Encryption and decryption technology of network encryption traffic based on entropy calculation

Abstract

The invention discloses an entropy calculation-based encryption and decryption technology for network encryption traffic, which relates to the technical field of network security and data encryption, and comprises the following steps of: initializing a pulse neural network, optimizing parameters through a genetic algorithm, extracting a feature vector and calculating an entropy value; entropy mutation detection and reinforcement learning are combined to adjust an entropy mutation threshold value, and a classification label is allocated to each fragment; and the classification label and the entropy value of each fragment are added to an input vector, a new vector is generated by using masked auto-regression flow transformation, an original entropy is calculated, calculation nodes are configured in the network to equally divide sample points and calculate the original entropy, and a main node summarizes frequency values and calculates an entropy boundary value. Normal flow and abnormal flow are accurately distinguished by optimizing entropy calculation and anomaly detection through a pulse neural network and reinforcement learning, an entropy boundary value is rapidly calculated through distributed calculation and standardized flow transformation, an encryption strategy is dynamically selected according to the entropy boundary value and a classification label, the confidentiality of data is protected, and the traceability of the abnormal flow is enhanced.

Description

Technical Field

[0001] The present invention relates to the field of network security and data encryption technology, and in particular to an encryption and decryption technology for network encrypted traffic based on entropy calculation. Background Art

[0002] As a core component of modern network security, network traffic encryption and decryption technology has undergone a significant evolution from traditional static encryption to dynamic adaptive encryption. Early technologies mainly relied on symmetric encryption algorithms (such as DES, AES) or asymmetric encryption algorithms (such as RSA) to encrypt and transmit data packets with fixed keys to protect data confidentiality. However, with the increasing complexity of network attacks, such as distributed denial of service attacks (DDoS) and advanced persistent threats (APT), a single encryption mechanism has become difficult to meet the needs of both real-time and security. In recent years, the combination of software-defined networking (SDN) and machine learning technology has promoted the development of traffic analysis and encryption strategies. Intelligent development, for example, traffic anomaly detection methods based on entropy calculation have gradually attracted attention. They identify potential abnormal behaviors by analyzing the statistical characteristics of traffic features (such as source IP entropy and port entropy). In addition, the application of generation models such as Normalizing Flow makes the entropy estimation of high-dimensional feature vectors more accurate, providing theoretical support for dynamic encryption strategies. At the same time, the introduction of quantum random number generators (QRNGs) further improves the randomness and security of key generation. However, these technologies mostly focus on the optimization of independent modules and lack the systematic integration of traffic segmentation, entropy calculation and encryption and decryption strategies, which limits their applicability in complex network environments.

[0003] Although existing technologies have made significant progress in the field of network traffic encryption and decryption, several shortcomings remain, particularly in terms of real-time performance, anomaly detection accuracy, and encryption strategy flexibility. Traditional anomaly detection methods based on entropy calculation typically rely on static thresholds or single feature analysis, making them difficult to adapt to the variability of traffic patterns, resulting in high false positive and false negative rates. They perform particularly poorly when dealing with disguised traffic or small-scale anomalies. Existing technologies often fail to fully utilize distributed computing architectures during traffic feature extraction and entropy calculation, resulting in low computational efficiency and difficulty meeting the real-time processing requirements of large-scale networks. Encryption strategy selection is often based on predefined rules and lacks dynamic linkage with anomaly detection results. For example, support for isolating and tracking anomaly traffic or implementing differentiated encryption is insufficient, which reduces system security and resource utilization efficiency. If traffic feature vector slicing and entropy boundary calculation can be closely integrated with encryption and decryption strategies, and an adaptive learning mechanism can be introduced, the accuracy of anomaly detection, the real-time performance of computation, and the targeted nature of encryption can be significantly improved. These shortcomings provide room for improvement for our invention, particularly in optimizing traffic slicing management through entropy calculation, dynamically adjusting encryption strategies, and improving the overall robustness of the system. Summary of the Invention

[0004] In view of the above existing problems, the present invention is proposed.

[0005] Therefore, the present invention provides an encryption and decryption technology for network encrypted traffic based on entropy calculation to solve the problems commonly faced by existing network traffic encryption and decryption technologies, such as insufficient anomaly detection accuracy, limited real-time processing capabilities, and lack of encryption strategy flexibility.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0007] In a first aspect, the present invention provides an encryption and decryption technology for network encrypted traffic based on entropy calculation, which includes:

[0008] Capture data packets in real time to extract traffic feature vectors, store them in slices, and attach quantum random tags. The traffic feature vectors include source IP address, destination port, protocol type, and timestamp difference.

[0009] Initialize the spiking neural network, optimize parameters using a genetic algorithm, extract feature vectors and calculate entropy values, combine entropy mutation detection and reinforcement learning to adjust the entropy mutation threshold and assign classification labels to each shard;

[0010] Add the classification label and entropy value of each shard to the input vector, use the masked autoregressive flow transform to generate a new vector and calculate the original entropy, configure the computing nodes in the network to evenly distribute the sample points and calculate the original entropy, and the master node summarizes the frequency values and calculates the entropy boundary value;

[0011] Network traffic is encrypted and decrypted based on entropy boundary values and classification tags, and all data is stored and managed in the database.

[0012] As a preferred solution of the encryption and decryption technology based on entropy calculation for network encrypted traffic of the present invention, the initialization of the pulse neural network, optimizing parameters by genetic algorithm, extracting feature vectors and calculating entropy values include:

[0013] Start the spiking neural network model on the processing server and use the NEST simulator as the implementation tool to initialize the synaptic weights of the spiking neural network and set the learning rules;

[0014] Use genetic algorithms to optimize model parameters, read shards and load them into memory buffers, deserialize the shards, and extract feature vectors as input vectors;

[0015] The input vector is converted into a pulse frequency according to the proportional relationship, and the input vector is substituted into the spiking neural network model. The trigger threshold of each neuron is dynamically adjusted according to the recent pulse emission;

[0016] When the membrane potential exceeds the trigger threshold, the neuron will emit a pulse and reset the membrane potential to the baseline value. The pulse will propagate to the output layer. The membrane potential of the output layer is directly accumulated according to the incoming pulse signal, and the entropy value is calculated and normalized. The calculated entropy value is stored in the memory buffer as the entropy value of the current slice.

