Network security protection method and system based on traffic analysis

Abstract

The present invention discloses a network security protection method and system based on traffic analysis, which relates to the field of network security protection technology, and specifically includes the following steps: based on the protocol type classification results, determine whether there is a multi-protocol interactive traffic situation, if so, determine all protocols involved in the interaction, and classify them into a protocol interaction identification set; obtain the interactive behavior feature information of each protocol in the protocol interaction identification set, and analyze it after acquisition to evaluate the degree of change in the interactive behavior between each protocol in the protocol interaction identification set; according to the evaluation results, perform dynamic regulation on the cross-protocol traffic identification mechanism. The present invention solves the problem that the existing technology cannot identify and regulate according to the degree of change in the interactive behavior between protocols in the case of multi-protocol interactive traffic, realizes the dynamic regulation of the cross-protocol traffic identification mechanism, and effectively improves the recognition capability and protection accuracy of hybrid protocol camouflage attacks.

Description

Technical Field

[0001] The present invention relates to the technical field of network security protection, and in particular to a network security protection method and system based on traffic analysis. Background Art

[0002] Network security protection refers to the use of technical means, management measures, and policies to protect computer networks and their data from unauthorized access, destruction, leakage, or tampering, thereby ensuring network reliability, integrity, and security. Traditional network security protection methods primarily rely on firewalls, intrusion detection systems (IDS), and intrusion prevention systems (IPS). These typically use rules, signatures, or blacklists to detect known attack behaviors. However, with the continuous evolution and transformation of network attack methods, traditional methods are often unable to cope with new and unknown attacks. Therefore, network security protection based on traffic analysis has emerged. This technology uses real-time analysis of network traffic characteristics and patterns to detect abnormal behavior and identify potential threats. Unlike traditional signature-based protection methods, traffic analysis-based protection methods can observe the flow of data packets and traffic fluctuations to promptly detect traffic that does not conform to normal network behavior, thereby identifying potential attacks or intrusions. This method does not rely on known attack patterns, but instead uses deep learning and behavioral analysis of network traffic to effectively detect new attacks and unknown threats. Network security protection based on traffic analysis not only enhances the response speed and adaptability of network security, but also reduces the false alarm rate and significantly improves the protection effect. It is of great significance to combat the increasingly complex network security challenges.

[0003] Existing network security protection technologies based on traffic analysis primarily monitor and analyze network traffic to identify abnormal traffic and potential network threats. The core of this technology lies in analyzing network behavior patterns through packet capture, traffic feature extraction, and traffic pattern recognition. Specifically, this technology typically involves multiple steps: First, network traffic data is captured in real time by data collection equipment. This data includes information such as packet size, transmission time, flow direction, and protocol type. Next, traffic feature extraction and data preprocessing are used to convert the captured data into a format suitable for analysis. Traffic features are then analyzed using statistical analysis, machine learning algorithms, or deep learning models to identify the differences between normal and abnormal traffic. Abnormal traffic typically manifests as significant fluctuations in traffic volume, frequent connection requests, or behavior that does not conform to normal communication patterns, all of which may indicate a potential attack. Finally, through traffic analysis-based policies, the system can detect and prevent this abnormal behavior in real time, for example by activating firewall rules, blocking malicious traffic, or triggering alarms. Through the coordinated work of these steps, network security protection based on traffic analysis can provide effective defense against unknown attacks and complex threats.

[0004] The existing technology has the following deficiencies:

[0005] When attackers launch attacks by disguising protocol packets as legitimate traffic, particularly when malicious traffic is transmitted simultaneously across multiple protocols (such as a combination of HTTP and DNS), existing network security protection technologies based on traffic analysis typically only analyze traffic at a single protocol level and fail to comprehensively analyze the interactions between protocols. In this scenario, attackers exploit a mix of protocols to conceal malicious traffic. Because protection systems fail to fully identify the interaction patterns between different protocols, interprotocol traffic cannot be effectively captured. Existing technologies cannot dynamically adjust cross-protocol traffic identification mechanisms based on the degree of variation in protocol interactions in the context of multi-protocol traffic. Existing technologies rely on analyzing the behavior patterns of a single protocol and lack comprehensive analysis of the interaction patterns across different protocols, making it impossible to identify coordinated disguised attacks conducted by multiple protocols. Ultimately, malicious traffic may pass between different protocols without being captured by single-layer protection mechanisms, resulting in the system failing to detect and prevent these disguised attacks. This, in turn, can lead to more complex attack methods such as reflection attacks, data leakage, and remote code execution, severely impacting network security.

[0006] The above information disclosed in this Background section is only for enhancement of understanding of the background of the present disclosure and therefore it may contain information that does not form the prior art that is already known to a person of ordinary skill in the art. Summary of the Invention

[0007] The purpose of the present invention is to provide a network security protection method and system based on traffic analysis to solve the problems in the above-mentioned background technology.

[0008] In order to achieve the above object, the present invention provides the following technical solution: a network security protection method based on traffic analysis, specifically comprising the following steps:

[0009] Perform packet-by-packet access processing on all traffic transmitted through the network, extract the protocol identification field, port information and transmission direction information of each data packet, and complete the protocol type classification of each data packet;

[0010] Based on the protocol type classification results, determine whether there is multi-protocol interaction traffic. If so, determine all protocols involved in the interaction and classify them into a protocol interaction identification set;

[0011] Obtaining interaction behavior characteristic information of each protocol in the protocol interaction identification set, and analyzing it after obtaining it to evaluate the degree of change in the interaction behavior between each protocol in the protocol interaction identification set;

[0012] Based on the evaluation results, dynamic regulation of cross-protocol traffic identification mechanisms is performed;

[0013] Based on the recognition results after dynamic regulation, the corresponding protection actions are executed, and the recognition results and the corresponding interactive behavior feature information are recorded at the same time, and the evaluation conditions and regulation strategies are updated based on the recorded content.

[0014] Preferably, based on the protocol type classification result, it is determined whether there is multi-protocol interaction traffic. If so, all protocols involved in the interaction are determined and classified into a protocol interaction identification set, specifically:

[0015] Based on the protocol type classification result of each data packet, statistics are collected on the network traffic after protocol type classification within a pre-set continuous time window. By analyzing the time sequence of data packets corresponding to all protocols within the pre-set continuous time window, it is determined whether there is multi-protocol interactive traffic; the multi-protocol interactive traffic refers to the situation where data packets of several protocols appear alternately within the pre-set continuous time window;

[0016] If it is determined that there is multi-protocol interactive traffic, the protocol types corresponding to all interleaved data packets in the preset continuous time window are determined as the protocols participating in the interaction, and the determined protocol combinations are constructed as a protocol interaction identification set.

[0017] Preferably, obtaining the interaction behavior characteristic information of each protocol in the protocol interaction identification set, and analyzing it after obtaining to evaluate the degree of change of the interaction behavior between each protocol in the protocol interaction identification set, specifically includes the following steps:

[0018] Obtaining the interaction behavior characteristic information of each protocol in the protocol interaction identification set and performing preprocessing after obtaining;

[0019] Extracting protocol load fluctuation feature information and protocol structure complexity feature information from the preprocessed interaction behavior feature information, and analyzing them after extraction to generate interaction load difference coefficient and structure complexity index respectively;

[0020] Based on the generated interaction load difference coefficient and structural complexity index, the interaction variation coefficient is generated by weighted summation;

[0021] Determine a preset interaction change coefficient threshold interval, and compare it with the generated interaction change coefficient after determination, and evaluate the degree of change of the interaction behavior between each protocol in the protocol interaction identification set based on the comparison result.

