A network traffic restoration and monitoring method

Abstract

The application discloses a network traffic restoration and monitoring method, and relates to the technical field of network monitoring.The method comprises the following steps: capturing original encrypted traffic data packets; embedding steganographic marks in non-key fields reserved in network layer and transmission layer message headers to generate encrypted traffic data packets carrying steganographic metadata; injecting a behavior element triple set into a constructed cross-protocol threat knowledge graph to perform adjacency relationship matching; when the coincidence degree of an unknown protocol behavior path and a graph threat link exceeds a preset security threshold, outputting a high-risk threat matching result; triggering real-time blocking and generating an auditable alarm record according to the high-risk threat matching result; updating the cross-protocol threat knowledge graph to complete an encrypted traffic restoration and intelligent monitoring closed loop.The application embeds steganographic marks in network layer and transmission layer message headers dynamically, so that the encrypted traffic carries steganographic metadata in the transmission process, and the encrypted traffic is marked covertly.

Description

Technical Field

[0001] This invention relates to the field of network monitoring technology, and in particular to a method for network traffic restoration and monitoring. Background Technology

[0002] With the widespread adoption of network encryption technologies, encryption protocols such as TLS / SSL have become the mainstream means of ensuring data transmission security. Encrypted traffic monitoring technologies have also evolved accordingly, from early deep packet inspection (DPI) to more recent machine learning-assisted analysis, aiming to achieve traffic visualization and threat awareness without decryption. Current research largely focuses on single-dimensional analysis such as traffic classification and anomaly detection, while cross-protocol correlation analysis technology is gradually becoming an important research direction in this field.

[0003] However, existing encrypted traffic monitoring technologies have shortcomings. They struggle to attach traceable monitoring metadata to encrypted traffic while maintaining the integrity of encrypted communication. Traditional methods cannot dynamically embed and extract flow association identifiers in the network and transport layer headers, leading to difficulties in reassembling encrypted session flows and insufficient cross-protocol behavior tracking capabilities, thus affecting the detection effectiveness of advanced persistent threats (APTs). Summary of the Invention

[0004] In view of the aforementioned existing problems, the present invention is proposed.

[0005] Therefore, this invention provides a network traffic restoration and monitoring method to solve the problems of dynamic embedding and extraction of monitoring metadata in encrypted traffic, as well as cross-protocol behavior correlation analysis.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution:

[0007] This invention provides a method for network traffic restoration and monitoring, which includes capturing original encrypted traffic data packets and dynamically embedding steganographic tags in non-critical fields reserved in the headers of network layer and transport layer packets to generate encrypted traffic data packets carrying steganographic metadata.

[0008] Receive encrypted traffic data packets carrying steganographic metadata, extract steganographic tags, and classify, aggregate, and reassemble the data fragments into a complete session stream based on the flow association identifier;

[0009] Based on the protocol type encoding, the transport layer header is stripped from the complete session stream, the application layer payload content is extracted, and the classified structured data entities are output.

[0010] Map categorized structured data entities to a unified set of behavioral element triples;

[0011] The behavioral element triple set is injected into the constructed cross-protocol threat knowledge graph for adjacency matching. When the overlap between the unknown protocol behavioral path and the threat link in the graph exceeds a preset security threshold, a high-risk threat matching result is output.

[0012] Real-time blocking is triggered based on high-risk threat matching results, and auditable alarm records are generated. The cross-protocol threat knowledge graph is updated to complete the closed loop of encrypted traffic restoration and intelligent monitoring.

[0013] As a preferred embodiment of the network traffic restoration and monitoring method of the present invention, the steganographic tag includes a flow association identifier and a protocol type encoding.

[0014] As a preferred embodiment of the network traffic restoration and monitoring method of the present invention, the specific steps for generating encrypted traffic data packets carrying steganographic metadata are as follows:

[0015] Capture raw encrypted traffic data packets, parse the raw encrypted traffic data packets, extract the values ​​of network layer and transport layer header fields, synchronously obtain the arrival timestamp and transport layer sequence number of the current raw encrypted traffic data packets, and collect the current network status parameters in real time;

[0016] Based on the values ​​of the network layer and transport layer header fields, combined with the stream association identifier and protocol type encoding, steganographic metadata is generated.

[0017] Calculate the steganography embedding utility value based on the current network state parameters, and decide on the embedding strategy under the current network state based on the steganography embedding utility value;

[0018] Based on the embedding strategy and steganographic metadata, a dynamic steganographic encoding sequence is generated by combining the arrival timestamp of the current original encrypted traffic data packet with the transport layer sequence number.

[0019] Based on the embedding strategy, multiple reserved non-critical fields in the headers of the network layer and transport layer are selected, and the dynamic steganography sequence is embedded bit by bit into the selected fields to generate encrypted traffic data packets carrying steganographic metadata.

[0020] As a preferred embodiment of the network traffic restoration and monitoring method of the present invention, the original encrypted traffic data packet includes data fragments transmitted in a network layer fragmented manner.