[0017] As a preferred solution of the entropy calculation-based encryption and decryption technology for network encrypted traffic of the present invention, the method of combining entropy mutation detection and reinforcement learning to adjust the entropy mutation threshold and assign a classification label to each shard includes:

[0018] Extract the source IP set from the feature vector and use a hash table to remove duplicates to obtain the number of unique source IPs. Set an anti-spoofing threshold. If the number of unique source IPs is greater than the anti-spoofing threshold, it indicates that the traffic may be forged and entropy mutation detection is performed. Otherwise, it passes verification and is marked as normal traffic.

[0019] Use the RL network to dynamically adjust the entropy mutation threshold. The RL network selects the adjustment factor through population coding and compares the calculated entropy mutation with the dynamically adjusted entropy mutation threshold. If the entropy mutation is greater than or equal to the entropy mutation threshold, a secondary verification is triggered. Otherwise, the traffic passes the verification and is marked as normal.

[0020] The secondary verification includes calculating the global standard deviation of the original byte stream corresponding to the feature vector, using a random number generator to generate a random index and randomly extracting a template of length 2 from the original byte stream, denoted as T m Repeat the random index generation process and extract a template of length 3, denoted as T m+1 , initialize the thread, respectively T m and T m+1 All templates are divided into different threads, the matching threshold r is set, the assigned templates are processed in each thread, and T is calculated. m and T m+1 The total number of matching pairs is set, the number of repeated sampling is set, the number of cycles is used as the seed, and the process of calculating the total number of matching pairs is repeated by increasing the seed to generate additional total number of matching pairs, the average of the total number of matching pairs is calculated and the entropy value is estimated, the entropy value fluctuation threshold is set, the estimated entropy value is compared with the entropy value, and a classification label is assigned to each fragment. If the change between the estimated entropy value and the entropy value is greater than or equal to the entropy value fluctuation threshold, the fragment is marked as abnormal traffic. Otherwise, after verification, all fragments that pass the verification are marked as normal traffic.

[0021] As a preferred solution of the entropy calculation-based encryption and decryption technology for network encrypted traffic of the present invention, the step of adding the classification label and entropy value of each slice to the input vector, using the masked autoregressive flow transform to generate a new vector, and calculating the original entropy includes:

[0022] Add the classification label and entropy value of each shard to its input vector and apply the normalized flow transformation to generate the transformed input vector;

[0023] G sample points are extracted from all transformed input vectors using uniform random sampling. The transformed entropy is calculated using the k-nearest neighbor distance and the k-nearest neighbor entropy estimation method. The original entropy is calculated based on the transformed entropy and the Jacobian determinant.

[0024] As a preferred solution of the encryption and decryption technology based on entropy calculation for network encrypted traffic of the present invention, wherein: the configuration of computing nodes in the network to evenly distribute sample points and calculate the original entropy, and the master node summarizing the frequency value and calculating the entropy boundary value includes:

[0025] Configure computing nodes in the network and use the polling allocation algorithm to evenly distribute sample points to each node. Each node independently calculates the original entropy of its sample and extracts the top node with the highest eigenvalue. Each node broadcasts the sample points to the master node through the gRPC protocol, and uses the Shannon entropy formula to calculate the entropy boundary value of the local frequency value.

[0026] As a preferred solution of the network encrypted traffic encryption and decryption technology based on entropy calculation of the present invention, wherein: the encryption and decryption of network traffic based on the entropy boundary value and classification mark includes:

[0027] Set the encryption threshold, obtain the classification label and entropy boundary value, encrypt all fragments and generate a key. The ODL controller distributes the key to the receiving ODL server through the TLS encrypted channel. The receiving OVS switch captures the encrypted traffic fragments and uploads the fragment metadata to the ODL controller through the OpenFlow protocol. The ODL controller parses the metadata, extracts the encryption method and decrypts it.

[0028] As a preferred solution of the network encrypted traffic encryption and decryption technology based on entropy calculation of the present invention, wherein: storing all data in the database and managing it includes:

[0029] Select a relational database to manage data and relationship analysis results, design the database table structure to store different types of data, set up regular backup tasks, back up all data in the database, manage database user permissions, and encrypt and store static data.

[0030] In a second aspect, the present invention provides a network traffic encryption and decryption system based on entropy calculation, comprising:

[0031] The data acquisition module is used to capture data packets in real time to extract traffic feature vectors, store the traffic feature vectors in slices and attach quantum random tags;

[0032] The shard classification module is used to initialize the spiking neural network, optimize parameters through genetic algorithms, extract feature vectors and calculate entropy values, combine entropy mutation detection and reinforcement learning to adjust the entropy mutation threshold and assign classification labels to each shard;

[0033] The raw entropy calculation module is used to add the classification label and entropy value of each shard to the input vector, use the masked autoregressive flow transform to generate a new vector and calculate the raw entropy. The computing nodes in the network are configured to evenly distribute the sample points and calculate the raw entropy. The master node summarizes the frequency values and calculates the entropy boundary value.

[0034] The encryption and decryption module is used to encrypt and decrypt network traffic based on entropy boundary values and classification tags;

[0035] The data storage module is used to store and manage all data in the database.

[0036] In a third aspect, the present invention provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: when the computer program is executed by the processor, it implements any step of the encryption and decryption technology based on entropy calculation for network encrypted traffic as described in the first aspect of the present invention.

