Terminal data transmission security management method and device and storage medium

Abstract

The present application relates to the technical field of data transmission security, and particularly relates to a terminal data transmission security management method and device and a storage medium, the method comprising: extracting traffic characteristics according to a non-standard protocol proportion and a transmission mutation rate in a monitoring period, and determining a traffic state; calculating a distribution characteristic of load bytes, establishing a decision tree according to the distribution characteristic of the load bytes, and warning a user; determining a fragmentation reorganization state based on a fragmentation packet proportion and a fragmentation packet time dispersion in the monitoring period; constructing a terminal behavior fingerprint according to the traffic state and the fragmentation reorganization state in each monitoring period in an analysis period and the number of warning monitoring periods, and determining a terminal behavior characteristic; constructing a terminal hot and cold migration entropy and a terminal reverse overwriting rate to determine a terminal file attack state, and updating the terminal behavior characteristic based on the terminal file attack state. The present application effectively improves the terminal data transmission security management efficiency.

Description

Technical Field

[0001] This invention relates to the field of data transmission security technology, and in particular to a terminal data transmission security management method, device, and storage medium. Background Technology

[0002] Traditional network security solutions typically rely on standalone intrusion detection systems (IDS) or endpoint protection software, which perform rule matching for abnormal network traffic or local file behavior, respectively. However, when faced with increasingly sophisticated attack methods, a single detection layer is insufficient for effective coverage: static protocol libraries cannot identify covert protocols on non-standard ports, threshold-based traffic mutation detection is susceptible to interference from legitimate business pulses, and file monitoring is prone to misjudging routine hot migration operations due to the lack of historical baseline comparison.

[0003] Furthermore, existing technologies for identifying fragmentation and reassembly attacks largely rely on fixed latency thresholds, making it difficult to distinguish between network congestion and malicious fragmentation behavior. Endpoint behavior analysis often treats events in isolation, ignoring the interconnected threat characteristics across network and storage layers. These limitations render traditional solutions inadequate for dealing with combined attacks such as APT attacks and ransomware, necessitating a new, multi-dimensional, collaborative, and continuously adaptive protection system. Summary of the Invention

[0004] The purpose of this invention is to provide a terminal data transmission security management method, device, and storage medium to solve at least one of the problems existing in the prior art.

[0005] To achieve the above objectives, the present invention adopts the following technical solution:

[0006] A terminal data transmission security management method includes:

[0007] Traffic characteristics are extracted and traffic status is determined based on the proportion of non-standard protocols and the transmission mutation rate within the monitoring period;

[0008] Extract the payload bytes of N data packets within the monitoring period, calculate the distribution characteristics of the payload bytes, build a decision tree based on the distribution characteristics of the payload bytes, and issue warnings to users.

[0009] The fragment reassembly status is determined based on the fragmentation percentage and fragmentation time dispersion within the monitoring period.

[0010] Based on the flow status and fragmentation and reassembly status of each monitoring cycle within the analysis period and the number of early warning monitoring cycles, a terminal behavior fingerprint is constructed, and the terminal behavior characteristics are determined.

[0011] We construct terminal cold and hot migration entropy and terminal reverse overwrite rate to determine the terminal file attack status, and update terminal behavior characteristics based on the terminal file attack status.

[0012] Optionally, the traffic collected in each time window within the monitoring period is sorted, the maximum value is denoted as A1, the minimum value is denoted as A2, the average value of the traffic collected in each time window within the monitoring period is calculated as Ap, and the ratio of the difference between A1 and A2 to Ap is used as the transmission mutation rate CT.

[0013] The transmission mutation rate (CT) and the proportion of non-standard protocols (RT) are fused to extract the traffic feature (LT), where LT = ln[4×CT / C0+1] / ln5+RT / RO, C0 is the mutation threshold, and R0 is the protocol proportion threshold.

[0014] When the flow characteristic LT is greater than or equal to the flow status threshold Ly, the flow status of the current monitoring period is determined to be an abnormal flow status; otherwise, the flow status of the current monitoring period is determined to be a normal flow status.

[0015] Optionally, N data packets are randomly sampled during the monitoring period, and the payload byte of the nth data packet is extracted as Fn. The distribution characteristic K of the payload byte is determined based on the payload byte of each data packet.

[0016] Optionally, when the distribution characteristic K of the load bytes is less than (Kb-1.2), it is determined that the distribution of load bytes is highly random within the monitoring period, and a high randomness warning is issued to the user, where Kb is the baseline kurtosis.