[0021] As a preferred embodiment of the network traffic restoration and monitoring method of the present invention, the specific steps for reconstructing the complete session flow are as follows:

[0022] The receiving end captures encrypted traffic data packets carrying steganographic metadata and precisely extracts the dynamic steganographic encoding sequence from the specified fields in the header of the encrypted traffic data packets;

[0023] Perform inverse transformation and verification on the dynamic steganographic sequence to obtain the stream association identifier and protocol type encoding;

[0024] Based on the flow association identifier, all data packets are fragmented and classified into the corresponding flow session buckets, and then sorted and reassembled to generate a reassembled complete session flow;

[0025] The reconstructed complete session stream is validated, and the complete session stream is output after successful validation.

[0026] As a preferred embodiment of the network traffic restoration and monitoring method of the present invention, the specific steps for outputting categorized structured data entities are as follows:

[0027] The corresponding application layer protocol parser is dynamically selected based on the protocol type encoding, the transport layer header of the complete session stream is stripped off, the encrypted protocol payload data is obtained and decrypted, and the application layer payload content is generated.

[0028] Perform semantic parsing on the application layer payload content to identify and extract the semantics of protocol commands, header fields, and payload content;

[0029] The protocol commands, header fields, and payload content semantics are converted into a unified key-value pair structure to generate categorized structured data entities.

[0030] In a preferred embodiment of the network traffic restoration and monitoring method of the present invention, the mapping is a set of unified behavioral element triples, and the specific steps are as follows.

[0031] Semantic elements are extracted from categorized structured data entities, and the importance weight of each element in the semantic elements is calculated using information entropy.

[0032] Using semantic elements and the importance weights of each element within the semantic elements, multiple preliminary behavioral element triples are generated, and the confidence score of each preliminary behavioral element triple is calculated.

[0033] Based on the confidence score of each preliminary behavioral element triplet, multiple preliminary behavioral element triplets are filtered, and preliminary behavioral element triplets with confidence scores exceeding a preset confidence threshold are retained to generate a set of behavioral element triplets.

[0034] Convert the set of behavioral element triples into a unified RDF format to generate a unified set of behavioral element triples.

[0035] As a preferred embodiment of the network traffic restoration and monitoring method of the present invention, the constructed cross-protocol threat knowledge graph is generated by training with historical threat behavior data and contains triplet relationship chains of known attack patterns.

[0036] As a preferred embodiment of the network traffic restoration and monitoring method of the present invention, the specific steps for outputting high-risk threat matching results are as follows:

[0037] Each behavior triple in the unified behavior element triple set is used as query input to perform parallel queries in the cross-protocol threat knowledge graph and activate relevant graph nodes.

[0038] Starting from all activated relevant graph nodes, perform a bidirectional traversal to extract all threat paths whose length does not exceed a preset length threshold;

[0039] Construct unknown protocol behavior paths by arranging the behavioral element triples in chronological order, and calculate the overlap between the unknown protocol behavior paths and each threat path;

[0040] When the overlap exceeds a preset security threshold, it is determined to be a high-risk threat match and a high-risk threat match result containing the overlap and evidence chain is generated.

[0041] As a preferred embodiment of the network traffic restoration and monitoring method of the present invention, the specific steps for completing the encrypted traffic restoration and intelligent monitoring closed loop are as follows:

[0042] Based on the evidence chain and overlap in the high-risk threat matching results, the real-time threat response level is dynamically assessed.

[0043] Based on the threat response level, select and execute the corresponding network blocking policy, digitally sign it, and generate auditable alarm records;

[0044] Auditable alarm records are fed back to the cross-protocol threat knowledge graph, updating the edge weights in the cross-protocol threat knowledge graph, thus completing the closed loop of encrypted traffic restoration and intelligent monitoring.

[0045] The beneficial effects of this invention are as follows: By dynamically embedding steganographic tags in the headers of network and transport layer messages, encrypted traffic carries steganographic metadata during transmission, achieving covert labeling of encrypted traffic. While ensuring that the original encrypted communication is not interfered with, it provides accurate flow classification criteria for traffic reconstruction, supports accurate reassembly of encrypted session streams and application layer protocol parsing, and lays a data foundation for cross-protocol threat detection. Attached Figure Description

[0046] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0047] Figure 1A flowchart for network traffic reconstruction and monitoring methods.

[0048] Figure 2 A flowchart for generating encrypted traffic packets carrying steganographic metadata.

[0049] Figure 3 A flowchart for generating high-risk threat matching results.

[0050] Figure 4 This is a flowchart for intelligent monitoring closed loop. Detailed Implementation

[0051] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0052] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0053] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0054] Reference Figures 1-4 As one embodiment of the present invention, this embodiment provides a network traffic restoration and monitoring method, including the following steps:

[0055] S1. Capture the original encrypted traffic data packets and dynamically embed steganographic tags in the non-critical fields reserved in the headers of the network layer and transport layer to generate encrypted traffic data packets carrying steganographic metadata.

[0056] S1.1: Steganographic tags contain stream association identifiers and protocol type encodings.