[0037] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, it implements any step of the encryption and decryption technology based on entropy calculation of network encrypted traffic as described in the first aspect of the present invention.

[0038] The beneficial effects of the present invention are: using pulse neural networks and reinforcement learning to optimize entropy value calculation and anomaly detection, accurately distinguishing normal and abnormal traffic, quickly calculating entropy boundary values through distributed computing and standardized stream transformation, dynamically selecting encryption strategies based on entropy boundary values and classification labels, protecting data confidentiality, and enhancing the traceability of abnormal traffic. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0040] Figure 1 This is a flow chart of the encryption and decryption technology based on entropy calculation for network encrypted traffic in Example 1.

[0041] Figure 2 Schematic diagram of the network traffic encryption and decryption system based on entropy calculation in Example 1.

[0042] Figure 3This is a flowchart of assigning classification labels to each fragment in Example 1.

[0043] Figure 4 This is a flow chart for calculating the entropy boundary value in Example 1. DETAILED DESCRIPTION

[0044] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0045] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0046] Secondly, the term "one embodiment" or "embodiment" herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in various places throughout this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive of other embodiments.

[0047] Example 1, with reference to Figures 1 to 4 , which is the first embodiment of the present invention, provides an encryption and decryption technology for network encrypted traffic based on entropy calculation, including the following steps:

[0048] S1, real-time capture of data packets to extract traffic feature vectors, store the traffic feature vectors in slices and attach quantum random tags;

[0049] Specifically, a software-defined network (SDN) switch is deployed in the network, Open vSwitch (OVS) is selected and connected to the SDN controller (ODL), and a quantum random number generator (QRNG) is connected to the ODL server through a USB interface. The Quantis driver is installed in ODL and the API interface is configured. A scheduled task is started in ODL to call the QRNG API once per second to generate a random integer sequence (e.g., a length of 1000). The original bit stream (4Mbit per second) output by the QRNG is divided into blocks, each 32 bits forming an integer. The random integer sequence is deduplicated to ensure that the sampling index is unique, and is sent to the OVS switch through the OpenFlow protocol. A matching rule is created in OVS for each element in the random integer sequence: if the counter of the packet (counting from 0) is equal to the element, it is sent to the analysis port through port mirroring. An initial sampling window is set (e.g., 2000 bytes). Within the sampling window, OVS captures the packet and outputs the packet set.

[0050] Start the traffic parsing process on the processing server, use the libpcap library to open the data stream of the analysis port, read each data packet in the packet set and extract the traffic feature vector, treat all traffic feature vectors as a shard according to the sampling window and serialize them into binary format, call QRNG to generate an 8-bit quantum random tag and append it to the end of the shard to generate a complete shard.

[0051] By deploying an SDN switch (OVS) in the network and connecting it to an ODL controller, using a quantum random number generator (QRNG) to generate a highly random integer sequence and issue sampling rules, combining port mirroring and the libpcap library to capture and parse traffic fragments in real time, and attaching quantum random tags, the efficiency and security of network traffic processing are significantly improved. By generating a 4Mbit bit stream per second through QRNG and processing it in blocks, the uniqueness of the sampling index is ensured, and efficient packet capture and feature extraction are achieved. Its role is to provide a reliable traffic fragmentation foundation for subsequent entropy calculation and encryption and decryption, ultimately achieving the beneficial effects of enhancing traffic analysis accuracy, improving data randomness and anti-attack capabilities in complex network environments, which is superior to traditional sampling methods based on pseudo-random numbers.

[0052] S2. Initialize the spiking neural network, optimize the parameters through genetic algorithm, extract the feature vector and calculate the entropy value, combine entropy mutation detection and reinforcement learning to adjust the entropy mutation threshold and assign classification labels to each shard;

[0053] Specifically, initializing the spiking neural network, optimizing parameters through genetic algorithms, extracting feature vectors and calculating entropy values include:

[0054] Start the spiking neural network model on the processing server and use the NEST simulator as the implementation tool to initialize the model;

[0055] The initialization includes creating an input layer, a hidden layer, and an output layer, setting the initial membrane potential of each layer, allocating neurons (e.g., 8) in the input layer, with each dimensional feature corresponding to a pair of neurons, one of which processes positive values and the other processes negative values, forming a dual-neuron coding structure, each neuron being configured as a basic pulse generation unit, allocating neurons (e.g., 85) in the hidden layer, the number of which is determined by subsequent genetic algorithm optimization, each neuron adopting a Leaky Integrate-and-Fire (LIF) model, allocating one neuron in the output layer for outputting an entropy value, and adopting the LIF model to fully connect the neurons in the input layer with the neurons in the hidden layer, and the neurons in the hidden layer are fully connected with one neuron in the output layer, with the connection ratio determined by subsequent optimization;

[0056] The membrane potential is a core concept used in spiking neural networks to simulate the working state of biological neurons. It is used to describe the changes in the potential state inside neurons and reflect whether they are activated and emit pulses.

[0057] Set independent membrane parameters for neurons in the hidden layer of the model to enhance model robustness. Apply the generated membrane parameters to the model configuration of each neuron in the hidden layer and store them as a parameter table.

[0058] The membrane parameters include membrane potential, voltage attenuation factor, current attenuation factor and trigger threshold, which are extracted from normal distribution;

[0059] Initialize the synaptic weights of the spiking neural network and set the learning rules;

[0060] Initializing the synaptic weights of the spiking neural network and setting the learning rule includes generating random weights for all synapses (8×85) from the input layer to the hidden layer and from the hidden layer to the output layer, extracting them from a uniform distribution, starting the STDP learning rule, setting the time window and the weight adjustment step size, for example, if the time difference between the input pulse and the output pulse is less than 10ms, the weight is increased by 0.01, otherwise it is reduced by 0.01;

[0061] Genetic algorithms were used to optimize model parameters to determine the number of hidden layer neurons, connection ratio, and membrane potential decay time constant.