[0017] When the distribution characteristic K of the load bytes is greater than (Kb+0.8), it is determined that the load byte distribution is highly structured within the monitoring period, and a high-structure warning is issued to the user.

[0018] If the distribution characteristic K of the load bytes does not fall into either of the above two categories, the load byte distribution is determined to be normal within the monitoring period, and no warning is issued to the user.

[0019] Optionally, the time difference between the latest and earliest arriving segments in the z-th group of segments within the monitoring period is taken as the time dispersion of the z-th group of segments, and the average of the time dispersion of each group of segments is taken as the segment dispersion of the monitoring period, denoted as Δt.

[0020] The fragment reassembly status is determined based on the fragment packet dispersion Δt and fragment packet proportion Pr during the monitoring period. If Δt is greater than or equal to the fragment reassembly delay threshold ss and the fragment packet proportion is greater than the fragment proportion threshold θ, the fragment reassembly status is determined to be an abnormal status; otherwise, the fragment reassembly status is determined to be a normal status.

[0021] Optionally, the number of monitoring periods in which the flow status is abnormal within the statistical analysis period is T1, the number of monitoring periods in which the segment reorganization status is abnormal within the statistical analysis period is T2, the number of early warning monitoring periods within the statistical analysis period is T3, and the number of monitoring periods within the statistical analysis period is Tz.

[0022] Construct a terminal behavior fingerprint H for the analysis period. When H is greater than the behavior threshold γ, the current analysis period is determined to be abnormal terminal behavior and deep forensics is triggered. Otherwise, the current analysis period is determined to be normal terminal behavior and deep forensics is not triggered.

[0023] Optionally, the average number of accesses to the m-th local file of the terminal in the M historical analysis periods that are in the same time period as the current analysis period is calculated as Wm, and the number of accesses to the m-th local file of the terminal in the current analysis period is denoted as Dm.

[0024] When Wm is less than or equal to the first access threshold u1, the local file is classified as a cold file; when Wm is greater than the first access threshold u1 and less than the second access threshold u2, the local file is classified as a warm file; when Wm is greater than or equal to the second access threshold u2, the local file is classified as a hot file.

[0025] Based on the above division conditions, the local files of each terminal in the current analysis period are re-divided, and the number of local files whose local file types are inconsistent with those before the re-division is counted as Mb. The ratio of Mb to the total number of local files in the terminal is taken as the terminal cold and hot mobility rate G1.

[0026] The ratio of the number of reverse write operations to the total number of write operations within the current analysis period is taken as the terminal reverse write rate L1.

[0027] An attack factor GY is constructed based on the terminal cold and hot migration rate G1 and the terminal reverse overwrite rate L1.

[0028] Optionally, when the terminal file attack status is abnormal, the behavior threshold is updated to γ1, γ1=γ-γ0×{1-exp[3×(GY-yy)-3]}, to update the terminal behavior characteristics; otherwise, the terminal behavior characteristics are not updated.

[0029] Wherein, γ0 is the preset adjustment threshold.

[0030] According to another aspect of this application, a terminal data transmission security management device is also provided, comprising:

[0031] The first state determination unit is used to extract traffic characteristics and determine traffic status based on the proportion of non-standard protocols and the transmission mutation rate within the monitoring period.

[0032] The decision tree building unit is used to extract the payload bytes of N data packets within the monitoring period, calculate the distribution characteristics of the payload bytes, build a decision tree based on the distribution characteristics of the payload bytes, and issue warnings to users.

[0033] The second state determination unit is used to determine the fragment reassembly state based on the fragment packet ratio and fragment packet time dispersion within the monitoring period.

[0034] The behavior feature determination unit is used to construct the terminal behavior fingerprint based on the flow status and fragmentation reorganization status of each monitoring cycle within the analysis cycle and the number of early warning monitoring cycles, and to determine the terminal behavior features.

[0035] The update unit is used to construct the terminal cold and hot migration entropy and the terminal reverse overwrite rate to determine the terminal file attack status, and update the terminal behavior characteristics based on the terminal file attack status.

[0036] According to another aspect of this application, a computer-readable storage medium is also provided, the computer-readable storage medium storing a computer program, wherein the computer program is used to control the terminal data transmission security management method described in the computer-readable storage medium during runtime.

