Data leakage real-time blocking system based on deep packet inspection

Abstract

The invention discloses a data leakage real-time blocking system based on deep packet inspection, and relates to the technical field of data security. The system comprises a data integrity parameter quantization module, a data acquisition-transmission integrity optimization module, a collaborative effectiveness parameter quantization module and an interception-blocking collaborative effectiveness optimization module. According to the method, an integrity quantization result is obtained by obtaining data integrity parameter quantization in a front-end data acquisition and transmission link, whether data acquisition-transmission integrity optimization is carried out or not is judged, if yes, an interception and blocking collaborative link is executed after the data acquisition-transmission integrity optimization, and the data acquisition-transmission integrity optimization is completed. Otherwise, directly executing an interception and blocking collaboration link, quantifying according to the obtained collaboration effectiveness parameter to obtain an effectiveness quantification result, and judging whether to carry out interception-blocking collaboration effectiveness optimization or not, thereby improving the real-time blocking effectiveness of data leakage. The problem of low effectiveness of real-time blocking of data leakage caused by the lack of a full-link coordination mechanism exists in the prior art.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data security, and particularly relates to a data leakage real-time blocking system based on deep packet detection. BACKGROUND

[0002] In the process of real-time behavior monitoring SDK (Software Development Kit), all operations related to personal information in the application are captured by embedding the SDK of the APP to realize the recording of the behavior source. The hook technology is used to intercept the sensitive function call, record the "function name, parameter, return value, call stack (positioning is the main APP or the third-party SDK call), capture the reading / uploading behavior of the device information (such as IMEI, MAC, Android ID) through the API (Application Programming Interface) hook, intercept the network request API in the application, and record the transmission content digest (after desensitization), target domain name / IP, transmission protocol (HTTP / HTTPS), initiator (main APP / SDK).

[0003] The real-time network traffic of the APP is obtained through the switch port mirroring or the optical splitter, and the application layer transmission content (such as the request body after HTTPS decryption, FTP file content) is analyzed. For non-standard protocols (such as APP self-defined private protocol), the characteristic field is analyzed by Wireshark packet capture, and the analysis rule is constructed (such as 0x01 is used to identify the user ID transmission of a social APP, and the deep packet detection extracts the transmitted user ID through the feature). The collected transmission content (such as mobile phone number, file hash) is associated with the claimed transmission content uploaded by the SDK (through the transmission time + source IP + target IP matching), and it is judged whether there is "hidden behavior of not recording by the SDK but actually transmitting sensitive data". Kafka is used as a message queue to receive the behavior data uploaded by the SDK and the traffic data pushed by the deep packet detection; through the Flink real-time stream processing framework, the repeated data is removed, and the missing fields are completed; based on the preset rules and machine learning models (such as classification algorithms), it is judged whether the behavior is illegal, and the responsible subject (main APP or third-party SDK) is located; the blocking action is executed, at the same time, the key information (used for audit tracing) needs to be recorded synchronously, and the alarm is sent to the administrator.

[0004] For example, the Chinese invention patent with publication number CN118445840A discloses a database sensitive data leakage protection method and device, which includes creating a sensitive data rule set, screening and monitoring operations involving sensitive data; auditing and collecting network traffic related to database sensitive data to obtain SQL statements of sensitive data; processing the SQL statements of sensitive data collected by the audit through a data processing engine to determine whether they hit sensitive data protection rules; if the result is yes, intercept the network traffic of the database, and if the result is no, allow the network traffic to access the database.

[0005] For example, the Chinese invention patent with publication number CN118898064B discloses a data leakage prevention processing method, system and data server, which includes monitoring the process behavior and file behavior of the data server to conduct in-depth monitoring from the behavior, avoiding security risks caused by monitoring only the process name; in addition, the method performs real-time feature matching and abnormality analysis on process behavior and file behavior, accurately identifies potential leakage behavior and blocks it in time, effectively preventing data leakage.

[0006] The above technology at least has the following technical problems: During the running process of the real-time behavior monitoring SDK, there are multiple technical pain points that affect each other and trigger chain problems. In the front-end data collection link, when multiple SDKs trigger sensitive behaviors (such as centralized permission application and device information function calling) at the same time in scenarios such as APP startup, due to the limited thread processing capacity of the JavaHook framework, if the time consumption of a single Hook callback exceeds the preset threshold, the subsequent behavior collection enters a queuing state, which in turn causes data timestamp drift and forms collection delay in high concurrency scenarios.

[0007] In the data transmission link, the unoptimized JSON format has a large data volume when transmitting batch behavior records, which not only occupies the network traffic of the APP, causing network request blocking of normal business, but also may trigger the background traffic limiting mechanism, directly causing the upload failure of collected data, forming the dual risks of data loss caused by collection delay and transmission failure.

[0008] In the interception and blocking coordination link, even if part of the data is successfully uploaded and triggers risk interception, the coordination defects between the application layer and the network layer in the existing architecture will cause new problems. The strategies of application layer interception and network layer blocking are not synchronized in real time. The SDK has intercepted a behavior, but the DPI (Deep Packet Inspection) has not received the "interception success" feedback, and still performs network blocking, causing resource waste; on the contrary, when the SDK fails to intercept, the DPI does not timely compensate.