[0057] Specifically, the flow association identifier is a string generated from the five-tuple information of the original encrypted traffic data packet using the SHA-256 hash algorithm;

[0058] Protocol type encoding maps application layer protocol names to binary codes using a predefined protocol code table;

[0059] It should be noted that the 5-tuple information includes the source IP address, destination IP address, source port number, destination port number, and transport layer protocol type;

[0060] A predefined protocol code table is a mapping table that is created and stored in advance, establishing a correspondence between common application layer protocol names (such as HTTP, HTTPS, FTP, SSH, DNS, etc.) and unique fixed-length binary codes.

[0061] S1.2: Capture the original encrypted traffic data packets, parse the original encrypted traffic data packets, extract the values ​​of the network layer and transport layer header fields, synchronously obtain the arrival timestamp and transport layer sequence number of the current original encrypted traffic data packets, and collect the current network status parameters in real time;

[0062] Specifically, the process involves capturing raw encrypted traffic data packets from the physical network interface card, parsing the raw encrypted traffic data packets, and extracting the IP identifier field value and time-to-live field value from the network layer header, as well as the sequence number field value and urgent pointer field value from the transport layer header.

[0063] The system collects the arrival timestamps of raw encrypted traffic data packets using a high-precision hardware clock, extracts the sequence number field value from the transport layer header, and collects the current average network latency, network throughput fluctuations, and network background traffic anomaly index in real time as parameters of the current network status.

[0064] S1.3: Generate steganographic metadata based on the values ​​of the network layer and transport layer header fields, combined with the stream association identifier and protocol type encoding;

[0065] Specifically, based on the values ​​of the network layer header field and the transport layer header field, the flow association identifier and the protocol type code are concatenated bit by bit to form an initial sequence. The checksum of the initial sequence is calculated using the CRC-16-CCITT standard, and the checksum is appended to the end of the initial sequence to generate steganographic metadata.

[0066] S1.4: Calculate the steganography embedding utility value based on the current network state parameters, and decide on the embedding strategy under the current network state based on the steganography embedding utility value;

[0067] Specifically, when the steganography embedding utility value exceeds the preset high-density threshold, a high-density embedding strategy is adopted. The high-density embedding strategy selects all available reserved non-critical fields in the network layer and transport layer packet headers for embedding.

[0068] When the steganography embedding utility value does not exceed the preset high density threshold but exceeds the preset medium density threshold, a medium density embedding strategy is adopted. The medium density embedding strategy selects 50% of the available field capacity for embedding.

[0069] When the steganography embedding utility value does not exceed the preset density threshold, a low-density embedding strategy is adopted, which selects 20% of the available field capacity for embedding.

[0070] It should be noted that the preset high-density threshold is a critical value set based on the optimal network performance test results, with an example value of 0.8; the preset medium-density threshold is a boundary value set based on stability experiments under light network load, with an example value of 0.5.

[0071] When the medium-density embedding strategy selects 50% of the capacity, it can still ensure that about half of the available fields are used to transmit metadata, while avoiding excessive field occupation that affects message parsing; when the low-density embedding strategy selects 20% of the capacity, it occupies only the minimum amount of field space, ensuring that even in network congestion or high-latency environments, it will not significantly increase the transmission burden.

[0072] The steganography embedding utility value is calculated based on the current network state parameters, expressed as follows:

[0073] ;

[0074] In the formula, This represents the steganography embedding utility value. This indicates that the delay affects the weighting coefficient. Represents the exponentially decaying term. This represents the current measured average network latency. Indicates the network baseline latency value. This represents the throughput fluctuation weighting coefficient. This represents the measured value of the current network throughput fluctuation. This indicates the maximum fluctuation in network throughput. The normalized ratio representing throughput fluctuations This represents the weighting coefficient of the abnormality index. This represents the measured value of the current network background traffic anomaly index. This represents the minimum value of the network background traffic anomaly index in historical statistics. This represents the maximum value of the network background traffic anomaly index in historical statistics.

[0075] It should be noted that, , and Dimensionless and The unit is milliseconds, and it is processed by the Sigmoid function. Dimensionless The ratio, once dimensionless, becomes a dimensionless value. The ratio is dimensionless after the dimension is eliminated, and the final output is... Since it is dimensionless, we maintain dimensional consistency.

[0076] The latency impact weight coefficient is derived from the priority setting of network transmission stability requirements, with an example value of 0.5; the throughput fluctuation weight coefficient is allocated according to the degree of impact of network throughput changes on steganography operations, which can be obtained through machine learning parameter tuning, with an example value of 0.3; the anomaly index weight coefficient is set based on the risk assessment results of network anomalies on embedding operations, with an example value of 0.2.

[0077] S1.5: Generate a dynamic steganography sequence based on the embedding strategy and steganography metadata, combined with the arrival timestamp and transport layer sequence number of the current original encrypted traffic data packet;

[0078] Specifically, based on the embedding capacity determined by the embedding strategy, a data segment of the corresponding length is extracted from the steganographic metadata;

[0079] Get the binary value of the arrival timestamp of the current original encrypted traffic data packet, get the binary value of the transport layer sequence number, and perform a bitwise XOR operation between the binary value of the arrival timestamp and the binary value of the transport layer sequence number to generate a dynamic perturbation factor.