[0037] The beneficial effects of this invention are as follows: By constructing a multi-dimensional, interconnected detection model, accurate identification and dynamic defense against complex threats are achieved. At the traffic layer, the integration of non-standard protocols, transmission mutation rates, and fragmentation reassembly state analysis effectively combats advanced network evasion techniques such as covert communication and fragmentation attacks. At the load layer, a two-way early warning mechanism based on randomness and structured features solves the blind spots in encrypted traffic detection and malicious payload mining. At the terminal layer, combining file cold and hot migration, reverse overwrite behavior, and behavioral fingerprint models, persistent threats such as storage layer ransomware attacks and data tampering can be traced. All detection results form a closed-loop feedback through weight aggregation and dynamic threshold adjustment, which not only reduces the false positive and false negative rates of traditional single-point detection but also adapts to the attacker's tactical iterations, forming a complete defense chain from threat discovery to forensic tracing, which is particularly suitable for combating new and complex threats such as APT attacks and ransomware attacks. Attached Figure Description

[0038] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0039] Figure 1 This is a flowchart illustrating the terminal data transmission security management method of this embodiment.

[0040] Figure 2 This is a flowchart illustrating the decision tree building method in this embodiment.

[0041] Figure 3 This is a flowchart illustrating the terminal file attack status analysis method in this embodiment.

[0042] Figure 4This is a schematic diagram of the terminal data transmission security management device in this embodiment. Detailed Implementation

[0043] To more clearly illustrate the present invention, the following description, in conjunction with preferred embodiments and accompanying drawings, further explains the invention. Similar components in the drawings are indicated by the same reference numerals. Those skilled in the art should understand that the specific description below is illustrative rather than restrictive and should not be construed as limiting the scope of protection of the present invention.

[0044] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate for the embodiments of this application described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0045] Specifically, this embodiment is applicable to enterprise terminals, especially for the early detection and blocking of advanced ransomware attacks. By dynamically associating abnormal network traffic, it constructs a multi-dimensional threat profile in real time, triggers deep forensics in the early stages of the attack chain, and dynamically tightens the behavior judgment threshold when file encryption operations are initiated. It also links with the terminal EDR to force isolation, achieving "network-terminal" collaborative protection and significantly shortening the residence time of ransomware attacks.

[0046] Please see Figure 1 As shown, it is a flowchart illustrating the terminal data transmission security management method of this embodiment, including:

[0047] Step S101: Extract traffic characteristics based on the proportion of non-standard protocols and the transmission mutation rate within the monitoring period, and determine the traffic status. The proportion of non-standard protocols refers to the proportion of traffic from non-standard port protocols.

[0048] For example, in this embodiment, all traffic within the monitoring period can be captured using a network traffic capture tool (such as tcpdump or Wireshark), the traffic size of the target port being a non-standard port can be counted, and the proportion of traffic to the total traffic can be calculated. The network traffic capture tool can also count the traffic size of each window within the monitoring period according to a fixed time window.

[0049] Specifically, the traffic collected in each time window within the monitoring period is sorted, the maximum value is denoted as A1, the minimum value is denoted as A2, the average value of the traffic collected in each time window within the monitoring period is calculated as Ap, and the ratio of the difference between A1 and A2 to Ap is used as the transmission mutation rate CT.

[0050] The transmission mutation rate (CT) and the proportion of non-standard protocols (RT) are fused to extract the traffic feature (LT), where LT = ln[4×CT / C0+1] / ln5+RT / RO, C0 is the mutation threshold, and R0 is the protocol proportion threshold.

[0051] When the flow characteristic LT is greater than or equal to the flow status threshold Ly, the flow status of the current monitoring period is determined to be an abnormal flow status; otherwise, the flow status of the current monitoring period is determined to be a normal flow status.

[0052] For example, in this embodiment, the monitoring period can be set to 1 minute and the time window can be set to 3 seconds. This embodiment does not specifically limit the above settings, and those skilled in the art can set them freely according to their needs.

[0053] For example, in this embodiment, the mutation threshold can be set to 5.0, the protocol proportion threshold can be set to 0.6, and the traffic status threshold can be set to 0.38. This embodiment does not specifically limit the above settings, and those skilled in the art can set them freely according to their needs. Among them, 4.8 < mutation threshold < 5.2, 0.5 < protocol proportion threshold < 0.65, and 0.35 < traffic status threshold < 0.4.