[0022] Preferably, the logic for obtaining the interaction load difference coefficient is as follows:

[0023] The protocol load fluctuation feature information is extracted from the pre-processed interaction behavior feature information, including the sum of all packet sizes, the number of packets, and the difference between the maximum and minimum packet sizes in each protocol in the protocol interaction identification set, and is calibrated as 、 and , Indicates the protocol interaction identifier set The sum of the sizes of all packets in the protocol, Indicates the protocol interaction identifier set The number of packets in a protocol, Indicates the protocol interaction identifier set The difference between the maximum and minimum packet sizes within a protocol, , is a positive integer;

[0024] Calculate the weighted load fluctuation factor of each protocol in the protocol interaction identification set. The specific calculation formula is as follows:

[0025] ;

[0026] Where, The first The weighted load fluctuation factor of each protocol;

[0027] The weighted load fluctuation factor of each protocol in the protocol interaction identification set Take the logarithm to form the logarithmic load index, according to the formula:

[0028] ;

[0029] Where, The first Logarithmic load indicators of each protocol;

[0030] Calculate the interaction load difference coefficient. The specific calculation formula is as follows:

[0031] ;

[0032] Where, is the interaction load difference coefficient.

[0033] Preferably, the logic for obtaining the structural complexity index is as follows:

[0034] The complex feature information of the protocol structure is extracted from the preprocessed interactive behavior feature information, including the number of types of all packet header fields, the control field ratio and the header field information entropy value of each protocol in the protocol interaction identification set, and marked as 、 and , Indicates the protocol interaction identifier set The number of all packet header field types in the protocol, Indicates the protocol interaction identifier set The ratio of control fields within the protocol, Indicates the protocol interaction identifier set The information entropy value of the header field in the protocol, , is a positive integer;

[0035] Calculate the structural complexity factor of each protocol in the protocol interaction identification set. The specific calculation formula is as follows:

[0036] ;

[0037] Where, The first The structural complexity factor of each protocol;

[0038] Calculate the structural complexity index. The specific calculation formula is as follows:

[0039] ;

[0040] Where, is the structural complexity index.

[0041] Preferably, the generated interaction load difference coefficient and structural complexity index , the interaction variation coefficient is generated by weighted summation. The specific calculation formula is as follows:

[0042] ;

[0043] Where, is the interaction coefficient of variation, and Interaction load difference coefficient and structural complexity index The non-zero weight coefficient of .

[0044] Preferably, a predetermined threshold interval of the interaction coefficient of variation is determined. , and after determination, the interaction variation coefficient generated Perform a comparison and evaluate the degree of change in the interaction behavior between the protocols in the protocol interaction identification set based on the comparison results. The specific comparison analysis is as follows:

[0045] like ,The change degree of the interaction behaviors between the ,protocol interaction identification set is the normal change degree;

[0046] like ,The change degree of the interaction behaviors between the ,protocol interaction identification set is significant ;

[0047] like ,The degree of change in the interaction behaviors between the ,protocol interaction identification set is a dramatic change degree.

[0048] Preferably, according to the evaluation results, dynamic regulation is performed on the cross-protocol traffic identification mechanism, specifically:

[0049] If the assessment result indicates a normal degree of change, the current cross-protocol traffic identification mechanism operating parameters are maintained, and the existing protocol identification rules and protection strategies continue to be used;

[0050] If the assessment result indicates a significant change, the sensitivity of traffic analysis will be increased, the monitoring window for inter-protocol data traffic will be adjusted, and the frequency of extracting protocol interaction behavior features will be increased to identify potential protocol coordination attacks and disguises.

[0051] If the assessment result indicates a drastic change, the core parameters of the cross-protocol traffic identification mechanism will be adjusted, advanced protocol analysis algorithms will be enabled, the traffic filtering mechanism will be strengthened to block potential malicious protocol traffic, and the real-time threat identification function will be triggered to isolate suspicious traffic.

[0052] Preferably, the network security protection system based on traffic analysis includes a protocol identification and classification module, an interactive protocol calibration module, an interactive behavior evaluation module, an identification strategy control module, and a protection closed-loop optimization module;

[0053] The protocol identification and classification module performs packet-by-packet access processing on all traffic transmitted through the network, extracts the protocol identification field, port information and transmission direction information of each data packet, and completes the protocol type classification of each data packet;

[0054] The interaction protocol identification module determines whether there is multi-protocol interaction traffic based on the protocol type classification results. If so, it determines all the protocols involved in the interaction and classifies them into a protocol interaction identification set.

[0055] An interaction behavior evaluation module obtains interaction behavior characteristic information of each protocol in the protocol interaction identification set, analyzes it after acquisition, and evaluates the degree of change in interaction behavior between each protocol in the protocol interaction identification set;

[0056] The identification policy control module dynamically controls the cross-protocol traffic identification mechanism based on the evaluation results;

[0057] The protection closed-loop optimization module executes corresponding protection actions based on the recognition results after dynamic regulation, records the recognition results and corresponding interactive behavior feature information, and updates the evaluation conditions and regulation strategies based on the recorded content.

[0058] In the above technical solution, the technical effects and advantages provided by the present invention are:

[0059] 1. The present invention can dynamically identify and judge the interactive behaviors between multiple protocols in network transmission traffic for complex scenarios involving multi-protocol interactive traffic. By introducing a continuous time window to capture the patterns of protocol interleaving, it avoids the blind spots in traditional methods that rely solely on the analysis of single protocol behavior patterns, significantly improving the ability to identify hybrid protocol camouflage attacks. In particular, when faced with fusion attacks involving protocols such as HTTP and DNS, it can proactively perceive and construct a protocol interaction identification set, thereby providing a foundation for subsequent behavioral feature analysis and identification strategy adjustments.

[0060] 2. This invention introduces two quantitative indicators: the interaction load difference coefficient and the structural complexity index. It also constructs an interaction change coefficient through mathematical modeling to accurately assess the degree of change in interaction behavior between protocols. This mechanism breaks through the traditional identification method based on static rule judgment and achieves fine-grained dynamic monitoring of protocol interaction patterns through a data-driven approach. The application of mathematical methods such as weighted modeling, exponential transformation, and logarithmic analysis not only improves the accuracy and controllability of identification results, but also establishes a quantifiable and adjustable dynamic evaluation mechanism, providing a reliable basis for subsequent decision-making on intelligent protection strategies.

[0061] 3. The present invention constructs a complete closed-loop process from identification and evaluation to dynamic regulation and optimization learning. Under different evaluation results, the cross-protocol traffic identification mechanism is hierarchically regulated according to the degree of interaction change, effectively achieving a balance between protection accuracy and system resource consumption. At the same time, after the protection action is executed, the identification results and interactive behavior characteristics are recorded and the strategy is updated, with continuous evolution and self-adaptation capabilities. This closed-loop optimization mechanism not only improves the system's responsiveness and adaptability in the face of complex traffic attacks, but also provides technical support for the intelligent and modular evolution of network security protection systems, and has significant practical value and promotion prospects. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, a brief introduction to the drawings required for use in the embodiments will be given below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0063] Figure 1The figure is a flow chart of the network security protection method and system based on traffic analysis of the present invention.