[0080] The corresponding length of data segment is extracted from the steganographic metadata and a bitwise XOR operation is performed with the dynamic perturbation factor to generate a dynamic steganographic encoding sequence.

[0081] S1.6: Select multiple reserved non-critical fields in the network layer and transport layer message headers according to the embedding strategy, and embed the dynamic steganography sequence bit by bit into the selected fields to generate encrypted traffic data packets carrying steganographic metadata.

[0082] Specifically, based on the field capacity requirements determined by the embedding strategy, the low bits of the IP identifier field and the available padding space in the IP options field are selected from the network layer packet header, and the last bit of the TCP sequence number, the TCP reserved bit field, and the low bits of the TCP urgent pointer are selected from the transport layer packet header.

[0083] According to the preset field priority order, the bits of the dynamic steganography sequence are sequentially filled into the reserved bits of the selected reserved non-critical fields. After the embedding operation is completed, the network layer header checksum and the transport layer header checksum are calculated to generate an encrypted traffic data packet carrying steganographic metadata.

[0084] It should be noted that the preset field priority order is set based on experimental analysis of the stability of each field in the network protocol specification and the impact of modifications on communication.

[0085] Superiorly, compared to conventional deep packet inspection (DPI), this method dynamically embeds steganographic markers in the headers of network and transport layers, enabling the addition of monitoring metadata to encrypted traffic without compromising the integrity of encrypted communication. Conventional DPI requires decryption of traffic or relies on plaintext protocol characteristics, posing a risk of privacy leakage and unable to handle fully encrypted traffic. However, by embedding steganographic markers in reserved fields in the header, decryption is unnecessary, and the accurate reassembly of encrypted sessions is achieved through flow association identifiers. This solves the bottleneck of difficult flow association and protocol identification in encrypted traffic, providing underlying data support for cross-protocol threat detection.

[0086] S2. Receive encrypted traffic data packets carrying steganographic metadata, extract steganographic tags, and classify, aggregate, and reassemble the data fragments into a complete session stream based on the flow association identifier.

[0087] S2.1: The original encrypted traffic data packet contains data fragments transmitted in a network layer fragmented manner.

[0088] It should be noted that in network layer fragmented transmission scenarios, a single original encrypted traffic data packet is split into multiple IP fragments, and each IP fragment header independently carries a dynamic steganography sequence.

[0089] S2.2: The receiving end captures encrypted traffic data packets carrying steganographic metadata and accurately extracts the dynamic steganographic encoding sequence from the specified fields in the header of the encrypted traffic data packets;

[0090] Specifically, according to the preset field priority order, the low-order bits of the IP identifier field in the network layer packet header, the padding space of the IP options field, the last bit of the TCP sequence number in the transport layer packet header, the TCP reserved bits, and the low-order bits of the TCP urgent pointer are read in sequence. The read bits are then concatenated in the embedding order to restore a complete dynamic steganography sequence.

[0091] S2.3: Perform inverse transformation and verification on the dynamic steganography sequence to obtain the stream association identifier and protocol type encoding;

[0092] Specifically, the last binary segment of the arrival timestamp of the current data packet is obtained and the last binary segment of the transport layer sequence number is XORed with a bitwise XOR operation to generate a dynamic perturbation factor.

[0093] The dynamic steganographic encoding sequence is cyclically XORed with the dynamic perturbation factor to restore the full-length steganographic metadata.

[0094] The checksum and valid data are separated from the restored steganographic metadata. The checksum of the valid data is calculated using the same CRC checksum standard as when it was generated. The checksum is considered to be passed when the calculated result is completely consistent with the separated checksum.

[0095] The valid data portion that passes the verification is separated into its first-end binary data as a stream association identifier, and the remaining part is used as a protocol type encoding.

[0096] S2.4: Based on the flow association identifier, all data packets are fragmented and classified into the corresponding flow session buckets, sorted and reassembled to generate the reassembled complete session flow;

[0097] Specifically, the stream association identifier extracted from the dynamic steganography sequence is used as the classification primary key to create the corresponding stream session bucket data structure in memory;

[0098] Packet fragments with the same flow association identifier are stored in the same flow session bucket. For network layer fragment data in the flow session bucket, they are sorted in ascending order according to the IP fragment offset field value.

[0099] For transport layer fragmented data, sort it in ascending order according to the TCP sequence number field value;

[0100] The sorted data fragments are concatenated sequentially to generate a reassembled complete session stream.

[0101] S2.5: Validate the reconstructed complete session stream, and output the complete session stream after successful validation.

[0102] Specifically, the transport layer header checksum of the reassembled complete session stream is calculated, and the consistency between the transport layer header checksum and the payload data is verified.