[0054] Specifically, by monitoring the proportion of non-standard protocol traffic and transmission mutation rate, abnormal behavior in network traffic can be comprehensively identified. Non-standard protocol proportion detection can effectively detect the covert communication by attackers using non-standard ports to circumvent traditional protection mechanisms, while transmission mutation rate analysis can capture abnormal fluctuations in traffic rate. The fusion of the two data reduces the risk of misjudgment based on a single indicator, improves the sensitivity of detecting complex attacks, helps to quickly locate potential threats and trigger alarms, and provides accurate basis for subsequent protection.

[0055] Please continue reading. Figure 1 As shown, the terminal data transmission security management method further includes:

[0056] Step S102: Extract the payload bytes of N data packets within the monitoring period, calculate the distribution characteristics of the payload bytes, establish a decision tree based on the distribution characteristics of the payload bytes, and issue an early warning to the user.

[0057] Please see Figure 2 As shown, the decision tree construction method includes:

[0058] Step S201: Extract the payload bytes of N data packets within the monitoring period and calculate the distribution characteristics of the payload bytes.

[0059] Specifically, N data packets are randomly sampled within the monitoring period, and the payload byte of the nth data packet is extracted as Fn. The distribution characteristics of the payload byte are determined based on the payload byte of each data packet.

[0060] The expression for the distribution characteristics of the payload bytes is: In the formula, K represents the distribution characteristics of the payload bytes, μF represents the average value of the payload bytes of N randomly sampled data packets, and σF represents the standard deviation of the payload bytes of N randomly sampled data packets.

[0061] Specifically, a random sampling mechanism is used to extract load statistical features, avoiding the computational burden of processing the entire dataset while preserving the representativeness of key data. The kurtosis-based distribution feature calculation is robust against noise interference, reflecting the overall data distribution characteristics without relying on specific protocol parsing rules. This adapts to diverse unknown threat detection scenarios, providing lightweight and robust feature inputs for subsequent decision tree-based early warning systems.

[0062] Please continue reading. Figure 2 As shown, the decision tree building method further includes:

[0063] Step S202: Establish a decision tree based on the distribution characteristics of the payload bytes and issue a warning to the user.

[0064] Specifically, when the distribution characteristic K of the load bytes is less than (Kb-1.2), it is determined that the distribution of load bytes within the monitoring period is highly random, and a high randomness warning is issued to the user, with Kb as the baseline kurtosis;

[0065] When the distribution characteristic K of the load bytes is greater than (Kb+0.8), it is determined that the load byte distribution is highly structured within the monitoring period, and a high-structure warning is issued to the user.

[0066] If the distribution characteristic K of the load bytes does not fall into either of the above two categories, the load byte distribution is determined to be normal within the monitoring period, and no warning is issued to the user.

[0067] For example, in this embodiment, the payload bytes can be extracted by parsing the application layer payload of each data packet and recording its byte length. This embodiment does not specifically limit the above settings, and those skilled in the art can set them freely according to their needs.

[0068] For example, in this embodiment, N can be set to 0.05 times the total number of data packets collected during the monitoring period. This embodiment does not specifically limit the above setting, and those skilled in the art can set it freely according to their needs.

[0069] For example, in this embodiment, the reference peak value can be set to 0.5. This embodiment does not specifically limit the setting of the reference peak value. Those skilled in the art can set it freely according to their needs. Among them, 0.48 < reference peak value < 0.51.

[0070] Specifically, the system uses a dual-threshold strategy to classify load randomness levels, enabling multi-scenario tiered early warning. It provides real-time alerts for high-random loads and triggers in-depth analysis for highly structured loads, balancing response speed and accuracy. The model can quickly adapt to business needs by adjusting the baseline threshold, supports the evolution of dynamic adversarial attack technologies, and includes load feature tags in the alerts to assist security teams in targeted investigations.

[0071] Please continue reading. Figure 1 As shown, the terminal data transmission security management method further includes:

[0072] Step S103: Determine the fragment reassembly status based on the fragment packet ratio and fragment packet time dispersion within the monitoring period, wherein the fragment packet ratio is the ratio of the number of fragment packets to the total number of packets.

[0073] Specifically, the time difference between the latest and earliest arriving segments in the z-th group of segments within the monitoring period is taken as the time dispersion of the z-th group of segments, and the average of the time dispersion of each group of segments is taken as the segment dispersion of the monitoring period, denoted as Δt.