[0062] The use of the genetic algorithm to optimize the model parameters includes initializing the population size, each individual including a range of hidden layer neuron numbers, a range of connection ratios, and a range of membrane potential decay time constants, and calculating the fitness F of each individual using the formula:

[0063] F=α·η conv +β·E H ,

[0064] Among them, η conv represents the training convergence time (seconds), measured by simulating training iterations, E H represents the entropy prediction error (bits / bytes), which is calculated by comparing with the true entropy value. α and β represent weight coefficients, which are adjusted through experiments.

[0065] Set the total number of evolutions, and select the first Q individuals with the lowest fitness for each evolution. The value of Q is determined according to the actual situation. Set the crossover probability (such as 0.5) and mutation probability (such as 0.2) to generate a new population. After the total number of evolutions is reached, output the individual with the lowest fitness to determine the optimal model parameters and apply them to the model.

[0066] Read the shards and load them into the memory buffer, deserialize the shards, and extract the feature vectors as input vectors;

[0067] The extraction of the feature vector as the input vector includes extracting the source IP entropy H src , Destination port entropy H dst , Protocol Type Distribution P proto and the timestamp difference change rate σ Δt As input vector;

[0068] The source IP entropy H src The calculation formula is:

[0069]

[0070] Among them, p src [i] represents the probability of occurrence of the i-th unique source IP, and L represents the number of unique source IPs;

[0071] The destination port entropy H dst The calculation formula is:

[0072]

[0073] Among them, p dst [j] represents the probability of occurrence of the jth unique destination port, and M represents the number of unique destination ports;

[0074] The protocol type distribution P proto Refers to counting the number of occurrences of each protocol type and calculating the proportion of each protocol type;

[0075] The timestamp difference change rate σ Δt The calculation formula is:

[0076]

[0077] Among them, μ Δt represents the mean of all timestamp differences, Δt[ι] represents the ι-th timestamp difference, and ξ represents the number of all timestamp differences;

[0078] Check each input feature value. If a feature value is lower than the set threshold, inject Poisson noise into the feature value. The noise injection frequency is 10Hz and the duration is 100 milliseconds. By injecting high-frequency pulse signals, network activity is stimulated to prevent the network from being difficult to train effectively due to weak input signals.

[0079] Convert the input vector into pulse frequency according to the proportional relationship, for example, H src =5.64 is mapped to 56.4Hz (i.e., 56.4 pulses per second). The input vector is substituted into the input layer of the spiking neural network model. The membrane potential of each neuron is determined by the pulse frequency and leakage current. The update formula of the membrane potential is:

[0080] V(t)=V(t-1)+I(t)-V leak ,

[0081] Among them, V(t) and V(t-1) represent the membrane potential at time point t and time point t-1 respectively. The membrane potential is the difference between the internal and external potentials of the neuron. The membrane potential of the neuron changes with time, which determines the active state of the neuron and whether it emits pulses. When the membrane potential reaches a certain threshold, the neuron will emit pulses. I(t) represents the pulse frequency at time point t, and V leak represents the leakage current constant (i.e., simulating the leakage behavior of neurons), obtained experimentally;

[0082] The trigger threshold of each neuron is dynamically adjusted according to the recent pulse emission situation. The adaptive threshold update formula is:

[0083] V th (t) = V th-base +θ·N spike ,

[0084] Among them, V th (t) represents the triggering threshold of the neuron, V th-base represents the basic threshold (such as 1.0), θ represents the adjustment factor, which controls the adjustment amplitude of the threshold, and N spike Indicates the number of pulses in the most recent (e.g. 100ms) time, reflecting the activity of the neuron;

[0085] When the membrane potential exceeds the trigger threshold, the neuron will emit a pulse and reset the membrane potential to the baseline value. The pulse will propagate to the output layer;

[0086] The threshold of the output layer neurons is set to infinity, which means that it does not have a fixed trigger threshold. The membrane potential of the output layer is directly accumulated according to the incoming pulse signal, the entropy value is calculated and normalized, and the calculated entropy value is stored in the memory buffer as the entropy value of the current slice.

[0087] By initializing the pulse neural network and combining it with genetic algorithm to optimize parameters, efficient extraction of network traffic feature vectors and accurate entropy calculation are achieved. A dual-neuron coding structure (positive and negative value separation) and LIF model are used on the processing server to convert features such as source IP entropy and destination port entropy into pulse frequency. Combined with the STDP learning rule and adaptive threshold adjustment, the model ensures accurate capture of the dynamic characteristics of traffic. The number of hidden layer neurons and connection ratio are optimized by genetic algorithm, which significantly reduces the training convergence time and entropy prediction error. The injection of Poisson noise avoids network failure under weak signals and enhances robustness. This step provides a high-quality entropy value foundation for subsequent anomaly detection and encryption and decryption, achieving the beneficial effect of improving the system's adaptability to complex traffic patterns and calculation accuracy.

[0088] Furthermore, combining entropy mutation detection and reinforcement learning to adjust the entropy mutation threshold and assign classification labels to each shard includes:

[0089] Extract the source IP set (for example, 1000 IP addresses) from the feature vector and use a hash table to remove duplicates to obtain the number of unique source IPs. Set an anti-spoofing threshold to represent the maximum number of unique source IPs allowed. The anti-spoofing threshold is based on the statistical law of normal traffic (the mean of the number of unique source IPs, and the anti-spoofing threshold is twice the mean) to detect whether there is forged traffic. Exceeding this value may indicate abnormal traffic. If the number of unique source IPs is greater than the anti-spoofing threshold, it indicates that the traffic may be forged, and entropy mutation detection is performed. Otherwise, it passes verification and is marked as normal traffic.