[0103] Check whether the application layer protocol header identifier conforms to the protocol specification corresponding to the protocol type encoding extracted from the steganographic metadata;

[0104] When the transport layer checksum verification passes and the number of consecutive failures of the application layer protocol header verification is less than a preset threshold, the complete session stream is determined to have passed verification; the verified complete session stream is then output.

[0105] It should be noted that the preset threshold number of attempts is set based on the statistical results of network transmission reliability test data, and the example value is three consecutive verification failures.

[0106] S3. Based on the protocol type encoding, strip the transport layer header from the complete session stream, extract the application layer payload content, and output the categorized structured data entities.

[0107] S3.1: Dynamically select the corresponding application layer protocol parser according to the protocol type encoding, strip the transport layer header of the complete session stream, obtain the encrypted protocol payload data and decrypt it to generate the application layer payload content.

[0108] Specifically, the protocol type encoding is mapped to the specific application layer protocol name by querying a predefined protocol code table;

[0109] Load the corresponding standard protocol parser according to the specific application layer protocol name, use the protocol parser to strip the transport layer header of the complete session stream, and extract the encrypted protocol payload data;

[0110] The encrypted payload data is decrypted using standard decryption algorithms. The TLS protocol uses the handshake protocol negotiation key defined in RFC 8446 for decryption, and the HTTPS protocol uses the certificate key for decryption. The decrypted data is then used to generate the application layer payload content.

[0111] It should be noted that a predefined protocol code table is a mapping table that is created and stored in advance, establishing a correspondence between common application layer protocol names (such as HTTP, HTTPS, FTP, SSH, DNS, etc.) and unique fixed-length binary codes.

[0112] S3.2: Perform semantic parsing on the application layer payload content to identify and extract the semantics of protocol commands, header fields, and payload content;

[0113] Specifically, based on the protocol specification definition and parsing rules corresponding to the protocol type encoding, regular expression matching is used to identify protocol commands, including HTTP request methods, DNS query types, TLS handshake types, etc.

[0114] Header fields, including HTTP header fields, DNS resource records, and TLS extension fields, are identified through delimiter parsing and key-value pair extraction algorithms.

[0115] Use length identifiers or boundary detection algorithms to extract the semantics of the payload content.

[0116] S3.3: Convert the semantics of protocol commands, header fields, and payload content into a unified key-value pair structure to generate categorized structured data entities.

[0117] Specifically, the key name is defined using a three-level naming convention of "protocol type.element level.element name", where the protocol type is obtained by querying a predefined protocol code table to encode the protocol type into a protocol name;

[0118] The element hierarchy is divided into three fixed levels: command, header, and payload. The element names adopt the original field names defined by the corresponding protocol standard.

[0119] The protocol commands obtained from semantic parsing are mapped to command-level key-value pairs, header fields are mapped to header-level key-value pairs, and payload content is mapped to payload-level key-value pairs.

[0120] All values ​​are converted to UTF-8 encoded string format to generate categorized structured data entities.

[0121] S4. Map the categorized structured data entities to a unified set of behavioral element triples.

[0122] S4.1: Extract semantic elements from categorized structured data entities, and use information entropy to calculate the importance weight of each element in the semantic elements;

[0123] Specifically, all semantic elements, including subject, predicate, and object elements, are extracted from the key-value pairs of categorized structured data entities.

[0124] The importance weight of each element in a semantic element is calculated using information entropy, expressed as follows:

[0125] ;

[0126] In the formula, Indicates the first The importance weight of each element Indicates the feature index. Indicates the first Information entropy of each element Indicates the total number of semantic element types. This represents the normalization factor.

[0127] It should be noted that, and All are dimensionless, and the final output is... It is dimensionless, but we maintain dimensional consistency.

[0128] S4.2: Utilize semantic elements and the importance weights of each element within the semantic elements to generate multiple preliminary behavioral element triples, and calculate the confidence score for each preliminary behavioral element triple;

[0129] Specifically, semantic elements are combined into preliminary behavioral element triplets according to the grammatical structure of "subject-verb-object".

[0130] The confidence score for each preliminary element behavior triple is calculated using the following expression:

[0131] ;

[0132] In the formula, This represents the confidence score of a single preliminary element behavior triple. Indicates the total number of elements. This indicates that the summation is performed by iterating through all elements. Indicates the first Completeness index of each element Represents the exponentially decaying term. Indicates the attenuation coefficient. This indicates the hierarchical depth of the initial element behavior triple in the semantic parsing tree.

[0133] It should be noted that, , , , All are dimensionless, and the final output is... It is dimensionless, but we maintain dimensional consistency.

[0134] S4.3: Based on the confidence score of each preliminary behavioral element triplet, filter multiple preliminary behavioral element triplets, retain the preliminary behavioral element triplets whose confidence scores exceed the preset confidence threshold, and generate a set of behavioral element triplets.

[0135] Specifically, the selection is based on the comparison between the confidence score of each preliminary behavioral element triple and the preset confidence threshold. When the confidence score of a preliminary behavioral element triple exceeds the preset confidence threshold, it is retained in the candidate set.