[0074] The fragment reassembly status is determined based on the fragment packet dispersion Δt and fragment packet proportion Pr during the monitoring period. If Δt is greater than or equal to the fragment reassembly delay threshold ss and the fragment packet proportion is greater than the fragment proportion threshold θ, the fragment reassembly status is determined to be an abnormal status; otherwise, the fragment reassembly status is determined to be a normal status.

[0075] Specifically, in this embodiment, a set of fragmented packets refers to the collection of all fragmented data packets generated after the same original IP data packet is fragmented.

[0076] For example, in this embodiment, the number of fragment packets can be counted by analyzing the Fragment Offset and MoreFragments flags in the IP header. This embodiment does not specifically limit the above settings, and those skilled in the art can set them freely according to their needs.

[0077] For example, in this embodiment, the fragmentation reassembly delay threshold can be set to 200ms, and the fragmentation ratio threshold can be set to 0.05. This embodiment does not specifically limit the above settings, and those skilled in the art can set them freely according to their needs. Among them, 180ms < fragmentation reassembly delay threshold < 220ms, 0.045 < 0.05 < 0.052.

[0078] Specifically, by analyzing the correlation between fragmentation packet ratio and time dispersion, we can identify evasion attacks that abuse the IP fragmentation mechanism. Fragmentation packet ratio detection can detect abnormal fragmentation network behavior, while time dispersion calculation can distinguish between normal network congestion and malicious fragmentation reassembly attacks. The combination of the two can effectively block the fragmentation-covered communication of penetration testing tools and advanced persistent threats, thus optimizing the efficiency of network layer defense.

[0079] Please continue reading. Figure 1 As shown, the terminal data transmission security management method further includes:

[0080] Step S104: Based on the traffic status and fragmentation reorganization status of each monitoring cycle within the analysis period and the number of early warning monitoring cycles, construct the terminal behavior fingerprint and determine the terminal behavior characteristics. The early warning monitoring cycle is a monitoring cycle that provides users with highly structured early warnings or highly random early warnings.

[0081] Specifically, the number of monitoring periods in which the flow status is abnormal within the statistical analysis period is T1, the number of monitoring periods in which the segment reorganization status is abnormal within the statistical analysis period is T2, the number of early warning monitoring periods within the statistical analysis period is T3, and the number of monitoring periods within the statistical analysis period is Tz.

[0082] Construct the terminal behavior fingerprint H for the analysis cycle, and set H=(x1×T1+x2×T2+x3×T3) / Tz, where x1 is the traffic weight, x2 is the fragmentation and reassembly weight, x3 is the load warning weight, and x1+x2+x3=1;

[0083] When H is greater than the behavior threshold γ, the current analysis period is determined to be abnormal terminal behavior, and deep forensics is triggered; otherwise, the current analysis period is determined to be normal terminal behavior, and deep forensics is not triggered.

[0084] For example, in this embodiment, the analysis period can be set to 1 hour. This embodiment does not specifically limit the above setting, and those skilled in the art can set it freely according to their needs.

[0085] For example, in this embodiment, the traffic weight can be set to 0.4, the fragmentation reassembly weight can be set to 0.3, the load warning weight can be set to 0.3, and the behavior threshold can be set to 0.35. This embodiment does not specifically limit the above settings, and those skilled in the art can set them freely according to their needs. Among them, 0.34≤behavior threshold≤0.36.

[0086] Specifically, by dynamically aggregating traffic, fragmenting and reassembling data, and monitoring load alarms, a terminal behavior fingerprint model is constructed to solve the fragmentation problem of isolated detection indicators.

[0087] Please continue reading. Figure 1As shown, the terminal data transmission security management method further includes:

[0088] Step S105: Construct terminal cold and hot migration entropy and terminal reverse overwrite rate to determine terminal file attack status, and update terminal behavior characteristics based on terminal file attack status.

[0089] Please see Figure 3 As shown, the analysis methods for terminal file attack states include:

[0090] Step S301: Classify the local file types on the terminal and construct the terminal cold and hot migration rate and the terminal reverse overwrite rate to determine the terminal file attack status.

[0091] Specifically, the average number of accesses to the m-th local file of the terminal in the M historical analysis periods that are in the same time period as the current analysis period is calculated as Wm, and the number of accesses to the m-th local file of the terminal in the current analysis period is denoted as Dm;

[0092] When Wm is less than or equal to the first access threshold u1, the local file is classified as a cold file; when Wm is greater than the first access threshold u1 and less than the second access threshold u2, the local file is classified as a warm file; when Wm is greater than or equal to the second access threshold u2, the local file is classified as a hot file.