[0064] Figure 2 This is a module diagram of the network security protection method and system based on traffic analysis of the present invention. DETAILED DESCRIPTION

[0065] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, these example embodiments are provided so that the description of this disclosure will be thorough and complete and will fully convey the concepts of the example embodiments to those skilled in the art.

[0066] The present invention provides Figure 1 The network security protection method based on traffic analysis shown in the figure specifically includes the following steps:

[0067] Perform packet-by-packet access processing on all traffic transmitted through the network, extract the protocol identification field, port information and transmission direction information of each data packet, and complete the protocol type classification of each data packet;

[0068] Through software, packet-by-packet access processing can be achieved for all traffic transmitted through the network. Specifically, data packet capture can be achieved using raw sockets or packet capture engines based on the monitoring mechanism of the data link layer or the network layer. For example, the libpcap interface can be called in a Linux environment, and the Npcap driver can be used in a Windows system. These packet capture tools can monitor the specified network interface in real time and capture all data packets transmitted on it. The software can set capture filters to filter the required traffic by network card, protocol, port or flow direction. During the capture process, all data packets will enter the processing flow in the order of their arrival, will not be discarded or re-arranged, and will retain complete metadata such as timestamp, data length and source and target information, thereby achieving complete, sequential and continuous packet-by-packet access.

[0069] After completing the traffic access, the protocol field of each data packet can be parsed by software to extract the protocol identification field, port information and transmission direction information. The specific implementation method includes parsing the data packet structure layer by layer, starting from the link layer to read the EtherType field to identify the network layer protocol type, such as IPv4 or IPv6, and then going up to the transport layer to read the Protocol field in the IP message to determine whether it is a TCP, UDP, ICMP or other type of protocol. At the transport layer, the TCP or UDP header field is further parsed to extract the source port and destination port, and combined with the predefined port mapping rules, the application layer protocol, such as HTTP, DNS, SMTP, etc., is identified. The transmission direction information can be determined based on the relationship between the source IP and the destination IP relative to the local address. After completing the extraction of the above information, the data packet is classified into the corresponding protocol category according to the protocol mapping table to form a traffic structure classified by protocol.

[0070] The process of accessing and extracting protocol-related fields from all traffic transmitted through the network packet by packet is the prerequisite for realizing protocol interaction identification and dynamic protection regulation. In network communications, the protocol stack is complex and the types of protocols are diverse. If the protocol structure and interaction path of each data packet cannot be obtained in real time, it is impossible to build a complete traffic behavior feature model. In scenarios of multi-protocol cross-transmission or malicious traffic disguise, only by completely extracting the protocol information and transmission direction of the data packet can the starting point and path of cross-protocol correlation behavior be identified. This process ensures the contextual integrity of data analysis and provides structured and accurate raw data support for subsequent protocol interaction behavior evaluation and protection strategy execution. It is the key starting point for building a complete dynamic protection system based on traffic analysis.

[0071] Based on the protocol type classification results, determine whether there is multi-protocol interaction traffic. If so, determine all protocols involved in the interaction and classify them into a protocol interaction identification set;

[0072] In this embodiment, based on the protocol type classification results, it is determined whether there is multi-protocol interaction traffic. If so, all protocols involved in the interaction are determined and classified into a protocol interaction identification set, specifically:

[0073] Based on the protocol type classification results of each data packet, statistics are collected on the network traffic after protocol type classification within a pre-set continuous time window. By analyzing the time sequence of data packets corresponding to all protocols within the pre-set continuous time window, it is determined whether there is multi-protocol interactive traffic. Multi-protocol interactive traffic refers to the situation where data packets of several protocols appear alternately within the pre-set continuous time window.

[0074] Software can be used to perform time-series statistical analysis on data packets classified by protocol type within a preset continuous time window to determine whether there is multi-protocol interactive traffic. In implementation, the software first continuously timestamps and maps the protocol type to each data packet that is accessed in real time according to a time window of fixed length, and writes the data packets into the cache structure in chronological order. At the end of each time window, the software will traverse the sequence of data packets in the window, count the distribution positions of each protocol on the time axis, and construct a protocol-time distribution map. Subsequently, by scanning the time sequence arrangement of data packets between different protocols, it is detected whether there is a phenomenon of data packets of multiple protocols interspersed with each other and continuously interleaved. If it is identified that at least two protocols appear alternately in time sequence within a certain time period, it can be determined that there is multi-protocol interactive traffic in the time window, and the protocol types involved in the interleaved distribution are extracted for subsequent processing.

[0075] The reason for this is that multi-protocol interaction is a common camouflage method used in current complex network attacks. Attackers often split malicious payloads into multiple protocols and send them alternately, exploiting the hierarchical isolation characteristics of the protocol detection system to circumvent the detection capabilities of a single protocol analysis model. Traditional analysis methods based on single-protocol behavioral characteristics have difficulty detecting such interleaving patterns. However, by analyzing the order of protocol types in data packets within a time window, the timing characteristics of "protocol interleaving" can be accurately identified. This characteristic itself is an important behavioral characteristic of multi-protocol collaborative communication. Timely identification of this alternating pattern helps to locate potential cross-protocol communication relationships, thereby providing structural input for subsequent feature extraction, threat modeling, and protection strategy selection, improving the detection capability and response accuracy of covert attacks.

[0076] If it is determined that there is multi-protocol interactive traffic, the protocol types corresponding to all interleaved data packets in the preset continuous time window are determined as the protocols participating in the interaction, and the determined protocol combinations are constructed as a protocol interaction identification set.

[0077] In the case where it is determined that there is multi-protocol interactive traffic, the protocol types corresponding to all the data packets that appear interlaced in the pre-set continuous time window can be further extracted by software, and combined to form a protocol interaction identification set. In implementation, after the alternating detection is confirmed, the software will perform a retrospective analysis on the data packets in the time window, traverse each data packet in the interlaced segment in chronological order, and record its protocol type in a protocol identification set structure. This set structure usually has a deduplication mechanism to avoid repeated counting of the same protocol type. After the traversal is completed, what is retained in the set are the protocol types involved in all the data packets that appear interlaced in the time window. The software then logically associates the protocol type set into a protocol interaction identification set, and stores it as the protocol interaction instance corresponding to the window, for subsequent interactive behavior feature extraction and risk assessment processing.

[0078] The purpose of this is to accurately capture the potential relationship patterns formed by collaborative communication between protocols. In network attacks, attackers often use multiple protocols to jointly complete the construction of communication links or the distribution of tasks, such as using the HTTP protocol to issue commands and then transmitting data back through the DNS channel. If these protocol participation relationships cannot be identified and combined within the time dimension, the analysis system will only be able to process traffic in isolation in the protocol dimension and will not be able to establish a behavioral chain between protocols. By constructing a set of protocol interaction identifiers, a perception foundation for the collaborative activities of multiple protocols can be established at the detection layer, so that subsequent behavioral analysis is no longer limited to single-protocol scenarios, but instead shifts to the overall perception and tracking of cross-protocol attack behaviors, thereby enhancing the ability to identify complex attack methods and effectively supporting the activation of dynamic protection decision-making mechanisms and the matching of refined strategies.