[0009] Finally lead to sensitive data transmission leaks through the network, form from the front-end collection to the back-end blocking of the whole link risk vulnerability, there is due to the lack of whole link collaborative mechanism caused by data leakage real-time blocking effectiveness low problem. SUMMARY

[0010] In order to solve the problem of low effectiveness of real-time blocking of data leakage due to the lack of whole link collaborative mechanism in the prior art, the present application provides a data leakage real-time blocking system based on deep packet inspection. The technical scheme is as follows: On the one hand, a data leakage real-time blocking system based on deep packet inspection is provided, comprising the following steps: data integrity parameter quantization module, data collection-transmission integrity optimization module, collaborative effectiveness parameter quantization module and interception-blocking collaborative effectiveness optimization module: wherein the data integrity parameter quantization module is used to obtain the data integrity parameter in the front-end data collection and transmission link, to quantify the integrity of the APP end data collection and transmission process, and obtain the integrity quantization result; the data collection-transmission integrity optimization module is used to judge whether to perform data collection-transmission integrity optimization according to the integrity quantization result, if yes, then execute the interception and blocking collaboration link after data collection-transmission integrity optimization, otherwise directly execute the interception and blocking collaboration link, the data collection-transmission integrity optimization includes dynamic frame extraction optimization to reduce the amount of redundant data transmission, avoid loss due to data overload, and thread pool core thread number optimization to avoid data processing delay and backlog caused by insufficient core thread number; the collaborative effectiveness parameter quantization module is used to obtain the collaborative effectiveness parameter in the interception and blocking collaboration link, to quantify the effectiveness of the application layer interception and network layer blocking collaboration, and obtain the effectiveness quantization result; the interception-blocking collaborative effectiveness optimization module is used to judge whether to perform interception-blocking collaborative effectiveness optimization according to the effectiveness quantization result, if yes, then execute the data leakage real-time blocking operation after interception-blocking collaborative effectiveness optimization, otherwise directly execute the data leakage real-time blocking operation, the interception-blocking collaborative effectiveness optimization includes retry interval timeout time dynamic optimization to avoid the blocking delay or failure caused by improper setting of invalid retry interval timeout time, and interception state synchronization time threshold dynamic optimization to avoid the inconsistency of interception and blocking actions caused by fixed interception state synchronization time.

[0011] One or more technical solutions provided in the embodiments of the present application have at least the following technical effects or advantages: 1、obtain the integrity quantization result by obtaining the data integrity parameter in the data acquisition and transmission link of the front end to represent the integrity of the data acquisition and transmission in the APP end, judge whether to perform data acquisition-transmission integrity optimization according to the integrity quantization result to avoid the integrity loss caused by data overload, processing delay or uneven resource allocation, ensure the accuracy of the key data in the whole link circulation process, obtain the effectiveness quantization result by obtaining the cooperation effectiveness parameter in the interception and blocking cooperation link to represent the effectiveness of the cooperation between the application layer interception and the network layer blocking, judge whether to perform interception-blocking cooperation effectiveness optimization according to the effectiveness quantization result to eliminate the protection vulnerabilities caused by synchronization delay, inefficient retry mechanism or inconsistent state in real time, ensure the accurate identification and rapid blocking of the leaked data, improve the overall protection effectiveness and response speed of the system, and further improve the effectiveness of real-time blocking of data leakage.

[0012] 2、According to the integrity quantization result, judge whether to perform data acquisition-transmission integrity optimization, if yes, judge whether to perform dynamic frame extraction optimization according to the interface change rate to reduce the amount of redundant data transmission, avoid loss caused by data overload, dynamically identify the interface change characteristics and intelligently adjust the frame extraction strategy, accurately exclude redundant data frames, avoid invalid data transmission from occupying bandwidth resources, and judge whether to perform thread pool core thread number optimization according to the average number of Hook callback to avoid data processing delay and backlog caused by insufficient core thread number, eliminate the integrity risk caused by overload or insufficient resources from both data source and processing bottleneck, ensure the real-time and accuracy of data acquisition and transmission in high-concurrency scenarios, and further improve the effectiveness of real-time blocking of data leakage.

[0013] 3、According to the effectiveness quantization result, judge whether to perform interception-blocking cooperation effectiveness optimization, if yes, judge whether to perform retry interval timeout time dynamic optimization according to the thread response delay to avoid blocking delay or failure caused by improper invalid retry interval timeout time setting, accurately avoid invalid retries caused by fixed parameters or blocking failure caused by improper timeout setting, improve the interception success rate of the system for real leakage events, and judge whether to perform interception state synchronization time threshold dynamic optimization according to the sensitive behavior interception time to avoid the inconsistency between interception and blocking actions caused by fixed interception state synchronization time, improve the single blocking success rate while ensuring seamless connection between application layer and network layer protection actions, eliminate the cooperation protection vulnerabilities from two dimensions of time control and state consistency, and further improve the effectiveness of real-time blocking of data leakage. BRIEF DESCRIPTION OF DRAWINGS

[0014] Figure 1 The structure diagram of the data leakage real-time blocking system based on deep packet inspection provided by the embodiment of the application is shown. Figure 2A structure thread pool core thread number optimization flowchart of a deep packet inspection based data leakage real-time blocking system provided in an embodiment of the present application is provided. Figure 3 A retry interval timeout time dynamic optimization flowchart of the deep packet inspection based data leakage real-time blocking system provided in the embodiment of the present application is provided. DETAILED DESCRIPTION

[0015] The technical solutions in the present application are described below with reference to the drawings.