[0093] Based on the above division conditions, the local files of each terminal in the current analysis period are re-divided, and the number of local files whose local file types are inconsistent with those before the re-division is counted as Mb. The ratio of Mb to the total number of local files in the terminal is taken as the terminal cold and hot mobility rate G1.

[0094] The ratio of the number of reverse write operations to the total number of write operations within the current analysis period is taken as the terminal reverse write rate L1.

[0095] An attack factor GY is constructed based on the terminal cold and hot mobility G1 and the terminal reverse overwrite rate L1. GY = E1 × lg(6 × G1 / G0 + 1) / lg7 + E2 × L1 / L0, where E1 is the mobility weight, E2 is the overwrite weight, E1 + E2 = 1, G0 is the mobility threshold, and L0 is the overwrite threshold.

[0096] When the attack factor GY is greater than the attack threshold yy, the attack status of the terminal file in the current analysis period is determined to be abnormal; otherwise, the attack status of the terminal file in the current analysis period is determined to be normal.

[0097] Specifically, the number of reverse overwrite operations is the cumulative number of non-tail data overwrite write operations that occur in the terminal storage during the analysis period. When the write offset is less than the current size of the file when the write operation occurs, it is determined to be a non-tail overwrite write. The statistics exclude the legitimate scenario behavior of predefined whitelisted applications (such as databases and design software), and the statistical granularity is based on each system call or IO request as an independent counting unit, without distinguishing the number of data blocks written. The total number of write operations is the cumulative number of all file write operations recorded by the terminal storage medium during the analysis period.

[0098] For example, in this embodiment, the number of times each file is accessed within M historical periods can be recorded by a file system auditing module (such as Linux's auditd or Windows' ETW event tracing). The number of accesses can be counted by real-time monitoring of file access system calls, kernel hooks, or user-space monitoring tools (such as Sysmon). The offset of each write request and the current size of the file can be captured at the file system driver layer. The reverse write behavior of predefined legitimate applications (such as database transaction logs and CAD software) needs to be excluded by process signatures or path rules. This embodiment does not specifically limit the above settings, and those skilled in the art can set them freely according to their needs.

[0099] For example, in this embodiment, the first access threshold can be set to 3, the second access threshold can be set to 15, the migration rate threshold can be set to 0.5, the overwrite rate threshold can be set to 0.2, the migration rate weight can be set to 0.6, the overwrite rate weight can be set to 0.4, and the attack threshold can be set to 0.46. This embodiment does not specifically limit the above settings, and those skilled in the art can set them freely according to their needs. Among them, 3≤first access threshold≤4, 13≤second access threshold≤16, 0.45<migration rate threshold<0.55, 0.018<overwrite rate threshold<0.22, and 0.45≤attack threshold≤0.48.

[0100] Specifically, based on a dynamic file access tiering strategy and combined with historical baselines to detect abnormal hot migration behavior, potential privilege abuse or data theft can be identified. Reverse overwrite rate monitoring filters out legitimate scenarios through whitelisting, accurately captures malicious overwrites, and constructs a multi-dimensional attack profile using a cold / hot migration model, significantly improving the ability to detect targeted attacks at the file level.

[0101] Specifically, in determining the terminal cold and hot migration rate, if the duration of the local file on the terminal is less than M historical monitoring cycles, then the local file on the terminal is not considered.

[0102] Please see Figure 3 As shown, the analysis methods for terminal file attack states also include:

[0103] Step S302: Update terminal behavior characteristics based on terminal file attack status.

[0104] Specifically, when the terminal file attack status is abnormal, the behavior threshold is updated to γ1, γ1=γ-γ0×{1-exp[3×(GY-yy)-3]}, to update the terminal behavior characteristics; otherwise, the terminal behavior characteristics are not updated.

[0105] Wherein, γ0 is the preset adjustment threshold.

[0106] For example, in this embodiment, the preset adjustment threshold can be set to 0.2×γ1. This embodiment does not specifically limit the above setting, and those skilled in the art can set it freely according to their needs.

[0107] Specifically, the terminal behavior threshold is dynamically adjusted through an exponential decay function to achieve an adaptive balance in detection sensitivity. When the file attack status is abnormal, the global behavior judgment threshold is lowered to expand the monitoring scope; if the attack factor drops, the threshold gradually returns to normal. This mechanism avoids the problem of missed or false detections caused by the traditional static threshold "one-size-fits-all" approach, improves the system's ability to continuously suppress persistent, low-intensity attacks, and forms a resilient defense system.