[0136] If the confidence score of the initial behavioral element triple does not exceed the preset confidence threshold, it is removed from the candidate set;

[0137] All the retained initial behavioral element triples are combined into a final behavioral element triple set.

[0138] It should be noted that the preset reliability threshold is set based on the statistical results of the balance point between precision and recall in historical behavioral data analysis, and the example value is 0.6.

[0139] S4.4: Convert the set of behavioral element triples into a unified RDF format to generate a unified set of behavioral element triples.

[0140] Specifically, the standard RDF triple structure is used for format conversion, mapping the subject element in each behavior element triple to a subject element, the predicate element to a predicate element, and the object element to an object element.

[0141] Add a timestamp attribute and a stream association identifier attribute as extended annotations to each RDF triple;

[0142] The RDF / XML serialization syntax is used to organize all the converted triples into a complete RDF document structure, generating a set of uniform behavior element triples.

[0143] S5. Inject the set of behavioral element triples into the constructed cross-protocol threat knowledge graph for adjacency matching. When the overlap between the unknown protocol behavioral path and the threat link in the graph exceeds the preset security threshold, output the high-risk threat matching result.

[0144] S5.1: The constructed cross-protocol threat knowledge graph is generated through training on historical threat behavior data and contains triple relationship chains of known attack patterns.

[0145] Specifically, a knowledge graph is constructed based on historical threat intelligence data, where nodes represent network entities (IP addresses, domain names, user accounts, etc.) and edges represent threat behavior relationships (vulnerability exploitation, data leakage, privilege escalation, etc.). Graph embedding algorithms are used to map nodes into low-dimensional vector representations. Threat paths consist of continuous triplet relationship chains, with each path labeled with threat type and confidence weight.

[0146] S5.2: Use each behavior triple in the unified behavior element triple set as query input to perform parallel queries in the cross-protocol threat knowledge graph and activate relevant graph nodes;

[0147] Specifically, each triple in the set of unified behavioral element triples in the RDF format is split into a subject element, a predicate element, and an object element;

[0148] By using subject and object elements as node query conditions and predicate elements as edge query conditions, parallel node matching queries are performed in the cross-protocol threat knowledge graph.

[0149] The cosine similarity algorithm is used to calculate the similarity of the feature vectors between the query node and the graph node. When the similarity value exceeds the preset node matching threshold, the graph node is marked as active.

[0150] It should be noted that the preset node matching threshold is set based on the statistical results of the balance between accuracy and recall in the historical threat data validation set, with an example value of 0.85.

[0151] S5.3: Perform a bidirectional traversal starting from all activated relevant graph nodes to extract all threat paths whose length does not exceed a preset length threshold;

[0152] Specifically, starting from each activated graph node, a breadth-first traversal is performed simultaneously in both forward and reverse directions;

[0153] Forward traversal searches for subsequent nodes along the outgoing edges, and reverse traversal searches for predecessor nodes along the incoming edges.

[0154] During the traversal, the sequence of nodes and edge relationships are recorded to form candidate paths. When the path length reaches a preset length threshold, the traversal of that branch is stopped.

[0155] Collect all complete paths whose length does not exceed a preset length threshold as threat paths.

[0156] It should be noted that the preset length threshold is set based on the statistical results of the effective attack chain length distribution in historical threat path analysis, and the example value is 5.

[0157] S5.4: Construct unknown protocol behavior paths by combining behavioral element triples in chronological order, and calculate the overlap between unknown protocol behavior paths and each threat path;

[0158] Specifically, the timestamp attribute of each behavioral element triple is extracted from the unified behavioral element triple set, and all behavioral element triples are sorted in ascending order according to the timestamp attribute value.

[0159] The node elements in the sorted behavior element triples are connected in order to form a node sequence. Edge relationships are added to adjacent nodes in the node sequence. The edge relationships are derived from the predicate elements of the corresponding behavior element triples, generating an unknown protocol behavior path with temporal relationships.

[0160] The overlap between the unknown protocol behavior path and each threat path is calculated using the following expression:

[0161] ;

[0162] In the formula, This indicates the degree of overlap between the unknown protocol behavior path and various threat paths. The set of nodes representing unknown protocol behavior paths. This represents the set of nodes along each threat path. This represents the size of the intersection between the unknown protocol behavior path and each threat path. This represents the size of the union of the unknown protocol behavior path and each threat path. The length of the time window indicating the behavior path of an unknown protocol. Indicates the length of the time window for each threat path. This indicates that the smaller value is taken between the unknown protocol behavior path and the time window length of each threat path. This indicates taking the larger value between the unknown protocol behavior path and the time window length of each threat path.

[0163] It should be noted that, and Dimensionless and The dimension is seconds. The dimension is eliminated through ratio calculation, resulting in the final output. It is dimensionless, but we maintain dimensional consistency.

[0164] S5.5: When the overlap exceeds the preset security threshold, it is judged as a high-risk threat match and a high-risk threat match result containing the overlap and evidence chain is generated.

[0165] Specifically, the calculated overlap is compared with a preset security threshold. When the overlap exceeds the preset security threshold, the threat path is marked as a matching path.