[0016] In the embodiments of the present application, the words such as "example", "for example" are used to represent an example, illustration or description. Any embodiment or design scheme described as "example" in the present application should not be interpreted as more preferred or more advantageous than other embodiments or design schemes. Rather, the word "example" is intended to present the concept in a specific manner. In addition, in the embodiments of the present application, the meaning expressed by "and / or" can be both, or can be either one of the two.

[0017] The embodiment of the present application provides a deep packet inspection based data leakage real-time blocking system, solves the problem of low data leakage real-time blocking effectiveness caused by the lack of full-link cooperation mechanism in the prior art, obtains an integrity quantization result by quantifying data integrity parameters in a front-end data collection and transmission link, and judges whether to perform data collection-transmission integrity optimization. If yes, the interception and blocking cooperation link is executed after the data collection-transmission integrity optimization, otherwise the interception and blocking cooperation link is directly executed. According to the obtained cooperation effectiveness parameter, an effectiveness quantization result is obtained, and it is judged whether to perform interception-blocking cooperation effectiveness optimization, thereby improving the data leakage real-time blocking effectiveness.

[0018] The technical solutions in the embodiments of the present application are to solve the above-mentioned problem of low data leakage real-time blocking effectiveness caused by the lack of full-link cooperation mechanism, and the general idea is as follows: By obtaining data integrity parameters in a front-end data collection and transmission link, the integrity of APP end data collection to transmission process is quantified to obtain an integrity quantization result. According to the integrity quantization result, it is judged whether to perform data collection-transmission integrity optimization. If yes, the interception and blocking cooperation link is executed after the data collection-transmission integrity optimization, otherwise the interception and blocking cooperation link is directly executed. Cooperation effectiveness parameters in the interception and blocking cooperation link are obtained to quantify the effectiveness of application layer interception and network layer blocking cooperation, and an effectiveness quantization result is obtained. According to the effectiveness quantization result, it is judged whether to perform interception-blocking cooperation effectiveness optimization. If yes, the data leakage real-time blocking operation is executed after the interception-blocking cooperation effectiveness optimization, otherwise the data leakage real-time blocking operation is directly executed, thereby improving the data leakage real-time blocking effectiveness.

[0019] To make the technical problems, technical solutions and advantages to be solved by the present application clearer, specific embodiments will be described in detail below with reference to the drawings.

[0020] As shown in Figure 1 The structure of the data leakage real-time blocking system based on deep packet detection provided by the embodiment of the present application is shown in the figure. The processing flow of the system can include the following steps: data integrity parameter quantization module, data acquisition-transmission integrity optimization module, collaborative effectiveness parameter quantization module, and interception-blocking collaborative effectiveness optimization module.

[0021] The data integrity parameter quantization module is used to obtain the data integrity parameters in the front-end data acquisition and transmission link to quantify the integrity of the APP-end data acquisition and transmission process, and obtain the integrity quantization result. The data integrity parameter quantization module specifically includes: a data integrity parameter acquisition unit, a data integrity threshold and an influence factor storage unit, and a data integrity parameter quantization unit.

[0022] It should be noted that the data integrity parameter acquisition unit is configured to acquire data integrity parameters, specifically including: Hook callback delay, sensitive behavior record data timestamp offset, and sensitive behavior record data upload rate. Specifically, the time difference between the sensitive behavior triggering time recorded by the timestamp and the callback processing completion time is recorded as the Hook callback delay. The absolute difference between the timestamp of the preset sensitive behavior record data and the actual occurrence time of the sensitive behavior record data recorded by the timestamp is recorded as the sensitive behavior record data timestamp offset. The ratio of the amount of sensitive behavior record data transmitted from the APP end to the backend by the SDK maintained by the code integrated in the APP to the upload time recorded by the time interface is recorded as the sensitive behavior record data upload rate. The callback processing refers to recording information such as sensitive behavior type, occurrence time, and calling party, and the sensitive behavior record data specifically refers to the sensitive behavior record data collected by the real-time behavior monitoring SDK, that is, the record data of sensitive behaviors related to personal information during APP running, such as permission application, device information calling, and sensitive function calling. The data integrity threshold and influence factor storage unit is configured to acquire the data integrity threshold and the data integrity influence factor corresponding to the data integrity parameters from the constructed real-time blocking database, specifically including: Hook callback delay threshold, sensitive behavior record data timestamp offset threshold, sensitive behavior record data upload rate threshold, Hook callback delay influence factor, sensitive behavior record data timestamp offset influence factor, and sensitive behavior record data upload rate influence factor. The data integrity parameter quantization unit is configured to correct the proportion analysis result of the Hook callback delay threshold and the Hook callback delay by the Hook callback delay influence factor to obtain a first complete value, correct the proportion analysis result of the sensitive behavior record data timestamp offset threshold and the sensitive behavior record data timestamp offset by the sensitive behavior record data timestamp offset influence factor to obtain a second complete value, and correct the proportion analysis result of the sensitive behavior record data upload rate and the sensitive behavior record data upload rate threshold by the sensitive behavior record data upload rate influence factor to obtain a third complete value. The first complete value, the second complete value, and the third complete value are coupled to obtain a data collection-transmission complete value.