[0108] Please see Figure 4 As shown, the terminal data transmission security management device includes:

[0109] The first state determination unit is used to extract traffic characteristics and determine traffic status based on the proportion of non-standard protocols and the transmission mutation rate within the monitoring period.

[0110] The decision tree building unit is used to extract the payload bytes of N data packets within the monitoring period, calculate the distribution characteristics of the payload bytes, build a decision tree based on the distribution characteristics of the payload bytes, and issue warnings to users.

[0111] The second state determination unit is used to determine the fragment reassembly state based on the fragment packet ratio and fragment packet time dispersion within the monitoring period.

[0112] The behavior feature determination unit is used to construct the terminal behavior fingerprint based on the flow status and fragmentation reorganization status of each monitoring cycle within the analysis cycle and the number of early warning monitoring cycles, and to determine the terminal behavior features.

[0113] The update unit is used to construct the terminal cold and hot migration entropy and the terminal reverse overwrite rate to determine the terminal file attack status, and update the terminal behavior characteristics based on the terminal file attack status.

[0114] The terminal data transmission security management device provided in this application embodiment can execute the terminal data transmission security management method provided in any embodiment of this application, and has the corresponding functional modules and beneficial effects of the execution method.

[0115] This application also provides a computer-readable storage medium, which is a tangible physical storage medium that can store the aforementioned computer program and various types of data used in the program; the physical storage medium includes, but is not limited to, existing physical storage media or combinations thereof, such as random access memory, read-only memory, optical disk, and hard disk.

[0116] It will be understood by those skilled in the art that all or some of the steps and systems in the methods disclosed above can be implemented as software, firmware, hardware, and suitable combinations thereof. Some or all of the physical components can be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit. Such software can be distributed on a computer-readable medium, which can include computer storage media (or non-transitory media) and communication media (or transient media). As is known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable programs, data structures, program modules, or other data). Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible to a computer. Furthermore, as is known to those skilled in the art, communication media typically contain computer-readable programs, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.

[0117] Obviously, the above embodiments of the present invention are merely examples for clearly illustrating the present invention, and are not intended to limit the implementation of the present invention. For those skilled in the art, other variations or modifications can be made based on the above description. It is impossible to exhaustively list all the implementation methods here. All obvious variations or modifications derived from the technical solutions of the present invention are still within the protection scope of the present invention.

Claims

1. A terminal data transmission security management method, characterized in that, include: Traffic characteristics are extracted and traffic status is determined based on the proportion of non-standard protocols and the transmission mutation rate within the monitoring period; Extract the payload bytes of N data packets within the monitoring period, calculate the distribution characteristics of the payload bytes, build a decision tree based on the distribution characteristics of the payload bytes, and issue warnings to users. The fragment reassembly status is determined based on the fragmentation percentage and fragmentation time dispersion within the monitoring period. Based on the flow status and fragmentation and reassembly status of each monitoring cycle within the analysis period and the number of early warning monitoring cycles, a terminal behavior fingerprint is constructed, and the terminal behavior characteristics are determined. Construct terminal cold and hot migration entropy and terminal reverse overwrite rate to determine terminal file attack status, and update terminal behavior characteristics based on terminal file attack status; The traffic collected in each time window within the monitoring period is sorted, with the maximum value denoted as A1 and the minimum value as A2. The average value of the traffic collected in each time window within the monitoring period is calculated as Ap, and the ratio of the difference between A1 and A2 to Ap is used as the transmission mutation rate CT. N data packets are randomly sampled within the monitoring period, and the payload byte of the nth data packet is extracted as Fn. The distribution characteristics K of the payload byte are determined based on the payload byte of each data packet. The time difference between the latest and earliest arriving segments in the z-th group of segments within the monitoring period is taken as the time dispersion of the z-th group of segments.

2. The terminal data transmission security management method according to claim 1, characterized in that, The transmission mutation rate (CT) and the proportion of non-standard protocols (RT) are fused to extract the traffic feature (LT), where LT = ln[4×CT / C0+1] / ln5+RT / RO, C0 is the mutation threshold, and R0 is the protocol proportion threshold. When the flow characteristic LT is greater than or equal to the flow status threshold Ly, the flow status of the current monitoring period is determined to be an abnormal flow status; otherwise, the flow status of the current monitoring period is determined to be a normal flow status.