[0090] The entropy mutation detection refers to reading the entropy value of the previous shard and the entropy value of the current shard and calculating the entropy mutation;

[0091] Use the RL network to dynamically adjust the entropy mutation threshold and define the RL network structure, RL state, RL action, and RL reward;

[0092] The RL network structure includes an input layer, a learning neuron group, a reward and penalty gate group, and a noise injection group. The input layer has 6 neurons corresponding to the input state vector. The learning neuron group has multiple groups, each containing 10 neurons, corresponding to the group encoding of the adjustment factor. Each group in the reward and penalty gate group contains 10 neurons for receiving reward and penalty signals. The noise injection group stimulates network activity through 10 neurons in the early stage of training.

[0093] The RL state refers to the definition of the input state vector S = (H src ,H dst ,P proto ,σ Δt ,H(X),H(X -1 )), where H(X -1 ) represents the entropy value of the previous shard;

[0094] The RL action includes outputting an adjustment factor according to the input state, for example, in the range of [0.5, 1.5], for dynamically adjusting the entropy mutation threshold;

[0095] The RL reward refers to the negative value R of the entropy prediction error, and the formula is:

[0096] R=-|H(X)-H true |,

[0097] Among them, H(X) represents the current entropy value, H truerepresents the true entropy value (obtained through offline analysis), and the weights of the actor network are optimized through the reinforcement learning agent gradient method to maximize the reward;

[0098] The RL network selects the adjustment factor through group coding and compares the calculated entropy mutation with the dynamically adjusted entropy mutation threshold. If the entropy mutation is greater than or equal to the entropy mutation threshold, a secondary verification is triggered. Otherwise, the verification is passed and marked as normal traffic.

[0099] The secondary verification includes calculating the global standard deviation of the original byte stream corresponding to the feature vector for subsequent matching threshold setting, using a random number generator (based on the Mersenne Twister algorithm) to generate a random index and randomly extracting a template of length 2 from the original byte stream, denoted as T m , that is, each template contains 2 consecutive bytes, ensuring that the template does not exceed the byte stream boundary, repeat the random index generation process (can be reused or regenerated) and extract a template of length 3, recorded as T m+1 ;

[0100] Initialize 12 threads (based on a 12-core CPU, such as Intel i5-10400), use the POSIX thread library (pthread) to create a thread pool, and set T m and T m+1 All templates are evenly divided into 12 threads, and each thread is initially allocated about 166 templates (2000÷12≈166);

[0101] Set the matching threshold r, the expression is:

[0102] r=ω×std(S),

[0103] Where ω represents the empirical coefficient (ranging from 0.1 to 0.25, with 0.2 chosen to balance sensitivity and robustness), and std(S) represents the global standard deviation of the original byte stream;

[0104] Process the assigned template in each thread and calculate T m and T m+1 The total number of matching pairs;

[0105] The calculation T in each thread m and T m+1 The matching pairs include T m and T m+1 The maximum distance of each template pair in is calculated and the number of matching pairs is calculated. The calculation formula of the maximum distance is:

[0106]

[0107] Among them, d(t m,i ,t m,∈) represents template t m,i and template t m,∈ 's maximum distance, d(t m+1,i , t m+1,∈ ) represents template t m+1,i and template t m+1,∈ 's maximum distance, t m,i [l] and t m,∈ [l] respectively represent the (l + 1)-th byte of template t m,i and template t m,∈ . ∈ = i + 1 to the end index, |t m,i [l] - t m,∈ [l]| represents the absolute difference at the corresponding position, and max takes the maximum difference as the distance. If d(t m,i , t m,∈ ) < r, it means template t m,i and template t m,∈ match, otherwise, it means they do not match;

[0108] The number of matching template pairs calculated by each thread within its assigned template subset is used as the local matching logarithm;

[0109] Wait for all threads to complete the initial assigned template matching calculation, record the end time of each thread, adopt a dynamic load balancing strategy. If a thread finishes ahead of schedule, obtain the remaining unprocessed templates from the global queue and assign them to this thread for processing, create a new task and start the thread to continue calculating the local matching logarithm. After all tasks (including the initial task and the dynamically assigned tasks) are completed, read the local matching logarithm calculated by each thread, summarize the local results of all threads, and respectively obtain the total matching logarithm of T m and T m+1 ;

[0110] The global queue mentioned above refers to a temporary data structure that is globally visible in the program and is used to store and manage unassigned tasks (i.e., the remaining template indices);

[0111] Set the number of repeated samplings (for example, 150 times), use the current timestamp as the basic seed to ensure that the randomness of each run is controllable and reproducible. Create two empty arrays to store the total matching logarithm of repeated samplings, allocate memory variables to store the estimated entropy value, and set the estimated entropy value to 0;

[0112] Enter a loop, use the loop count as the seed, and repeat the process of calculating the total matching logarithm by incrementing the seed to generate additional total matching logarithms (150 groups). Respectively substitute all the total matching logarithms of T m and T m+1 into the two empty arrays, calculate the average value of the total matching logarithm and estimate the entropy value H. The formula is:

[0113]

[0114] in, and Respectively represent T m and T m+1 The average of the total number of matching pairs, Represents conditional probability, reflecting the m to T m+1 The random change of the negative sign ensures that the entropy value is positive. or Then directly assign H = 0, indicating complete determinism (no random changes);

[0115] Set the entropy fluctuation threshold, compare the estimated entropy value with the entropy value, and assign a classification label to each shard. If the change between the estimated entropy value and the entropy value is greater than or equal to the entropy fluctuation threshold, the shard is marked as abnormal traffic. Otherwise, after verification, all verified shards are marked as normal traffic.