[0079] Obtaining interaction behavior characteristic information of each protocol in the protocol interaction identification set, and analyzing it after obtaining it to evaluate the degree of change in the interaction behavior between each protocol in the protocol interaction identification set;

[0080] In this embodiment, the interaction behavior characteristic information of each protocol in the protocol interaction identification set is obtained, and after being obtained, it is analyzed to evaluate the degree of change in the interaction behavior between the protocols in the protocol interaction identification set. Specifically, the following steps are included:

[0081] Obtaining the interaction behavior characteristic information of each protocol in the protocol interaction identification set and performing preprocessing after obtaining;

[0082] Obtaining the interactive behavior characteristic information of each protocol in the protocol interaction identification set can be achieved by parsing the network data packets identified as the protocol interaction identification set packet by packet within a continuous time window. Specifically, a traffic collection tool is used to intercept network traffic in real time, and in the traffic parsing module, the protocol header field content, field structure configuration, field value distribution, control field occurrence, etc. are extracted based on the protocol type of each data packet, and a corresponding feature vector set is constructed based on the protocol. These sets include but are not limited to structured data such as the number of field types, field hierarchy, control field ratio, field content distribution density, and typical field patterns. Through the protocol classification index mechanism, they are respectively attributed to the feature set corresponding to each protocol in the protocol interaction identification set, thereby achieving the acquisition of the interactive behavior characteristic information of each protocol. This process can be achieved through the combination of traffic analysis tools with feature extraction algorithms, such as regularization-based protocol field extraction and statistical coding, to ensure that the obtained results have structural and quantifiable characteristics.

[0083] The primary purpose of preprocessing the acquired interaction behavior feature information is to eliminate noisy fields, standardize feature dimensions, and improve computational stability and parameter generation accuracy for subsequent analysis. Due to differences in field structures across protocols, the originally acquired feature information may contain inconsistent data formats, inconsistent field encodings, missing fields, or outliers, necessitating preprocessing. Preprocessing includes field normalization (e.g., using Z-score normalization or Min-Max scaling to compress all field features to the same scale range), outlier removal (e.g., using a threshold between the median and the interquartile range to eliminate extreme values), missing field filling (using the protocol average field value or a protocol default structure template for interpolation), and redundant field filtering (removing non-discriminative fields that appear repeatedly across multiple protocols). These methods transform the feature information for each protocol into a structurally consistent, numerically stable vector format suitable for subsequent modeling, providing an accurate basis for assessing the extent of interaction behavior change.

[0084] Extracting protocol load fluctuation feature information and protocol structure complexity feature information from the preprocessed interaction behavior feature information, and analyzing them after extraction to generate interaction load difference coefficient and structure complexity index respectively;

[0085] Extracting protocol load fluctuation and protocol structure complexity characteristics from preprocessed interaction behavior feature information can be achieved in software by constructing a feature parsing model and a multidimensional statistical analysis process. Specifically, the software first invokes the payload and structure field extraction modules based on the preprocessed feature vector corresponding to each protocol, focusing on field dimensions related to data transmission load and protocol structure complexity, respectively. For protocol load fluctuation characteristics, the software extracts and calculates the total packet size, number of packets, and the difference between the maximum and minimum packet sizes for each protocol within the interaction time window to construct a three-dimensional feature set representing load fluctuation. For protocol structure complexity characteristics, the software extracts the number of protocol header field types, the proportion of control fields, and the entropy value based on the field distribution from the preprocessed vector to measure the complexity of the protocol message structure in terms of functionality and randomness. The entire extraction process is completed based on field label index matching and rule-driven extraction. All extracted results are stored in a structured protocol information feature set, which serves as the basic data support for subsequent parameter calculation and interaction behavior evaluation.

[0086] Based on the generated interaction load difference coefficient and structural complexity index, the interaction variation coefficient is generated by weighted summation;

[0087] Determine a preset interaction change coefficient threshold interval, and compare it with the generated interaction change coefficient after determination, and evaluate the degree of change of the interaction behavior between each protocol in the protocol interaction identification set based on the comparison result.

[0088] Determining pre-set interaction variation coefficient thresholds is accomplished through software-based historical modeling and policy rule generation. Specifically, during an offline training phase, the software analyzes a large amount of annotated historical network traffic data, categorizing it based on whether it exhibits abnormal multi-protocol interaction behavior. The software then performs cluster statistical analysis on the interaction variation coefficients (weighted by the interaction load variance coefficient and the structural complexity index) calculated for each sample category. Using clustering algorithms such as K-means or Gaussian mixture models, the software identifies the numerical distribution characteristics of the interaction variation coefficients under different interaction states. It then sets numerical ranges that reflect the boundaries of normal, suspicious, and abnormal interactions, and saves these three threshold ranges as policy configuration parameters. During actual operation, the software automatically loads these threshold ranges based on predefined rules and uses them as the basis for interaction behavior assessment, ensuring the dynamic adaptability and accuracy of the assessment mechanism. This process allows for real-time updates of historical samples based on the operating environment, periodically recalculating the threshold ranges to optimize identification results.

[0089] In this embodiment, the logic for obtaining the interaction load difference coefficient is as follows:

[0090] The protocol load fluctuation feature information is extracted from the pre-processed interaction behavior feature information, including the sum of all packet sizes, the number of packets, and the difference between the maximum and minimum packet sizes in each protocol in the protocol interaction identification set, and is calibrated as 、 and , Indicates the protocol interaction identifier set The sum of the sizes of all packets in the protocol, Indicates the protocol interaction identifier set The number of packets in a protocol, Indicates the protocol interaction identifier set The difference between the maximum and minimum packet sizes within a protocol, , is a positive integer;

[0091] The sum of all packet sizes, the number of packets, and the difference between the maximum and minimum packet sizes within each protocol in the protocol interaction identification set can be obtained by real-time capture of network traffic and protocol classification, followed by statistical analysis by protocol dimension during the data processing phase. The specific implementation method is as follows: After completing packet-by-packet access processing and protocol type classification, the software system can traverse the packet set corresponding to each protocol, read and accumulate the payload length field of each packet, and obtain the sum of all packet sizes within the protocol; at the same time, count the packets that appear in the protocol during the traversal process to obtain the number of packets; for the difference between the maximum and minimum packet sizes, a status record of the current maximum and minimum packet sizes is continuously maintained during the traversal, and the difference is calculated at the end of the traversal. The above three types of data can all be dynamically updated and cached in memory through software logic, without the need for human intervention, and can reflect the data carrying characteristics of the protocol in the current interaction window in real time. Among them, the sum of the packet sizes is used to reflect the total data carrying capacity of the protocol, the number of packets reveals the frequency of interaction in communication, and the difference between the maximum and minimum packet sizes reflects the fluctuation range of the protocol's transmission load. These three types of data together constitute the basic input for evaluating the complexity and stability of protocol behavior.

