous identification of the communication behavior type and risk level.

5. The risk-driven adaptive data encryption method according to claim 4, characterized in that: The behavior dynamic perception channel is specifically: The first ESN layer uses communication behavior time series data As input, the initial time series feature representation is obtained ; After that, the second ESN layer receives and As input, it constructs an enhanced expression of short-term behavior features and outputs intermediate representation features ; The third ESN layer is 、 and As input, high-order behavior state representation is obtained through progressive dynamic memory modeling ;at last, The fully connected layer is mapped to a unified latent space, and the nonlinear expression capability is introduced through the ReLU activation function, and finally the dynamic semantic features of the behavior of the channel are obtained. .

6. The risk-driven adaptive data encryption method according to claim 4, characterized in that: The context state representation unit is specifically: Communication topology data and device status data The splicing is used as input and high-dimensional representation mapping is performed through two serial multi-layer perceptron structures; and each multi-layer perceptron is connected to the ReLU activation function to enhance nonlinearity, and finally the context state feature is obtained. .

7. The risk-driven adaptive data encryption method according to claim 4, characterized in that: The feature fusion and risk identification unit is specifically: The behavior dynamic semantic features obtained by the behavior dynamic perception channel The context state features obtained by the context state representation unit Perform channel splicing to obtain a complete fusion feature vector ; Then, the multi-head attention mechanism is used to capture the correlation between different behavioral dimensions and contextual factors, highlight the information most relevant to risk prediction, and obtain attention features ;then, Input to the fully connected layer and use the ReLU activation function to achieve nonlinear transformation at the semantic level to obtain high-order fusion features ; Finally, the high-order fusion feature Finally, there are two output branches: one uses layer normalization and Softmax activation function to output the communication behavior type recognition result ; Secondly, the Dropout layer is used to suppress overfitting and output the risk level detection results in a linear activation manner .

8. The risk-driven adaptive data encryption method according to claim 1, wherein: The strategy neural network is specifically: First, the identified communication risk level , Communication behavior type Device Status Characteristics Spliced into a set of multi-dimensional policy context vectors , and then to enhance the nonlinear modeling capability, the vector After two fully connected layers and a ReLU activation function, projection mapping is performed to output the policy semantic representation features. ; After that, layer normalization and Softmax activation function are used to output the probability distribution of the encryption algorithm. , and the probability distribution of channel types ; Use the Dropout layer and Sigmoid activation function to output the disturbance level prediction result , and the prediction results of camouflage level ; Finally, through the mask vector Constrain the output space of the strategy neural network and obtain the final adaptive encryption strategy result: in, To predict the best encryption algorithm, is the best channel type, is the optimal disturbance level, The best camouflage level.

9. The risk-driven adaptive data encryption method according to claim 1, wherein: The S4 includes three execution stages: structural perturbation processing, behavior camouflage, encryption encapsulation and channel scheduling; In the structural disturbance processing stage, according to the disturbance level output by the strategy , dynamically perform multi-level perturbation operations: When the disturbance level is low, When , the system only performs basic field rearrangement and field renaming, breaking up the structural characteristics of the communication message; When the disturbance level is medium, When, pseudo field injection and fixed pattern interference are further added; When the disturbance level is high, When ,performing semantic level perturbations that change the communication structure template, thus enhancing the unrecognizable nature of the traffic; Behavior camouflage execution phase, according to the camouflage level in the strategy Control the external manifestation of communication behavior and improve the ability to resist traffic analysis: When , only low-frequency port perturbation and path randomization are performed; When , open the relay jump proxy mechanism and switch the source IP and TTL disturbance; When the system simulates typical application communication behaviors, it constructs communication rhythm interference on the time series to achieve behavioral-level mimicry camouflage; In the encryption encapsulation and channel scheduling phase, the best encryption algorithm type is obtained. and optimal channel type , start the corresponding encryption algorithm, and select the corresponding communication channel for data encapsulation and transmission to ensure the encryption integrity and path concealment of the transmission process.

10. The risk-driven adaptive data encryption method according to claim 9, characterized in that: During the encryption encapsulation and channel scheduling phase, all scrambled and encrypted content is accompanied by a descrambling parameter index or indicator to ensure that the receiving end can perform secure decoding and restoration.

Images