[0166] Extract the complete node sequence and edge relationships of the matching path as the evidence chain, and generate a high-risk threat matching result that includes overlap, evidence chain and matching credibility.

[0167] It should be noted that the preset security threshold is set based on the statistical analysis results of the balance point between false alarm rate and detection rate in historical threat verification data, with an example value of 0.6.

[0168] Superiorly, compared to conventional rule-based or single-dimensional threat detection, this method achieves accurate identification of cross-protocol and multi-step covert attack chains by injecting behavioral element triples into a cross-protocol threat knowledge graph for adjacency matching. Traditional methods rely on single-point feature matching or static rule bases, which cannot effectively correlate scattered threat behaviors across different protocols; however, by leveraging the semantic association capabilities of the knowledge graph and calculating the overlap between behavioral paths and known threat links, it is possible to discover cross-protocol combined attacks such as "HTTP tunneling to transmit SSH commands" or "DNS tunneling to hide data leakage," thereby improving the detection accuracy and threat discovery depth of advanced persistent threats (APTs).

[0169] S6. Based on the high-risk threat matching results, trigger real-time blocking and generate auditable alarm records, update the cross-protocol threat knowledge graph, and complete the closed loop of encrypted traffic restoration and intelligent monitoring.

[0170] S6.1: Dynamically assess the real-time threat response level based on the evidence chain and overlap in the high-risk threat matching results;

[0171] Specifically, the strength level of the evidence chain is assessed based on the number of nodes and the completeness of the edge relationships within the evidence chain.

[0172] The severity level of the threat is determined by combining the predefined range of overlap.

[0173] Based on the combined mapping relationship between the strength level of the evidence chain and the severity level of the threat, the final real-time threat response level is determined from a predefined response level lookup table.

[0174] It should be noted that the predefined range is a division standard set based on the statistical characteristics of the overlap distribution in historical threat data. For example, a value of 0.6 to 0.8 is defined as a medium threat range, and a value above 0.8 is defined as a high threat range.

[0175] The predefined response level comparison table is a mapping rule set based on the statistical results of the actual handling effects of different combinations of evidence chain strength and threat severity in historical handling records. Specifically, it refers to the mapping relationship between the combination of evidence chain strength level (high / medium / low) and threat severity level (high / medium / low) to the corresponding relationship table of specific response levels (high / medium / low).

[0176] S6.2: Based on the threat response level, select and execute the corresponding level of network blocking policy, digitally sign it, and generate auditable alarm records;

[0177] Specifically, the corresponding network blocking policy is selected from the predefined response policy mapping table based on the real-time threat response level; a high-level response uses a real-time connection blocking policy, a medium-level response uses a session termination policy, and a low-level response uses a traffic rate limiting policy.

[0178] The selected blocking policy command is issued to the target network device through the standard network management protocol, and the alarm record is signed by the RSA digital signature algorithm to generate an auditable alarm record.

[0179] It should be noted that the predefined response strategy mapping table is an operational guideline set up based on the correlation analysis results of different threat levels and actual response effects in historical network response records.

[0180] S6.3: Feed auditable alarm records back to the cross-protocol threat knowledge graph, update the edge weights in the cross-protocol threat knowledge graph, and complete the closed loop of encrypted traffic restoration and intelligent monitoring.

[0181] Specifically, verified threat path information is extracted from auditable alarm records, including the node sequence and edge relationships in the path. The weight values ​​of the corresponding edges in the cross-protocol threat knowledge graph are adjusted according to the threat response level and the credibility of the high-risk threat matching results.

[0182] By adopting a weight update mechanism based on time decay, newly verified threat evidence is ensured to receive a higher weight adjustment range. After the weight update is completed, a monitoring closed loop is formed, enabling the cross-protocol threat knowledge graph to have continuous evolution capabilities and providing an updated threat intelligence foundation for traffic monitoring.

[0183] In summary, this invention achieves covert labeling of encrypted traffic by dynamically embedding steganographic tags in the headers of network and transport layer messages, enabling encrypted traffic to carry steganographic metadata during transmission. This ensures that the original encrypted communication remains undisturbed, provides accurate flow classification criteria for traffic reconstruction, supports accurate reassembly of encrypted session streams and application layer protocol parsing, and lays a data foundation for cross-protocol threat detection.