[0092] Calculate the weighted load fluctuation factor of each protocol in the protocol interaction identification set. The specific calculation formula is as follows:

[0093] ;

[0094] Where, The first The weighted load fluctuation factor of each protocol;

[0095] In the calculation of the weighted load fluctuation factor, the The combination of is designed to comprehensively evaluate the traffic load level and fluctuation characteristics of each protocol in multi-protocol interaction, and enhance the ability to identify potential abnormal interaction behaviors. Indicates the The average packet size of each protocol within the interaction window is used to measure the basic load strength of the protocol. If the value is abnormally large or small, it may indicate that the protocol has undertaken atypical data transmission tasks. This introduces the fluctuation of the packet size within the protocol. The weighted load fluctuation factor (WFLF) is the difference between the maximum and minimum packet sizes. This factor controls the impact of outliers through a logarithmic transformation, improving the stability and discrimination of the overall indicator. Adding these two factors creates a composite indicator that reflects both data volume and traffic volatility, accurately characterizing the transmission status of each protocol during interaction. The physical significance of the weighted load fluctuation factor lies in its ability to reveal the protocol's traffic carrying capacity and its stability changes within the interaction window. It is a key basis for assessing whether a protocol in a multi-protocol mixed interaction scenario experiences load anomalies and whether it could be exploited by attackers for data hiding or channel camouflage.

[0096] The weighted load fluctuation factor of each protocol in the protocol interaction identification set Take the logarithm to form the logarithmic load index, according to the formula:

[0097] ;

[0098] Where, The first Logarithmic load indicators of each protocol;

[0099] The calculation of logarithmic load index adopts this formula, the core purpose of which is to calculate the weighted load fluctuation factor of each protocol. Scale compression and nonlinear enhancement are performed to improve sensitivity to subtle fluctuations in multi-protocol traffic while reducing interference caused by outliers. In terms of calculation logic, the comprehensive load and fluctuation of each protocol are first normalized into a unified dimension indicator. , and then processed by logarithmic function, so that the value growth shows a decreasing trend, thereby widening the value gap between protocols with smaller loads and highlighting the slight differences in their behaviors; while for extremely large or abnormal The value, its change impact will be compressed by the logarithmic function to avoid excessive impact on the overall evaluation results. The constant 1 is added to prevent The logarithmic operation is undefined, and all values are guaranteed to be in the positive range, which is convenient for subsequent statistical analysis. The physical significance of is that it is a stable and comparable quantitative representation of the complexity of the protocol's transmission behavior within the interaction window. It can reflect whether there are abnormal changes in the data role assumed by the protocol in the multi-protocol interaction scenario, and lay the foundation for further aggregation calculation of load differences.

[0100] Calculate the interaction load difference coefficient. The specific calculation formula is as follows:

[0101] ;

[0102] Where, is the interaction load difference coefficient.

[0103] The core purpose of this formula is to measure the difference in load fluctuation between the protocols in the protocol interaction identification set. First, calculate the logarithmic load index of each protocol , which reflects the load fluctuation level of each protocol during data packet transmission. Next, by calculating all protocols The mean of ), providing an overall reference load level for the entire protocol set. Then, the deviation of the load fluctuation of each protocol from the mean is calculated by the square of the difference, that is, the degree of dispersion of the load fluctuation of the protocol. Finally, the square root of the square of the deviation of all protocols is averaged to obtain the interaction load difference coefficient The physical significance of the interaction load difference coefficient is that it provides a quantitative measure of the load change of the entire protocol set during the interaction process. A large value indicates that the load fluctuations between protocols are significantly different, which may indicate abnormal traffic or behavior of some protocols, and may be a signal of potential attacks or abnormal behavior. Small values indicate consistent load fluctuations between protocols, generally indicating high stability in the protocol interaction process. Therefore, the interaction load variance coefficient can be effectively used to detect abnormal fluctuations in protocol interactions and serve as a basis for subsequent adjustments to protection mechanisms.

[0104] Interaction load difference coefficient The size directly reflects the degree of difference in load fluctuations between the protocols in the protocol interaction identification set, and is therefore highly correlated with the degree of change in the interaction behavior between the evaluated protocols. When the interaction load difference coefficient is large, it means that the protocols present significantly different load fluctuation patterns within the same interaction window, that is, the transmission behavior of some protocols deviates significantly from other protocols in terms of intensity or stability. This inconsistency usually means that the interaction behavior between protocols has undergone a mutation or abnormal change, which may indicate the existence of attack behaviors such as malicious traffic nesting, hidden channel construction, or disguised communication. On the contrary, when the interaction load difference coefficient is small, it means that the load fluctuations between protocols are relatively consistent, and the interaction behavior tends to be stable and coordinated, which usually indicates that the current protocol collaboration environment is in a normal state. Therefore, by The judgment of the value can effectively evaluate whether the protocol interaction behavior is within the normal fluctuation range, thereby providing an accurate judgment basis for subsequent dynamic regulation.

[0105] In this embodiment, the logic for obtaining the structural complexity index is as follows:

[0106] The complex feature information of the protocol structure is extracted from the preprocessed interactive behavior feature information, including the number of types of all packet header fields, the control field ratio and the header field information entropy value of each protocol in the protocol interaction identification set, and marked as 、 and , Indicates the protocol interaction identifier set The number of all packet header field types in the protocol, Indicates the protocol interaction identifier set The ratio of control fields within the protocol, Indicates the protocol interaction identifier set The information entropy value of the header field in the protocol, , is a positive integer;

[0107] To obtain three types of data—the number of header field types, the control field ratio, and the header field information entropy value—for each protocol in the protocol interaction identification set, software can be used to gradually parse network packets. First, during the packet-by-packet processing phase, each packet is decoded using a protocol analysis library (such as libpcap or a deep packet inspection engine, as used by Wireshark) to extract its header fields. The number of header field types is determined by identifying and deleting duplicate field names across protocols, reflecting the diversity of the protocol header structure. The control field ratio refers to the proportion of fields used for state management, connection control, handshake negotiation, and other functions in the protocol header field. This is calculated by applying predefined semantic classifications to the fields and counting the proportions of relevant fields. The header field information entropy value is calculated by calculating the frequency distribution of each field in a protocol dataset and using information entropy formulas (such as Shannon Entropy) to calculate the distribution uncertainty of the field content. A larger value indicates more random field variation and a more complex structure. Through this approach, the software can quantify the structural characteristics of each protocol in network traffic, providing a foundation for the subsequent generation of a structural complexity factor.

[0108] Calculate the structural complexity factor of each protocol in the protocol interaction identification set. The specific calculation formula is as follows:

[0109] ;

[0110] Where, The first The structural complexity factor of each protocol;

[0111] This formula is designed to characterize the structural complexity of each protocol in the protocol interaction identification set in multiple dimensions. Its calculation process integrates three aspects: control logic strength, information distribution complexity, and field type diversity. First, It represents the square of the control field ratio. The square operation enhances the influence of high ratio of control field on the complexity of the structure, which shows that the higher the control logic dominance in the protocol, the more complex its internal structure is. It is an exponential operation on the information entropy of the header field. It describes the unpredictability and uncertainty of the header field distribution. The index processing further amplifies the complexity of the high entropy protocol, making the weight of the protocol with chaotic or changeable structure increased in the index. The number of field types The logarithmic function transformation of , which not only preserves its quantity change trend, but also avoids directly linearly amplifying the number of fields, reflecting the impact of field richness on the structure. By combining these three items in a product way, the structural complexity factor It can comprehensively reflect the complex characteristics of the protocol at three levels: control logic, field diversity, and header field distribution. Its physical significance lies in measuring the complexity challenges that a certain protocol brings to the system's recognition and parsing capabilities during the interaction process, thereby providing an important reference for subsequent behavioral change assessments.