[0023] It should be further explained that, to support the efficient operation of the real-time data leakage blocking system based on deep packet inspection, a real-time blocking database is pre-built. This database is specifically used to store various key setting parameters, including essential preset data such as Hook callback delay, timestamp offset of sensitive behavior log data, and upload rate of sensitive behavior log data. The initial values ​​of these parameters are not subjectively determined but are based on actual data. For example, the initial value of the Hook callback delay threshold is calculated by summing and averaging historical Hook callback delays accumulated in the database, ensuring that the initial settings have objective basis and representativeness. Furthermore, considering the complexity of actual application scenarios and the dynamic changes in requirements, all parameter values ​​in the database remain adjustable. Technical personnel can manually set, adjust, and fine-tune these values ​​based on the system's performance during actual debugging, ultimately achieving optimal configuration of system parameters.

[0024] It needs to be explained that, firstly, the specific constraint expression for obtaining the first complete value is: ; In the formula, A represents the first complete value, T1 represents the Hook callback delay impact factor obtained from the real-time blocking database, B0 represents the Hook callback delay threshold obtained from the real-time blocking database, and B represents the Hook callback delay. The Hook callback delay is negatively correlated with the data collection-transmission complete value; a higher Hook callback delay results in some sensitive behaviors not being recorded or uploaded in a timely manner, and a lower data collection-transmission complete value.

[0025] Secondly, the specific constraint expression for obtaining the second complete value is: ; In the formula, C represents the second complete value, T2 represents the impact factor of the timestamp offset of sensitive behavior record data obtained from the real-time blocking database, D0 represents the timestamp offset threshold of sensitive behavior record data obtained from the real-time blocking database, and D represents the timestamp offset of sensitive behavior record data. The timestamp offset of sensitive behavior record data is negatively correlated with the data acquisition-transmission complete value. A larger timestamp offset leads to data temporal disorder, affecting the accuracy of subsequent analysis and even causing some data to be discarded due to temporal issues. Conversely, a smaller data acquisition-transmission complete value results in a smaller data acquisition-transmission complete value.

[0026] Then, the specific constraint expression for obtaining the third complete value is: ; In the formula, E represents the second complete value, T3 represents the sensitive behavior record data upload rate impact factor obtained from the real-time blocking database, F0 represents the sensitive behavior record data upload rate threshold value obtained from the real-time blocking database, and F represents the sensitive behavior record data upload rate. The sensitive behavior record data upload rate and the data collection-transmission complete value are positively correlated. The higher the sensitive behavior record data upload rate, the higher the data transmission efficiency, the greater the probability that the sensitive behavior record is timely delivered to the server, and the higher the data collection-transmission complete value.

[0027] Finally, the first complete value, the second complete value, and the third complete value are coupled to obtain a specific limit expression of the data collection-transmission complete value as follows: ; In the formula, G represents the data collection-transmission complete value.

[0028] It should be explained that the real-time blocking database stores impact factors corresponding to the data integrity parameters, including a Hook callback delay impact factor, a sensitive behavior record data timestamp offset impact factor, and a sensitive behavior record data upload rate impact factor. The values of these impact factors are mostly between 0 and 1, and the sum of the three values is 1. In addition, there is a pre-set mapping relationship between these impact factors and the data integrity parameters. This relationship can be a one-to-one direct correspondence or a many-to-one aggregated correspondence.

[0029] Specifically, there is a correlation between the data integrity parameters, as follows: the higher the Hook callback delay, the greater the deviation between the recorded time and the actual behavior occurrence time, resulting in an increase in the timestamp offset of the sensitive behavior record; the greater the timestamp offset of the sensitive behavior record, the more chaotic the data upload timing, the longer the time interval between data collection and transmission, and the slower the sensitive behavior record data upload rate; the higher the Hook callback delay, the slower the data upload rate, and the more data accumulation, thereby reducing the upload amount per unit time and slowing the sensitive behavior record data upload rate.

[0030] In the embodiment, by understanding the correlation between the data integrity parameters, it is helpful to accurately locate the source of integrity damage in the data collection and transmission link, form a closed-loop mechanism of problem tracing-targeted optimization, and ultimately guarantee the time accuracy, time consistency and transmission efficiency of sensitive behavior records in the whole link of collection and transmission, improve the controllability of data integrity and the adaptive adjustment ability of the system; by understanding the positive and negative correlation between the data integrity parameters and the complete value of data collection-transmission, it is helpful to build the quantitative association between parameters and integrity, and provide a clear direction for accurate optimization of the data collection and transmission link. On the one hand, it can quickly lock the core driving factors affecting integrity, and on the other hand, it can realize the early prediction and dynamic regulation of integrity risk, and continuously guarantee the integrity of sensitive behavior data in the whole link of collection and transmission, providing a reliable data basis for subsequent interception-blocking cooperation and other links.

[0031] The data collection-transmission integrity optimization module is configured to determine whether to perform data collection-transmission integrity optimization according to the integrity quantification result. If yes, the interception and blocking cooperation link is executed after the data collection-transmission integrity optimization; otherwise, the interception and blocking cooperation link is directly executed. The data collection-transmission integrity optimization includes dynamic frame extraction optimization to reduce the amount of redundant data transmission and avoid loss due to data overload, and thread pool core thread number optimization to avoid data processing delay and backlog caused by insufficient core thread number.