[0116] By extracting the source IP set from the feature vector and combining it with the anti-spoofing threshold to preliminarily screen for forged traffic, the entropy mutation threshold is dynamically adjusted using entropy mutation detection and reinforcement learning (RL) network, and the entropy value is accurately estimated through multi-threaded secondary verification, anomaly detection and classification label assignment of network traffic fragments are achieved. Its function is to capture the mutation characteristics of traffic patterns through hash table deduplication and RL adaptive threshold adjustment, and further verify the entropy fluctuation by combining parallel calculation of template matching logarithms. Its purpose is to provide accurate anomaly judgment basis for subsequent encryption and decryption strategies, and ultimately achieve the beneficial effect of efficiently and accurately identifying abnormal traffic in complex network environments, significantly improving the robustness and real-time performance of detection, and overcoming the limitations of traditional static threshold methods.

[0117] S3. Add the classification label and entropy value of each shard to the input vector, use the masked autoregressive flow transform to generate a new vector and calculate the original entropy. Configure computing nodes in the network to evenly distribute the sample points and calculate the original entropy. The master node summarizes the frequency values and calculates the entropy boundary value.

[0118] Specifically, the classification label and entropy value of each slice are added to the input vector, a new vector is generated using the masked autoregressive flow transform, and the original entropy is calculated including:

[0119] Add the classification label and entropy value of each shard to its input vector and apply the normalized flow transformation to generate the transformed input vector;

[0120] The standardized flow transformation refers to initializing the masked autoregressive flow (MAF) model, using a 5-layer neural network architecture with 128 hidden units in each layer, using the ReLU activation function, loading pre-trained weights, generating initial parameters through offline training based on historical traffic data (50% normal and 50% abnormal samples), defining a transformation function, using the KLD divergence (Kullback-Leibler Divergence) as the loss function, and training by minimizing the difference between the transformed distribution and the uniform distribution. The Adam optimizer is configured and the learning rate, batch size, and training cycle are set.

[0121] G sample points are extracted from all transformed input vectors using uniform random sampling. The value of G is determined according to the actual situation. The transformed entropy is calculated using the k-nearest neighbor distance and the k-NN entropy estimation method. The original entropy is calculated based on the transformed entropy and the Jacobian determinant.

[0122] By incorporating the classification label and entropy value of each shard into the input vector, and using the masked autoregressive flow (MAF) model for standardized flow transformation, combined with the k-nearest neighbor entropy estimation method and the Jacobian determinant to calculate the original entropy, accurate entropy estimation of high-dimensional traffic feature vectors is achieved. The historical traffic data is modeled using a 5-layer neural network architecture and pre-trained weights to ensure that the transformed vector accurately reflects the statistical characteristics of the traffic. The transformed entropy is efficiently calculated through uniform random sampling and the k-NN method, and then the original entropy is restored in combination with the Jacobian determinant, providing a high-precision quantitative basis for subsequent distributed entropy boundary calculation and encryption and decryption strategies, ultimately improving the accuracy and reliability of the system in evaluating traffic randomness in complex network environments.

[0123] Furthermore, computing nodes are configured in the network to evenly distribute the sample points and calculate the raw entropy, and the master node summarizes the frequency values and calculates the entropy boundary value including:

[0124] Configure computing nodes in the network and use the polling allocation algorithm to evenly distribute sample points to each node. Each node independently calculates the original entropy of its sample and extracts the top node with the highest eigenvalue. Sample points, The value of is confirmed according to the actual situation. Each node broadcasts it to the master node through the gRPC protocol. The entropy boundary value of the local frequency value is calculated using the Shannon entropy formula. The upper boundary value is based on the Shannon entropy plus the logarithm adjustment of the remaining samples, and the lower boundary value directly uses the Shannon entropy result.

[0125] The local frequency value refers to the frequency of occurrence of the sample points extracted by each node in the aggregated data set.

[0126] By configuring computing nodes in the network and using a polling allocation algorithm to evenly distribute sample points, each node independently calculates the original entropy and extracts the top K sample points with the highest eigenvalues. Combined with the gRPC protocol, these are broadcast to the master node. The master node uses the Shannon entropy formula to calculate the entropy boundary value of the local frequency value (the upper boundary is adjusted by the logarithm of the remaining samples, and the lower boundary is the Shannon entropy), thus achieving efficient entropy estimation in a distributed environment. The role of this process is to disperse the computing load and summarize the frequency distribution. Its purpose is to provide an accurate entropy boundary basis for encryption and decryption strategies, ultimately achieving the beneficial effect of quickly and accurately quantifying the randomness characteristics of traffic in large-scale networks, significantly improving real-time processing capabilities and system scalability, and overcoming the efficiency bottleneck of traditional centralized computing.

[0127] S4. Encrypt and decrypt network traffic based on entropy boundary values and classification tags, and store all data in a database for management.

[0128] Specifically, network traffic encryption and decryption based on entropy boundary values and classification tags include:

[0129] Through statistical analysis of historical entropy values (such as mean plus standard deviation) and experimental verification, an encryption threshold (such as 5) is set to obtain classification labels and entropy boundary values. If the lower boundary value of the shard is greater than or equal to the encryption threshold, XOR encryption is used to quickly process the shard. The key is directly generated by the seed. When the shard is classified as abnormal traffic, a digital watermark (for example, an 8-bit identifier based on quantum random numbers) is additionally embedded in the traffic header to facilitate subsequent tracking and abnormal analysis. If the upper boundary value of the shard is less than the encryption threshold, AE is used. Segments are strongly encrypted using S-256 (256-bit key), with the key generated by seed expansion. If a segment is classified as abnormal traffic, an isolation flag is added (for example, marked as "to be isolated" in the OpenFlow rule), and the traffic is redirected to the isolation queue for in-depth analysis. If the upper boundary value of the segment is greater than or equal to the encryption threshold and the lower boundary value is less than the encryption threshold, the segment is strongly encrypted using AES-256. If the segment is classified as abnormal traffic, additional logging is added to monitor potential threats.

[0130] The ODL controller distributes the key (XOR seed or AES-256 key) to the ODL server at the receiving end through the TLS encrypted channel. The OVS switch at the receiving end captures the encrypted traffic fragments and uploads the fragment metadata (including encryption method, classification tag, and entropy boundary value) to the ODL controller through the OpenFlow protocol. The ODL controller parses the metadata, extracts the encryption method, and decrypts it.