[0112] Calculate the structural complexity index. The specific calculation formula is as follows:

[0113] ;

[0114] Where, is the structural complexity index.

[0115] This calculation method uses the arithmetic mean to combine the structural complexity factors of multiple protocols in order to measure the overall level of the entire protocol interaction set in terms of structural complexity. The calculation process first sums the structural complexity factors of each protocol to obtain the total structural complexity of the interaction protocol set, and then divides it by the number of protocols. , and standardize them to avoid deviations caused by different numbers of protocols. This design can effectively reflect the average complexity of all interactive protocols at the overall structural level, and has good comparability and stability. The physical meaning of the structural complexity index is that it represents the overall complexity of the protocol interaction structure in the current interaction window. The higher the complexity, the more difficult it is to model and identify the protocol interaction relationship, and the more hidden the potential attack is, providing a basic basis for the dynamic regulation and identification mechanism of network security protection. In other words, It is a key reference quantity that drives the sensitivity adjustment and policy optimization of cross-protocol traffic identification mechanisms.

[0116] Structural complexity index The magnitude of the Structural Complexity Index directly reflects the overall structural complexity of each protocol in the protocol interaction identification set, and this complexity is closely related to the variability of inter-protocol interaction behavior. A high Structural Complexity Index indicates that the protocol set contains a wide variety of packet header field types, a high proportion of control fields, and a high information entropy value for the field distribution. This suggests that these protocols may possess high dynamic adaptability and concealment capabilities during interaction, resulting in more flexible and varied interactions and a high degree of behavioral variability, making them difficult to effectively identify using static models. Conversely, a low Structural Complexity Index indicates a relatively stable protocol structure, concentrated use of control fields, and low information entropy. Interaction behavior is regular and fixed, with relatively low variability, making it easier to identify and model. Therefore, a higher Structural Complexity Index indicates a greater degree of variability in protocol interaction behavior, reflecting a more complex and unpredictable inter-protocol interaction state currently facing the system, placing higher demands on dynamic protection mechanisms. The size of can be used as an important parameter basis to evaluate and quantify the degree of this behavioral change.

[0117] In this embodiment, based on the generated interaction load difference coefficient and structural complexity index , the interaction variation coefficient is generated by weighted summation. The specific calculation formula is as follows:

[0118] ;

[0119] Where, is the interaction coefficient of variation, and Interaction load difference coefficient and structural complexity index The non-zero weight coefficient of .

[0120] The generation of the interaction variation coefficient can be realized by software, specifically including: first, the interaction load difference coefficient obtained by calculation is converted into Structural Complexity Index are imported into the analysis model as input parameters respectively; then, two non-zero weight coefficients are preset in the model, namely and , used to regulate and The coefficient of variation in the interaction The impact ratio of Indicates the importance of the impact of load differences when evaluating the degree of change in interactive behavior. Indicates the importance attached to the complexity of the protocol structure. Both are set according to the needs of network protection strategy, with flexibility and adjustability to meet Generally, if the target system is more concerned about abnormal traffic distribution, it can be appropriately increased. If you pay more attention to the changes in the structural diversity of the protocol itself, you can appropriately increase Finally, the interaction change coefficient is generated by weighted summation , to achieve a comprehensive quantitative evaluation of the overall changing trend of multi-protocol interaction behaviors.

[0121] In this embodiment, the preset threshold interval of the interaction coefficient is determined. , and after determination, the interaction variation coefficient generated Perform a comparison and evaluate the degree of change in the interaction behavior between the protocols in the protocol interaction identification set based on the comparison results. The specific comparison analysis is as follows:

[0122] like ,The change degree of the interaction behaviors between the ,protocol interaction identification set is the normal change degree;

[0123] This indicates that the degree of variability in protocol interaction behavior is within normal limits. Interactions between protocols are relatively stable, with minimal fluctuations in protocol load and structural complexity. This generally indicates that protocol interactions within the network are operating within expected normal conditions, with no signs of abnormal or malicious traffic. In this situation, the network security protection system can maintain its current protection strategy without overreacting. This state frees the system's protection resources and computing power to monitor other, higher-risk activities, avoiding unnecessary computational overhead.

[0124] like ,The change degree of the interaction behaviors between the ,protocol interaction identification set is significant ;

[0125] This indicates significant fluctuations in protocol load or structural complexity, possibly due to behavioral changes in certain protocols or unusual data exchange patterns within the network. In this case, protection systems should conduct more detailed monitoring of these protocols to identify potential network attacks or data leaks. In this case, protection mechanisms may trigger alerts or take preventative measures, such as enhanced traffic analysis and the activation of additional detection algorithms to identify potential malicious activity and prevent further escalation.

[0126] like ,The degree of change in the interaction behaviors between the ,protocol interaction identification set is a dramatic change degree.

[0127] This situation indicates a sudden change in the way protocols interact, with unusual load fluctuations or extreme abnormalities in protocol structure complexity. This may indicate the presence of malicious traffic, such as network attacks, protocol spoofing, data leaks, and other high-risk events. This change is often caused by malicious exploitation or abnormal behavior of certain protocols within the network. In this case, the protection system needs to take immediate emergency measures, such as blocking suspicious traffic, analyzing its source, or even activating more advanced intrusion prevention systems to prevent possible attacks. The impact of this situation is that the system needs to quickly identify the anomaly and take action to mitigate potential network risks while simultaneously activating protection mechanisms to ensure network security.

[0128] Based on the evaluation results, dynamic regulation of cross-protocol traffic identification mechanisms is performed;

[0129] In this embodiment, the cross-protocol traffic identification mechanism is dynamically regulated based on the evaluation results, specifically:

[0130] If the assessment result indicates a normal degree of change, the current cross-protocol traffic identification mechanism operating parameters are maintained, and the existing protocol identification rules and protection strategies continue to be used;

[0131] If the assessment result indicates a normal level of change, the current cross-protocol traffic identification mechanism operating parameters are maintained, and the existing protocol identification rules and protection strategies continue to be used. This can be achieved through software configuration and dynamic parameter control. Specifically, the software first triggers a routine status check based on the assessment result to confirm that the current traffic identification algorithm and protection strategy are operating normally and there are no signs of abnormal fluctuations or malicious traffic. In this case, the system maintains the existing protocol identification rules and detection strategy and continues to monitor normal protocol interaction behavior. To ensure this, the software uses threshold parameters in the configuration file to maintain fixed settings for parameters such as the monitoring window size, protocol hierarchy analysis method, and packet filtering thresholds for interaction traffic. This approach is adopted because, under normal levels of change, protocol interaction behavior does not change significantly, and the network state is relatively stable. Continuing to use the existing protection strategy can save computing resources, avoid unnecessary system scheduling and burden, and ensure that network protection does not overreact and affect system performance or generate false alarms. Therefore, the software chooses not to adjust the protection strategy and continues with normal traffic monitoring and protocol identification.