[0032] The cooperation effectiveness parameter quantification module is configured to obtain a cooperation effectiveness parameter in the interception and blocking cooperation link to quantify the effectiveness of the cooperation between the application layer interception and the network layer blocking, and obtain an effectiveness quantification result. The cooperation effectiveness parameter quantification module specifically includes a cooperation effectiveness parameter acquisition unit, a cooperation effectiveness threshold and influence factor storage unit, and a cooperation effectiveness quantification unit.

[0033] It should be noted that the cooperative effectiveness parameter acquisition unit is used to acquire the cooperative effectiveness parameter, specifically including: intercepting state synchronization delay and bit filling response time, while acquiring data collection-transmission integrity value; the cooperative effectiveness threshold and influence factor storage unit is used to acquire the cooperative effectiveness threshold and the cooperative effectiveness influence factor corresponding to the cooperative effectiveness parameter from the constructed real-time blocking database, specifically including: data collection-transmission integrity threshold, intercepting state synchronization delay threshold, bit filling response time threshold, data collection-transmission integrity influence factor, intercepting state synchronization delay influence factor and bit filling response time influence factor; the cooperative effectiveness quantification unit is used to correct and couple the proportion analysis result of the cooperative effectiveness threshold and the cooperative effectiveness parameter through the cooperative effectiveness influence factor, recorded as a first effective value, and correct the proportion analysis result of the data collection-transmission integrity value and the data collection-transmission integrity threshold through the data collection-transmission integrity influence factor, recorded as a second effective value, and couple the first effective value and the second effective value to obtain the intercept-blocking cooperative effective value.

[0034] It should be explained that first, the specific limit expression for obtaining the first effective value is: ; In the formula, P represents the first effective value, S1 represents the intercepting state synchronization delay influence factor acquired from the real-time blocking database, V0 represents the intercepting state synchronization delay threshold acquired from the real-time blocking database, and V represents the intercepting state synchronization delay. S2 represents the bit filling response time influence factor acquired from the real-time blocking database, R0 represents the bit filling response time threshold acquired from the real-time blocking database, and R represents the bit filling response time. Among them, the intercepting state synchronization delay and the intercept-blocking cooperative effective value have a negative correlation, the larger the intercepting state synchronization delay, the more likely it is that the DPI cannot obtain the latest intercepting state in time, resulting in repeated interception or missed blocking, and the lower the intercept-blocking cooperative effective value; the bit filling response time and the intercept-blocking cooperative effective value have a negative correlation, the longer the bit filling response time, the longer the time consumed from receiving a failure signal to executing network blocking at the network layer, and the smaller the intercept-blocking cooperative effective value.

[0035] Then, the specific limit expression for obtaining the second effective value is: ; In the formula, Q represents a second effective value, S3 represents a data collection-transmission integrity influence factor obtained from the real-time blocking database, W0 represents a data collection-transmission integrity threshold value obtained from the real-time blocking database, and W represents a data collection-transmission integrity value. The data collection-transmission integrity value is positively correlated with the interception-blocking synergy effective value, and the higher the data collection-transmission integrity value, the more complete the data collection and transmission ensure that the interception state can be accurately synchronized to the DPI, avoiding the loss of data resulting in synergy failure, and the larger the interception-blocking synergy effective value.

[0036] Finally, the specific limiting expression of the interception-blocking synergy effective value is obtained as follows: ; In the formula, Y represents the interception-blocking synergy effective value.

[0037] It should be explained that the real-time blocking database stores influence factors corresponding to the synergy effectiveness parameters, including a data collection-transmission integrity influence factor, an interception state synchronization delay influence factor, and a placeholder response time influence factor. The values of these influence factors are mostly between 0 and 1, and the sum of the three values is 1. In addition, there is a pre-set mapping relationship between these influence factors and the synergy effectiveness parameters. This relationship can be a one-to-one direct correspondence or a many-to-one aggregated correspondence.

[0038] Specifically, there is a correlation between the synergy effectiveness parameters, as follows: the lower the data collection-transmission integrity value, the lower the completeness of the data being recorded and uploaded, the longer the time for the application layer to feed back the interception state to the network layer after completing the interception of sensitive behavior, and the greater the interception state synchronization delay; the greater the interception state synchronization delay, the longer the time for the DPI to start the placeholder blocking due to the synchronization delay not receiving the signal in time, increasing the risk of sensitive data leakage, and the longer the placeholder response time; the lower the data collection-transmission integrity value, the longer the placeholder response time, and the more likely it is that sensitive data will be leaked through network transmission if the SDK interception fails and the DPI placeholder blocking is not timely.

[0039] In this embodiment, by understanding the correlation between the synergy effectiveness parameters, it is helpful to build a synergy protection link for problem transmission-precise intervention. On the one hand, it can realize the root positioning of synergy failure, and on the other hand, it can establish a risk transmission prediction mechanism. By understanding the positive and negative correlation between the synergy effectiveness parameters and the interception-blocking synergy effective value, it is helpful to build a precise regulation system of parameters-efficiency, to realize the directional optimization and efficiency improvement of the interception-blocking synergy mechanism. On the one hand, it can clearly define the core target of synergy optimization, and on the other hand, it can establish a dynamic early warning and intervention mechanism for synergy efficiency.