[0184] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for network traffic restoration and monitoring, characterized in that: include, The process involves capturing raw encrypted traffic packets and dynamically embedding steganographic tags in non-critical fields reserved in the network and transport layer headers to generate encrypted traffic packets carrying steganographic metadata. The specific steps are as follows: Capture raw encrypted traffic data packets, parse the raw encrypted traffic data packets, extract the values ​​of network layer and transport layer header fields, synchronously obtain the arrival timestamp and transport layer sequence number of the current raw encrypted traffic data packets, and collect the current network status parameters in real time; Based on the values ​​of the network layer and transport layer header fields, combined with the stream association identifier and protocol type encoding, steganographic metadata is generated. Calculate the steganography embedding utility value based on the current network state parameters, and decide on the embedding strategy under the current network state based on the steganography embedding utility value; Based on the embedding strategy and steganographic metadata, a dynamic steganographic encoding sequence is generated by combining the arrival timestamp of the current original encrypted traffic data packet with the transport layer sequence number. Based on the embedding strategy, multiple reserved non-critical fields in the headers of the network layer and transport layer are selected, and the dynamic steganography sequence is embedded bit by bit into the selected fields to generate encrypted traffic data packets carrying steganographic metadata. Receive encrypted traffic data packets carrying steganographic metadata, extract steganographic tags, and classify, aggregate, and reassemble the data fragments into a complete session stream based on the flow association identifier; Based on the protocol type encoding, the transport layer header is stripped from the complete session stream, the application layer payload content is extracted, and the classified structured data entities are output. Map categorized structured data entities to a unified set of behavioral element triples; The behavioral element triple set is injected into the constructed cross-protocol threat knowledge graph for adjacency matching. When the overlap between the unknown protocol behavioral path and the threat link in the graph exceeds a preset security threshold, a high-risk threat matching result is output. Real-time blocking is triggered based on high-risk threat matching results, and auditable alarm records are generated. The cross-protocol threat knowledge graph is updated to complete the closed loop of encrypted traffic restoration and intelligent monitoring.

2. The network traffic restoration and monitoring method as described in claim 1, characterized in that: The steganographic tag includes a stream association identifier and a protocol type encoding.

3. The network traffic restoration and monitoring method as described in claim 1, characterized in that: The original encrypted traffic data packet contains data fragments transmitted in a network layer fragmented manner.

4. The network traffic restoration and monitoring method as described in claim 1, characterized in that: The specific steps for reassembling the session into a complete stream are as follows. The receiving end captures encrypted traffic data packets carrying steganographic metadata and precisely extracts the dynamic steganographic encoding sequence from the specified fields in the header of the encrypted traffic data packets; Perform inverse transformation and verification on the dynamic steganographic sequence to obtain the stream association identifier and protocol type encoding; Based on the flow association identifier, all data packets are fragmented and classified into the corresponding flow session buckets, and then sorted and reassembled to generate a reassembled complete session flow; The reconstructed complete session stream is validated, and the complete session stream is output after successful validation.

5. The network traffic restoration and monitoring method as described in claim 1, characterized in that: The specific steps for outputting categorized structured data entities are as follows. The corresponding application layer protocol parser is dynamically selected based on the protocol type encoding, the transport layer header of the complete session stream is stripped off, the encrypted protocol payload data is obtained and decrypted, and the application layer payload content is generated. Perform semantic parsing on the application layer payload content to identify and extract the semantics of protocol commands, header fields, and payload content; The protocol commands, header fields, and payload content semantics are converted into a unified key-value pair structure to generate categorized structured data entities.

6. The network traffic restoration and monitoring method as described in claim 1, characterized in that: The mapping is a set of unified behavioral element triples, and the specific steps are as follows. Semantic elements are extracted from categorized structured data entities, and the importance weight of each element in the semantic elements is calculated using information entropy. Using semantic elements and the importance weights of each element within the semantic elements, multiple preliminary behavioral element triples are generated, and the confidence score of each preliminary behavioral element triple is calculated. Based on the confidence score of each preliminary behavioral element triplet, multiple preliminary behavioral element triplets are filtered, and preliminary behavioral element triplets with confidence scores exceeding a preset confidence threshold are retained to generate a set of behavioral element triplets. Convert the set of behavioral element triples into a unified RDF format to generate a unified set of behavioral element triples.

7. The network traffic restoration and monitoring method as described in claim 1, characterized in that: The constructed cross-protocol threat knowledge graph is generated through training on historical threat behavior data and contains triplet relationship chains of known attack patterns.

8. The network traffic restoration and monitoring method as described in claim 1, characterized in that: The specific steps for outputting high-risk threat matching results are as follows: Each behavior triple in the unified behavior element triple set is used as query input to perform parallel queries in the cross-protocol threat knowledge graph and activate relevant graph nodes. Starting from all activated relevant graph nodes, perform a bidirectional traversal to extract all threat paths whose length does not exceed a preset length threshold; Construct unknown protocol behavior paths by arranging the behavioral element triples in chronological order, and calculate the overlap between the unknown protocol behavior paths and each threat path; When the overlap exceeds a preset security threshold, it is determined to be a high-risk threat match and a high-risk threat match result containing the overlap and evidence chain is generated.

9. The network traffic restoration and monitoring method as described in claim 1, characterized in that: The specific steps to complete the encrypted traffic restoration and intelligent monitoring closed loop are as follows. Based on the evidence chain and overlap in the high-risk threat matching results, the real-time threat response level is dynamically assessed. Based on the threat response level, select and execute the corresponding network blocking policy, digitally sign it, and generate auditable alarm records; Auditable alarm records are fed back to the cross-protocol threat knowledge graph, updating the edge weights in the cross-protocol threat knowledge graph, thus completing the closed loop of encrypted traffic restoration and intelligent monitoring.

Images