[0132] If the assessment result indicates a significant change, the sensitivity of traffic analysis will be increased, the monitoring window for inter-protocol data traffic will be adjusted, and the frequency of extracting protocol interaction behavior features will be increased to identify potential protocol coordination attacks and disguises.

[0133] If the assessment indicates a significant change, the software can adjust the sensitivity of the traffic analysis, optimize the monitoring window for inter-protocol data traffic, and increase the frequency of protocol interaction behavior feature extraction to identify potential coordinated attacks and masquerading. This is achieved as follows: First, upon identifying significant changes in protocol interactions based on the assessment results, the software automatically increases the sampling frequency of network traffic, shortening the time span of the protocol monitoring window. This allows the system to more frequently detect subtle changes in protocol interactions. Second, the software improves the accuracy and frequency of protocol behavior feature extraction and adds packet analysis capabilities to detect anomalous patterns in protocol traffic in real time. This further refines packet analysis, particularly in scenarios involving coordinated interaction of multiple protocols, focusing on potential protocol masquerading and attack behaviors. To optimize the sensitivity of the traffic analysis, the software also enables a more sophisticated rules engine to conduct deeper analysis of inter-protocol traffic statistical characteristics, transmission patterns, and traffic ratios, thereby enhancing its ability to identify complex attacks. This approach is adopted because when the degree of change is significant, the behavior of protocol interaction has undergone more obvious changes. Simple static monitoring rules may not be able to identify potential attack behaviors or data disguise in a timely manner. Increasing sensitivity and analysis frequency can ensure higher detection accuracy, thereby preventing potential threats in advance and preventing attacks from expanding to more serious stages.

[0134] If the assessment result indicates a drastic change, the core parameters of the cross-protocol traffic identification mechanism will be adjusted, advanced protocol analysis algorithms will be enabled, the traffic filtering mechanism will be strengthened to block potential malicious protocol traffic, and the real-time threat identification function will be triggered to isolate suspicious traffic.

[0135] If the assessment indicates a significant change, the software can adjust the core parameters of the cross-protocol traffic identification mechanism, enable advanced protocol analysis algorithms, strengthen traffic filtering mechanisms, block potentially malicious protocol traffic, and trigger real-time threat identification to isolate suspicious traffic. This implementation involves: First, upon detecting a significant change, the software system immediately uses a dynamic parameter adjustment mechanism to modify key configuration parameters in the cross-protocol traffic identification module. These include increasing the depth of protocol analysis, shortening the packet analysis cycle, and adjusting packet feature extraction algorithms to promptly detect significant changes in protocol behavior. Second, the software activates advanced protocol analysis algorithms, such as deep packet inspection (DPI) or machine learning-based behavioral analysis algorithms. These algorithms provide deeper analysis of abnormal patterns, protocol masquerading, and traffic mixing in protocol interactions, especially when multiple protocols interact collaboratively. To further strengthen protection, the software also activates stricter traffic filtering rules, automatically filtering based on real-time data traffic patterns, protocol characteristics, and blacklists to block suspected malicious traffic. Finally, in this case, the software also activates real-time threat identification. By analyzing traffic source, destination address, protocol identifiers, and other information, it triggers an automated isolation mechanism to isolate potentially malicious traffic and prevent it from spreading to other network nodes. The reason for adopting this approach is that when protocol interaction behavior changes drastically, conventional detection methods and protection strategies cannot effectively deal with sudden malicious traffic or complex attack patterns. Therefore, it is necessary to adjust core parameters and enable advanced analysis algorithms to respond in real time and accurately identify potential threats to ensure that the security of the network system is not compromised.

[0136] Based on the recognition results after dynamic regulation, the corresponding protection actions are executed, and the recognition results and the corresponding interactive behavior feature information are recorded at the same time, and the evaluation conditions and regulation strategies are updated based on the recorded content.

[0137] After completing the dynamic regulation of the cross-protocol traffic identification mechanism, the software can execute the protection actions corresponding to the identification results through the integrated rule matching and behavior response mechanism. Specifically, the software will first call the rules in the corresponding protection policy library according to the degree of match between the identified protocol interaction behavior and the attack pattern, including connection blocking, session interruption, IP blacklist marking, specific protocol restrictions and other operations, and set the response priority according to the risk level classified by the identification result. At the same time, the system will perform structured storage of the identification results, including information such as the identified protocol combination, abnormal behavior patterns, and associated data packet characteristics, and record them in the log database together with timestamps, identification logic, and triggered response measures. These recording operations are implemented in software by the log management submodule, supporting automatic archiving, label classification, and index retrieval, providing a basis for subsequent analysis and auditing.

[0138] In addition, the software system also inputs the recorded interactive behavior feature information and identification results as feedback information into the evaluation module to achieve dynamic optimization of the evaluation conditions and control strategies. The software executes a periodic strategy evaluation program in the background, performs cluster analysis and rule evolution on the recorded identification cases, and automatically optimizes the feature extraction parameters based on the previously successfully identified attack patterns, adjusts the threshold range of the interaction change coefficient, and updates the protocol identification granularity and trigger conditions, thereby improving the system's adaptability when facing new or evolving attack behaviors in the future. This mechanism realizes a closed-loop process from identification, response, recording to self-optimization, which not only improves the real-time and accuracy of the protection system, but also enhances the system's sustainable evolution capability. It is an important part of realizing adaptive security protection based on software control logic.

[0139] like Figure 2 The network security protection system based on traffic analysis shown includes a protocol identification and classification module, an interactive protocol calibration module, an interactive behavior evaluation module, an identification strategy control module, and a protection closed-loop optimization module;

[0140] The protocol identification and classification module performs packet-by-packet access processing on all traffic transmitted through the network, extracts the protocol identification field, port information and transmission direction information of each data packet, and completes the protocol type classification of each data packet;

[0141] The interaction protocol identification module determines whether there is multi-protocol interaction traffic based on the protocol type classification results. If so, it determines all the protocols involved in the interaction and classifies them into a protocol interaction identification set.

[0142] An interaction behavior evaluation module obtains interaction behavior characteristic information of each protocol in the protocol interaction identification set, analyzes it after acquisition, and evaluates the degree of change in interaction behavior between each protocol in the protocol interaction identification set;

[0143] The identification policy control module dynamically controls the cross-protocol traffic identification mechanism based on the evaluation results;

[0144] The protection closed-loop optimization module executes corresponding protection actions based on the recognition results after dynamic regulation, records the recognition results and corresponding interactive behavior feature information, and updates the evaluation conditions and regulation strategies based on the recorded content.

[0145] The above formulas are all dimensionless and numerical calculations. The formulas are obtained by collecting a large amount of data and performing software simulation to obtain the most recent real situation. The preset parameters in the formulas are set by technicians in this field according to actual conditions.

[0146] The above embodiments can be implemented in whole or in part via software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product comprises one or more computer instructions or computer programs. When loaded or executed on a computer, the processes or functions described in the embodiments of this application are fully or partially performed. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired or wireless means (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium accessible by a computer or a data storage device such as a server or data center that contains a collection of one or more available media. The available medium can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media. The semiconductor media can be a solid-state drive.