[0040] The interception-block synergy effectiveness optimization module is configured to determine whether to perform interception-block synergy effectiveness optimization according to the effectiveness quantification result, and if so, perform the data leakage real-time blocking operation after interception-block synergy effectiveness optimization, or directly perform the data leakage real-time blocking operation, wherein the interception-block synergy effectiveness optimization includes dynamic optimization of retry interval timeout time to avoid blocking delay or failure caused by improper setting of invalid retry interval timeout time, and dynamic optimization of interception state synchronization time threshold to avoid inconsistency between interception and blocking actions caused by fixed interception state synchronization time.

[0041] In the embodiment, the above-mentioned modules realize the closed-loop efficiency improvement from data collection and transmission to interception and blocking through the whole-link design of quantification-optimization-synergy. The data integrity parameter quantification module provides an objective basis for subsequent optimization by accurately quantifying the integrity of front-end data collection and transmission. The data collection-transmission integrity optimization module significantly improves the integrity of APP-side data from collection to transmission through double measures of dynamic frame extraction to reduce redundant data transmission and optimization of thread pool core thread number to avoid processing delay and backlog. On this basis, the synergy effectiveness parameter quantification module quantifies the synergy effectiveness of the application layer and the network layer. The interception-block synergy effectiveness optimization module avoids blocking delay or failure by dynamically adjusting the retry interval timeout time and prevents action inconsistency by optimizing the interception state synchronization time threshold, further improving the precision and timeliness of synergy interception and blocking. Overall, the four modules are progressive and synergistic, laying a reliable data foundation for interception and blocking synergy through the integrity optimization of data collection and transmission, and ensuring efficient execution of interception and blocking actions through synergy effectiveness optimization, ultimately significantly reducing the risk of sensitive data leakage and improving the system's emergency response capability and data security protection level in complex scenarios.

[0042] It needs to be pointed out that in the process of performing the data leakage real-time blocking operation, the intercepted and blocked cooperative instruction optimized or not optimized by the interception and blocking cooperative effectiveness optimization module is obtained, the intercepted and blocked cooperative instruction contains the leakage data features to be blocked, the leakage data features include at least one of data identification, transmission path, application layer trigger condition and network layer trigger condition, and the intercepted and blocked cooperative instruction is generated based on the front-end data collection and transmission integrity result output by the data collection and transmission integrity optimization module and the cooperative effectiveness quantification result output by the cooperative effectiveness quantification module; the target data transmission stream (including cross-application / cross-process data transmission (such as communication data with a third-party service) and data stream between local storage and network transmission, etc.) is analyzed in real time based on deep packet inspection technology, the analysis result is matched with the leakage data features to locate the data stream to be blocked, and the located data stream is the real leakage data subjected to integrity check; the application layer performs a front-end interception action on the leakage data based on the interception state synchronization time threshold dynamically optimized or the default interception state synchronization time threshold, and the front-end interception action includes at least one of terminating a data sending interface and clearing a cache; the interception state of the application layer is synchronized to the network layer in real time, and the network layer performs a blocking action on the matched network traffic based on the cooperative instruction, and the blocking action includes at least one of cutting off a connection and discarding a data packet, and the application layer interception and the network layer blocking are consistent in time; the execution state of the blocking action is recorded in real time, and the execution state includes at least one of whether the interception is successful, whether the blocking is successful, time consumption and involved data volume, and whether there is unblocked missing data or misblocking is monitored at the same time; when the initial blocking is not successful as monitored in the blocking effect real-time monitoring step, the retry interval timeout time dynamically optimized or the default retry interval timeout time based on the retry interval timeout time is used to dynamically adjust the retry frequency within the timeout threshold and perform secondary blocking until the blocking is successful or the timeout upper limit is reached; a blocking log containing complete information of the blocking operation is generated, and the complete information includes at least one of a blocking object, a time, a manner, a result, an associated integrity parameter and an associated cooperative effectiveness parameter.

[0043] Further, the specific determination step of determining whether to perform data collection and transmission integrity optimization according to the integrity quantification result is: obtaining a preset data collection and transmission integrity threshold from the constructed real-time blocking database; if the data collection and transmission integrity value is greater than or equal to the preset data collection and transmission integrity threshold, no data collection and transmission integrity optimization is performed; if the data collection and transmission integrity value is not greater than the preset data collection and transmission integrity threshold, whether to perform dynamic frame extraction optimization is determined through the interface change rate, if yes, whether to perform thread pool core thread number optimization is determined after dynamic frame extraction optimization, otherwise, whether to perform thread pool core thread number optimization is directly determined.

[0044] As a further specific description, the specific process of judging whether to perform dynamic frame extraction optimization through interface change rate is as follows: The interface change rate is a core index for measuring the dynamic degree of the APP interface content, specifically the ratio of the pixel change area in the interface image to the total interface area, and the frame extraction frequency refers to the number of frames extracted within a preset time in continuous video stream or animation sequence.

[0045] If the interface change rate is greater than the preset upper limit of the interface change rate, it means that the high-frequency change of the interface content may generate a large amount of repeated or non-critical data (such as video frames, dynamic interface elements, etc.), then the data acquisition-transmission completeness deviation and change rate increase are arithmetically averaged to avoid excessive frame extraction leading to damage to data integrity, and the frame extraction frequency is increased by the frame extraction frequency increase amount, and the frame extraction frequency is increased by the frame extraction frequency threshold to increase the frame extraction frequency in the next time, which not only greatly reduces the transmission pressure in the high-dynamic interface scene, but also ensures the completeness and timeliness of the critical data, and provides high-quality front-end data support for the subsequent interception-blocking cooperative link, the data acquisition-transmission completeness deviation is used to reflect the deviation degree of the preset data acquisition-transmission completeness threshold and the data acquisition-transmission completeness value, and the change rate increase represents the difference between the interface change rate and the preset upper limit of the interface change rate.