[0131] This step statistically analyzes historical entropy values and experimentally verifies the setting of an encryption threshold (such as 5), dynamically selects XOR or AES-256 encryption based on the classification label and entropy boundary value, and adds watermarks, isolation marks or log records to abnormal traffic, implementing differentiated encryption and decryption strategies that match the randomness and abnormal state of traffic. The ODL controller distributes keys through the TLS channel and parses metadata for decryption, ensuring data confidentiality and integrity. Its role is to optimize encryption efficiency and enhance the ability to track abnormal traffic, making it suitable for real-time network security protection, ultimately achieving the beneficial effect of improving system flexibility and manageability while ensuring transmission security.

[0132] Furthermore, storing and managing all data in a database involves:

[0133] Select a relational database to manage data and relationship analysis results, design the database table structure to store different types of data, set up regular backup tasks, back up all data in the database, manage database user permissions, and encrypt and store static data.

[0134] By selecting a relational database to manage data and relationship analysis results, and designing a database table structure to store different types of data, we achieve structured storage of traffic sharding, entropy values, classification labels, and encryption and decryption metadata. The purpose of this process is to facilitate rapid query and association analysis of data, and its purpose is to support subsequent traffic behavior tracing and abnormal pattern mining. By setting regular backup tasks to back up all data and managing the permissions of database users, combined with static data encryption storage, we achieve high data availability, security, and access control, and ultimately achieve the beneficial effect of improving system management efficiency and reliability while ensuring data integrity and confidentiality. Compared with traditional disordered storage methods, it significantly enhances the controllability and protection capabilities of data management.

[0135] Deploying the Qi'anxin Tianyan unknown threat detection and backtracking solution can help users discover unknown threats promptly and effectively, improve managers' speed and efficiency in discovering unknown threats, and minimize user losses after an attack. It can also record every network behavior on the intranet, providing strong support for backtracking. In this solution, all traffic in the user network is fully detected and recorded, and all network behavior is stored in a standardized format on the Tianyan data platform. Cloud-based threat intelligence and local file threat identification analysis results are connected to the local analysis platform, providing users with threat discovery and tracing capabilities based on intelligence and file detection.

[0136] Security analysis services are divided into three scenarios: online, semi-online and offline. Online means that the cloud can directly connect to the customer environment's Sky Eye environment; semi-online means that the cloud cannot directly connect to the customer environment, but a third-party computer can connect to the cloud and the customer environment; offline means that the cloud cannot directly connect to the customer environment, nor can it be connected indirectly through other means.

[0137] This embodiment also provides a network traffic encryption and decryption system based on entropy calculation, including:

[0138] The data acquisition module is used to capture data packets in real time to extract traffic feature vectors, store the traffic feature vectors in slices and attach quantum random tags;

[0139] The shard classification module is used to initialize the spiking neural network, optimize parameters through genetic algorithms, extract feature vectors and calculate entropy values, combine entropy mutation detection and reinforcement learning to adjust the entropy mutation threshold and assign classification labels to each shard;

[0140] The raw entropy calculation module is used to add the classification label and entropy value of each shard to the input vector, use the masked autoregressive flow transform to generate a new vector and calculate the raw entropy. The computing nodes in the network are configured to evenly distribute the sample points and calculate the raw entropy. The master node summarizes the frequency values and calculates the entropy boundary value.

[0141] The encryption and decryption module is used to encrypt and decrypt network traffic based on entropy boundary values and classification tags;

[0142] The data storage module is used to store and manage all data in the database.

[0143] This embodiment also provides a computer device, which is suitable for the case where network encrypted traffic is encrypted and decrypted based on entropy calculation technology, including: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute computer-executable instructions to implement the network encrypted traffic encryption and decryption technology based on entropy calculation proposed in the above embodiment.

[0144] The computer device may be a terminal, comprising a processor, a memory, a communication interface, a display screen and an input device connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device comprises a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner may be achieved through WIFI, an operator network, NFC (near field communication) or other technologies. The display screen of the computer device may be a liquid crystal display or an electronic ink display screen, and the input device of the computer device may be a touch layer covering the display screen, or a button, trackball or touchpad provided on the housing of the computer device, or an external keyboard, touchpad or mouse.

[0145] This embodiment also provides a storage medium on which a computer program is stored. When the program is executed by the processor, it implements the encryption and decryption technology based on entropy calculation for network encrypted traffic as proposed in the above embodiment; the storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, disk or optical disk.

[0146] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. An encryption and decryption technology for network encrypted traffic based on entropy calculation, characterized by: include: Capture data packets in real time to extract traffic feature vectors, store them in slices, and attach quantum random tags. The traffic feature vectors include source IP address, destination port, protocol type, and timestamp difference. Initialize the spiking neural network, optimize parameters using a genetic algorithm, extract feature vectors and calculate entropy values, combine entropy mutation detection and reinforcement learning to adjust the entropy mutation threshold and assign classification labels to each shard; Add the classification label and entropy value of each shard to the input vector, use the masked autoregressive flow transform to generate a new vector and calculate the original entropy, configure the computing nodes in the network to evenly distribute the sample points and calculate the original entropy, and the master node summarizes the frequency values and calculates the entropy boundary value; Network traffic is encrypted and decrypted based on entropy boundary values and classification tags, and all data is stored and managed in the database.