[0147] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0148] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0149] In the several embodiments provided in this application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the embodiments described above are merely illustrative. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0150] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0151] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0152] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A network security protection method based on traffic analysis, characterized in that: The specific steps include: Perform packet-by-packet access processing on all traffic transmitted through the network, extract the protocol identification field, port information and transmission direction information of each data packet, and complete the protocol type classification of each data packet; Based on the protocol type classification results, determine whether there is multi-protocol interaction traffic. If so, determine all protocols involved in the interaction and classify them into a protocol interaction identification set; Obtaining interaction behavior characteristic information of each protocol in the protocol interaction identification set, and analyzing it after obtaining it to evaluate the degree of change in the interaction behavior between each protocol in the protocol interaction identification set; The specific steps include: Obtaining the interaction behavior characteristic information of each protocol in the protocol interaction identification set and performing preprocessing after obtaining; Extracting protocol load fluctuation feature information and protocol structure complexity feature information from the preprocessed interaction behavior feature information, and analyzing them after extraction to generate interaction load difference coefficient and structure complexity index respectively; Based on the generated interaction load difference coefficient and structural complexity index, the interaction variation coefficient is generated by weighted summation; Determine a pre-set interaction change coefficient threshold interval, compare it with the generated interaction change coefficient after determination, and evaluate the degree of change of the interaction behavior between each protocol in the protocol interaction identification set based on the comparison result; Based on the evaluation results, dynamic regulation of cross-protocol traffic identification mechanisms is performed; Based on the recognition results after dynamic regulation, the corresponding protection actions are executed, and the recognition results and the corresponding interactive behavior feature information are recorded at the same time, and the evaluation conditions and regulation strategies are updated based on the recorded content.

2. The network security protection method based on traffic analysis according to claim 1 is characterized in that: Based on the protocol type classification results, determine whether there is multi-protocol interaction traffic. If so, identify all protocols involved in the interaction and group them into a protocol interaction identifier set, specifically: Based on the protocol type classification result of each data packet, statistics are collected on the network traffic after protocol type classification within a pre-set continuous time window. By analyzing the time sequence of data packets corresponding to all protocols within the pre-set continuous time window, it is determined whether there is multi-protocol interactive traffic; the multi-protocol interactive traffic refers to the situation where data packets of several protocols appear alternately within the pre-set continuous time window; If it is determined that there is multi-protocol interactive traffic, the protocol types corresponding to all interleaved data packets in the preset continuous time window are determined as the protocols participating in the interaction, and the determined protocol combinations are constructed as a protocol interaction identification set.

3. The network security protection method based on traffic analysis according to claim 2 is characterized in that: The logic for obtaining the interaction load difference coefficient is as follows: The protocol load fluctuation feature information is extracted from the pre-processed interaction behavior feature information, including the sum of all packet sizes, the number of packets, and the difference between the maximum and minimum packet sizes in each protocol in the protocol interaction identification set, and is calibrated as 、 and , Indicates the protocol interaction identifier set The sum of the sizes of all packets in the protocol, Indicates the protocol interaction identifier set The number of packets in a protocol, Indicates the protocol interaction identifier set The difference between the maximum and minimum packet sizes within a protocol, , is a positive integer; Calculate the weighted load fluctuation factor of each protocol in the protocol interaction identification set. The specific calculation formula is as follows: Where, The first The weighted load fluctuation factor of each protocol; The weighted load fluctuation factor of each protocol in the protocol interaction identification set Take the logarithm to form the logarithmic load index, according to the formula: Where, The first Logarithmic load indicators of each protocol; Calculate the interaction load difference coefficient. The specific calculation formula is as follows: Where, is the interaction load difference coefficient.

4. The network security protection method based on traffic analysis according to claim 3 is characterized in that: The logic for obtaining the structural complexity index is as follows: The complex feature information of the protocol structure is extracted from the preprocessed interactive behavior feature information, including the number of types of all packet header fields, the control field ratio and the header field information entropy value of each protocol in the protocol interaction identification set, and marked as 、 and , Indicates the protocol interaction identifier set The number of all packet header field types in the protocol, Indicates the protocol interaction identifier set The ratio of control fields within the protocol, Indicates the protocol interaction identifier set The information entropy value of the header field in the protocol, , is a positive integer; Calculate the structural complexity factor of each protocol in the protocol interaction identification set. The specific calculation formula is as follows: Where, The first The structural complexity factor of each protocol; Calculate the structural complexity index. The specific calculation formula is as follows: Where, is the structural complexity index.

5. The network security protection method based on traffic analysis according to claim 4 is characterized in that: Based on the generated interaction load difference coefficient and structural complexity index , the interaction variation coefficient is generated by weighted summation. The specific calculation formula is as follows: Where, is the interaction coefficient of variation, and Interaction load difference coefficient and structural complexity index The non-zero weight coefficient of .

6. The network security protection method based on traffic analysis according to claim 5 is characterized in that: Determine the pre-set threshold interval of the interaction coefficient of variation , and after determination, the interaction variation coefficient generated Perform a comparison and evaluate the degree of change in the interaction behavior between the protocols in the protocol interaction identification set based on the comparison results. The specific comparison analysis is as follows: like ,The change degree of the interaction behaviors between the ,protocol interaction identification set is the normal change degree; like ,The change degree of the interaction behaviors between the ,protocol interaction identification set is significant ; like ,The degree of change in the interaction behaviors between the ,protocol interaction identification set is a dramatic change degree.

7. The network security protection method based on traffic analysis according to claim 6 is characterized in that: Based on the evaluation results, the cross-protocol traffic identification mechanism is dynamically regulated, specifically: If the assessment result indicates a normal degree of change, the current cross-protocol traffic identification mechanism operating parameters are maintained, and the existing protocol identification rules and protection strategies continue to be used; If the assessment result indicates a significant change, the sensitivity of traffic analysis will be increased, the monitoring window for inter-protocol data traffic will be adjusted, and the frequency of extracting protocol interaction behavior features will be increased to identify potential protocol coordination attacks and disguises. If the assessment result indicates a drastic change, the core parameters of the cross-protocol traffic identification mechanism will be adjusted, advanced protocol analysis algorithms will be enabled, the traffic filtering mechanism will be strengthened to block potential malicious protocol traffic, and the real-time threat identification function will be triggered to isolate suspicious traffic.

8. A network security protection system based on traffic analysis, used to implement the network security protection method based on traffic analysis according to any one of claims 1 to 7, characterized in that: It includes protocol identification and classification module, interactive protocol calibration module, interactive behavior evaluation module, identification strategy control module and protection closed-loop optimization module; The protocol identification and classification module performs packet-by-packet access processing on all traffic transmitted through the network, extracts the protocol identification field, port information and transmission direction information of each data packet, and completes the protocol type classification of each data packet; The interaction protocol identification module determines whether there is multi-protocol interaction traffic based on the protocol type classification results. If so, it determines all the protocols involved in the interaction and classifies them into a protocol interaction identification set. An interaction behavior evaluation module obtains interaction behavior characteristic information of each protocol in the protocol interaction identification set, analyzes it after acquisition, and evaluates the degree of change in interaction behavior between each protocol in the protocol interaction identification set; The identification policy control module dynamically controls the cross-protocol traffic identification mechanism based on the evaluation results; The protection closed-loop optimization module executes corresponding protection actions based on the recognition results after dynamic regulation, records the recognition results and corresponding interactive behavior feature information, and updates the evaluation conditions and regulation strategies based on the recorded content.

Images