[0046] If the interface change rate is within the preset interface change rate standard interval, it means that the change of the interface content is within the reasonable and stable range preset by the system, at this time, the interface neither produces a large amount of redundant data due to high-frequency dramatic change, nor causes critical information update lag due to low-frequency change. Under this condition, the default frame extraction frequency can achieve the balance between redundancy control and data integrity, without the need to increase the frame extraction frequency (to avoid excessive frame extraction leading to data loss), nor to reduce the frequency (to prevent invalid data accumulation), and the stable frame extraction rhythm can be maintained to ensure that the transmission data contains complete interface key changes (such as element state updates triggered by user operation) and excludes repeated static content (such as background areas that have not changed for a long time). The preset interface change rate standard interval represents the closed interval formed by the preset lower limit of the interface change rate and the preset upper limit of the interface change rate.

[0047] If the interface change rate is less than the preset interface change rate lower limit, it means that the interface content is in a low-frequency change state (such as a static text page or an interface that has not been operated for a long time). At this time, a too high frame extraction frequency will generate a large amount of repeated data (such as consecutive frames of the same page). Therefore, the data acquisition-transmission complete deviation and the change rate correction amount are arithmetically averaged to avoid the influence of insufficient frame extraction on data integrity, and a frame extraction frequency reduction amount is obtained. The frame extraction frequency threshold is subtracted from the frame extraction frequency reduction amount to reduce the frame extraction frequency of the next time. In a low dynamic scene (such as slow browsing of text and images by the user or pausing operation), although the interface changes are few, key frames (such as scrolling to a new paragraph or the moment of clicking a button) still need to be accurately captured to avoid missing key changes due to too sparse frame extraction. This linkage response of static degree-frame density makes the data acquisition not only adapt to the low dynamic rhythm, but also not destroy the time sequence continuity due to excessive frequency reduction. The change rate correction amount represents the difference between the preset interface change rate lower limit and the interface change rate.

[0048] In the embodiment, the three technical effects of redundancy suppression-integrity guarantee-resource adaptation are achieved through scene-based accurate regulation. Redundant data such as video frames and dynamic elements can be removed by increasing the frame extraction frequency, and frame extraction can be avoided by using the complete deviation to constrain the frame extraction frequency, so that key changes (such as interface jumps triggered by operations) are not lost. High timeliness of front-end data is provided for interception-blocking cooperation to avoid destroying the time sequence continuity due to too sparse frame extraction. Overall, the mechanism realizes the adaptive matching of the frame extraction strategy and the interface dynamics. In all scenes, it not only greatly reduces the transmission and computing resource consumption, but also guarantees the data integrity and timeliness of key information, laying a high-quality data foundation for subsequent data acquisition-transmission optimization and interception-blocking cooperation links.

[0049] It should be noted that, as shown in Figure 2 the structure thread pool core thread number optimization flowchart of the deep packet inspection-based data leakage real-time blocking system provided by the embodiment of the present application, the specific logic is as follows: whether to perform thread pool core thread number optimization is determined according to the average number of Hook callbacks. If the average number of Hook callbacks is greater than the preset upper limit of the average number of Hook callbacks, the result of rounding up the harmonic average of the data acquisition-transmission complete deviation and the average number compensation is used as the thread pool core thread number increase amount to adjust the thread pool core thread number. If the average number of Hook callbacks is within the preset average number of Hook callbacks standard interval, the current thread pool core thread number is maintained. If the average number of Hook callbacks is less than the preset lower limit of the average number of Hook callbacks, the result of rounding down the harmonic average of the data acquisition-transmission complete deviation and the average number correction is used as the thread pool core thread number decrease amount to adjust the thread pool core thread number of the next time.

[0050] As a further specific description, the specific steps of determining whether to perform thread pool core thread number optimization are as follows: wherein the average number of Hook callbacks represents the average efficiency of the number of Hook callbacks within a preset time window, and the number of core threads of the thread pool refers to the number of threads in the thread pool that are resident for more than a preset time.

[0051] If the average number of Hook callbacks is greater than the preset upper limit of the average number of Hook callbacks, which means that the fixed number of threads cannot cope with the performance decline caused by peak load, then the result of rounding up the harmonic mean of the data acquisition-transmission complete deviation and the average number of compensation is used as the thread pool core thread number adjustment amount to ensure that the adjustment amount is positively correlated with the load overrun, and precise resource allocation is achieved. The thread pool core thread number adjustment amount is added to the thread pool core thread number to extend the thread pool core thread number. The rounding up adjustment method ensures that the number of threads is increased by at least 1, avoiding insufficient adjustment due to minor deviations. At the same time, the use of harmonic mean makes the adjustment process smoother, reducing system shock caused by large adjustments. The average number of compensation represents the difference between the average number of Hook callbacks and the preset upper limit of the average number of Hook callbacks.