3. The terminal data transmission security management method according to claim 2, characterized in that, When the distribution characteristic K of the load bytes is less than (Kb-1.2), it is determined that the distribution of load bytes within the monitoring period is highly random, and a high randomness warning is issued to the user. Kb is the baseline kurtosis. When the distribution characteristic K of the load bytes is greater than (Kb+0.8), it is determined that the load byte distribution is highly structured within the monitoring period, and a high-structure warning is issued to the user. If the distribution characteristic K of the load bytes does not fall into either of the above two categories, the load byte distribution is determined to be normal within the monitoring period, and no warning is issued to the user.

4. The terminal data transmission security management method according to claim 3, characterized in that, The average time dispersion of each component package is taken as the component package dispersion of the monitoring period, denoted as Δt; The fragment reassembly status is determined based on the fragment packet dispersion Δt and fragment packet proportion Pr during the monitoring period. If Δt is greater than or equal to the fragment reassembly delay threshold ss and the fragment packet proportion is greater than the fragment proportion threshold θ, the fragment reassembly status is determined to be an abnormal status; otherwise, the fragment reassembly status is determined to be a normal status.

5. The terminal data transmission security management method according to claim 4, characterized in that, The number of monitoring periods in which the flow status is abnormal within the statistical analysis period is T1; the number of monitoring periods in which the segment reorganization status is abnormal within the statistical analysis period is T2; the number of early warning monitoring periods within the statistical analysis period is T3; and the number of monitoring periods within the statistical analysis period is Tz. Construct a terminal behavior fingerprint H for the analysis period. When H is greater than the behavior threshold γ, the current analysis period is determined to be abnormal terminal behavior and deep forensics is triggered. Otherwise, the current analysis period is determined to be normal terminal behavior and deep forensics is not triggered.

6. The terminal data transmission security management method according to claim 5, characterized in that, The average number of accesses to the m-th local file of the terminal in the same period of the current analysis period is calculated as Wm, and the number of accesses to the m-th local file of the terminal in the current analysis period is denoted as Dm. When Wm is less than or equal to the first access threshold u1, the local file is classified as a cold file; when Wm is greater than the first access threshold u1 and less than the second access threshold u2, the local file is classified as a warm file; when Wm is greater than or equal to the second access threshold u2, the local file is classified as a hot file. Based on the above division conditions, the local files of each terminal in the current analysis period are re-divided, and the number of local files whose local file types are inconsistent with those before the re-division is counted as Mb. The ratio of Mb to the total number of local files in the terminal is taken as the terminal cold and hot mobility rate G1. The ratio of the number of reverse write operations to the total number of write operations within the current analysis period is taken as the terminal reverse write rate L1. An attack factor GY is constructed based on the terminal cold and hot migration rate G1 and the terminal reverse overwrite rate L1.

7. The terminal data transmission security management method according to claim 6, characterized in that, When the terminal file attack status is abnormal, the behavior threshold is updated to γ1, γ1=γ-γ0×{1-exp[3×(GY-yy)-3]}, to update the terminal behavior characteristics; otherwise, the terminal behavior characteristics are not updated. Where γ0 is the preset adjustment threshold and yy is the attack threshold.

8. A terminal data transmission security management device, applied to the terminal data transmission security management method as described in any one of claims 1-7, characterized in that, include: The first state determination unit is used to extract traffic characteristics and determine traffic status based on the proportion of non-standard protocols and the transmission mutation rate within the monitoring period. The decision tree building unit is used to extract the payload bytes of N data packets within the monitoring period, calculate the distribution characteristics of the payload bytes, build a decision tree based on the distribution characteristics of the payload bytes, and issue warnings to users. The second state determination unit is used to determine the fragment reassembly state based on the fragment packet ratio and fragment packet time dispersion within the monitoring period. The behavior feature determination unit is used to construct the terminal behavior fingerprint based on the flow status and fragmentation reorganization status of each monitoring cycle within the analysis cycle and the number of early warning monitoring cycles, and to determine the terminal behavior features. The update unit is used to construct the terminal cold and hot migration entropy and the terminal reverse overwrite rate to determine the terminal file attack status, and update the terminal behavior characteristics based on the terminal file attack status.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein the computer program is used to control the electronic device on which the computer-readable storage medium resides to perform the terminal data transmission security management method according to any one of claims 1-7 during runtime.

Images