2. The network encrypted traffic encryption and decryption technology based on entropy calculation as claimed in claim 1 is characterized by: Initializing the spiking neural network, optimizing parameters through a genetic algorithm, extracting feature vectors, and calculating entropy values include: Start the spiking neural network model on the processing server and use the NEST simulator as the implementation tool to initialize the synaptic weights of the spiking neural network and set the learning rules; Use genetic algorithms to optimize model parameters, read shards and load them into memory buffers, deserialize the shards, and extract feature vectors as input vectors; The input vector is converted into a pulse frequency according to the proportional relationship, and the input vector is substituted into the spiking neural network model. The trigger threshold of each neuron is dynamically adjusted according to the recent pulse emission; When the membrane potential exceeds the trigger threshold, the neuron will emit a pulse and reset the membrane potential to the baseline value. The pulse will propagate to the output layer. The membrane potential of the output layer is directly accumulated according to the incoming pulse signal, and the entropy value is calculated and normalized. The calculated entropy value is stored in the memory buffer as the entropy value of the current slice.

3. The network encrypted traffic encryption and decryption technology based on entropy calculation as claimed in claim 2, characterized in that: The method of combining entropy mutation detection and reinforcement learning to adjust the entropy mutation threshold and assign a classification label to each shard includes: Extract the source IP set from the feature vector and use a hash table to remove duplicates to obtain the number of unique source IPs. Set an anti-spoofing threshold. If the number of unique source IPs is greater than the anti-spoofing threshold, it indicates that the traffic may be forged and entropy mutation detection is performed. Otherwise, it passes verification and is marked as normal traffic. Use the RL network to dynamically adjust the entropy mutation threshold. The RL network selects the adjustment factor through population coding and compares the calculated entropy mutation with the dynamically adjusted entropy mutation threshold. If the entropy mutation is greater than or equal to the entropy mutation threshold, a secondary verification is triggered. Otherwise, the traffic passes the verification and is marked as normal. The secondary verification includes calculating the global standard deviation of the original byte stream corresponding to the feature vector, using a random number generator to generate a random index and randomly extracting a template of length 2 from the original byte stream, denoted as T m Repeat the random index generation process and extract a template of length 3, denoted as T m+1 , initialize the thread, respectively T m and T m+1 All templates are divided into different threads, the matching threshold r is set, the assigned templates are processed in each thread, and T is calculated. m and T m+1 The total number of matching pairs is set, the number of repeated sampling is set, the number of cycles is used as the seed, and the process of calculating the total number of matching pairs is repeated by increasing the seed to generate additional total matching pairs. The average of the total matching pairs is calculated and the entropy value is estimated. The entropy fluctuation threshold is set, and the estimated entropy value is compared with the entropy value. A classification label is assigned to each fragment. If the change between the estimated entropy value and the entropy value is greater than or equal to the entropy fluctuation threshold, the fragment is marked as abnormal traffic. Otherwise, after verification, all fragments that pass the verification are marked as normal traffic.

4. The network encrypted traffic encryption and decryption technology based on entropy calculation as claimed in claim 3 is characterized by: The steps of adding the classification label and entropy value of each slice to the input vector, generating a new vector using the masked autoregressive flow transform, and calculating the raw entropy include: Add the classification label and entropy value of each shard to its input vector and apply the normalized flow transformation to generate the transformed input vector; G sample points are extracted from all transformed input vectors using uniform random sampling. The transformed entropy is calculated using the k-nearest neighbor distance and the k-nearest neighbor entropy estimation method. The original entropy is calculated based on the transformed entropy and the Jacobian determinant.

5. The network encrypted traffic encryption and decryption technology based on entropy calculation as claimed in claim 4 is characterized by: The configuration of computing nodes in the network to evenly distribute sample points and calculate the original entropy, and the master node summarizing frequency values and calculating the entropy boundary value includes: Computing nodes are configured in the network and the polling allocation algorithm is used to evenly distribute sample points to each node. Each node independently calculates the original entropy of its samples and extracts the top θ sample points with the highest eigenvalues. Each node broadcasts them to the master node through the gRPC protocol and uses the Shannon entropy formula to calculate the entropy boundary value of the local frequency value.

6. The network encrypted traffic encryption and decryption technology based on entropy calculation as claimed in claim 5, characterized in that: The network traffic encryption and decryption according to the entropy boundary value and the classification mark includes: Set the encryption threshold, obtain the classification label and entropy boundary value, encrypt all fragments and generate a key. The ODL controller distributes the key to the receiving ODL server through the TLS encrypted channel. The receiving OVS switch captures the encrypted traffic fragments and uploads the fragment metadata to the ODL controller through the OpenFlow protocol. The ODL controller parses the metadata, extracts the encryption method and decrypts it.

7. The network encrypted traffic encryption and decryption technology based on entropy calculation as claimed in claim 6, characterized in that: Said storing and managing all data in the database includes: Select a relational database to manage data and relationship analysis results, design the database table structure to store different types of data, set up regular backup tasks, back up all data in the database, manage database user permissions, and encrypt and store static data.

8. A network traffic encryption and decryption system based on entropy calculation based on the network encrypted traffic encryption and decryption technology according to any one of claims 1 to 7, characterized in that: include: The data acquisition module is used to capture data packets in real time to extract traffic feature vectors, store the traffic feature vectors in slices and attach quantum random tags; The shard classification module is used to initialize the spiking neural network, optimize parameters through genetic algorithms, extract feature vectors and calculate entropy values, combine entropy mutation detection and reinforcement learning to adjust the entropy mutation threshold and assign classification labels to each shard; The raw entropy calculation module is used to add the classification label and entropy value of each shard to the input vector, use the masked autoregressive flow transform to generate a new vector and calculate the raw entropy. The computing nodes in the network are configured to evenly distribute the sample points and calculate the raw entropy. The master node summarizes the frequency values and calculates the entropy boundary value. The encryption and decryption module is used to encrypt and decrypt network traffic based on entropy boundary values and classification tags; The data storage module is used to store and manage all data in the database.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the encryption and decryption technology based on entropy calculation of network encrypted traffic according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the encryption and decryption technology based on entropy calculation of network encrypted traffic according to any one of claims 1 to 7 are implemented.

Images