[0052] If the average number of Hook callbacks is within the preset standard interval of the average number of Hook callbacks, which means that the current thread pool configuration can fully meet the business requirements, neither causing task backlog due to insufficient threads nor wasting resources due to excessive threads, then the current thread pool core thread number is maintained, and the thread pool core thread number is not optimized. The average number of Hook callbacks standard interval represents the closed interval formed by the preset lower limit of the average number of Hook callbacks and the preset upper limit of the average number of Hook callbacks.

[0053] If the average number of Hook callbacks is less than the preset lower limit of the average number of Hook callbacks, which means that the current thread pool size is too large and there are a large number of idle threads, then the result of rounding down the harmonic mean of the data acquisition-transmission complete deviation and the average number of correction is used as the thread pool core thread number adjustment amount, and the thread pool core thread number is subtracted from the thread pool core thread number to shorten the thread pool core thread number. Too many threads will increase the scheduling burden of the operating system, causing frequent task switching. After adjusting the number of threads, the CPU cache hit rate increases and the context switching overhead decreases, thereby speeding up the execution of active threads. When the number of Hook callbacks is insufficient, the task queue in the thread pool may be empty for a long time, causing some threads to be in a waiting state. By dynamically adjusting the number of threads, the system can maintain a reasonable length of the task queue and avoid resource waste. The average number of correction represents the difference between the preset lower limit of the average number of Hook callbacks and the average number of Hook callbacks.

[0054] In the embodiment, by dynamically adjusting the thread pool core thread number, accurate response to system load changes and resource optimization configuration are realized, ensuring that the thread number adjustment amplitude is positively correlated with the load overrun degree, which not only ensures at least 1 thread adjustment to avoid optimization deficiency caused by slight deviation, but also reduces system shock caused by large adjustment through the smoothing characteristics of harmonic mean, maintains the existing thread configuration to avoid unnecessary adjustment, ensures that the system meets business requirements while maximizing resource utilization, effectively reduces the operating system scheduling burden and context switching overhead, improves CPU cache hit rate, avoids resource waste and task queue long idle caused by too many threads, and finally realizes adaptive optimization of the system under different load scenarios, ensuring dynamic balance between task processing efficiency and resource utilization efficiency.

[0055] Further, the specific steps of judging whether to perform interception-block cooperation effectiveness optimization according to the effectiveness quantization result are as follows: obtaining a preset interception-block cooperation effective interval from the constructed real-time blocking database, the preset interception-block cooperation effective interval representing a closed interval formed by a preset interception-block cooperation effective lower limit and a preset interception-block cooperation effective upper limit; if the interception-block cooperation effectiveness value is greater than the preset interception-block cooperation effective upper limit, interception-block cooperation effectiveness optimization is not performed; if the interception-block cooperation effectiveness value is within the preset interception-block cooperation effective interval, whether to perform retry interval timeout time dynamic optimization is judged according to the thread response delay, if yes, whether to perform interception state synchronization time threshold dynamic optimization is judged after the retry interval timeout time dynamic optimization, otherwise, whether to perform interception state synchronization time threshold dynamic optimization is directly judged; if the interception-block cooperation effectiveness value is less than the preset interception-block cooperation effective lower limit, an alarm prompt is sent to the preset personnel.

[0056] It should be noted that, as shown in Figure 3 the retry interval timeout time dynamic optimization flowchart of the deep packet inspection-based data leakage real-time blocking system provided by the embodiment of the present application, the specific logic is as follows: whether to perform retry interval timeout time dynamic optimization is judged according to the thread response delay, if the thread response delay is greater than the preset thread response delay upper limit, a delay warning prompt is sent to the preset personnel; if the thread response delay is within the preset thread response delay standard interval, the retry interval timeout time upper adjustment amount is obtained by arithmetically averaging the interception-block cooperation effectiveness value and the thread response delay, and the retry interval timeout time interval is extended; if the thread response delay is less than the preset thread response delay lower limit, the retry interval timeout time lower adjustment amount is obtained by arithmetically averaging the interception-block cooperation effectiveness value and the response delay correction amount, and the retry interval timeout time interval is shortened.

[0057] As a further specific description, the specific flow of judging whether to perform retry interval timeout time dynamic optimization according to the thread response delay is as follows: wherein the retry interval timeout represents a waiting time for triggering message retransmission when the SDK does not receive a DPI receipt confirmation after pushing an interception state message to the DPI, and the thread response delay refers to a time difference between a time when the Hook callback thread receives a sensitive behavior trigger and a time when the sensitive behavior interception processing is completed and the interception is successful.

[0058] If the thread response delay is greater than the preset thread response delay upper limit, indicating that the system has deficiencies in resource configuration, thread scheduling strategy, etc., a delay warning prompt is sent to the preset personnel.

[0059] If the thread response delay is within the preset thread response delay standard interval, it is considered that the current load is controllable, but there is still optimization space, then the retry interval timeout is increased by arithmetically averaging the interception-block synergy effective value and the thread response delay. Extending the retry interval means that the thread can release CPU resources during the waiting period for processing other tasks. This is particularly important for multi-core systems, which can improve the overall utilization of the CPU and avoid resource waste caused by frequent retries. The retry interval timeout is increased by adding the retry interval timeout upper limit to the retry interval timeout threshold. By dynamically extending the retry interval, the system can automatically adjust the processing rhythm without triggering an alarm, avoiding system crashes caused by high instantaneous load. The preset thread response delay standard interval represents a closed interval formed by the preset thread response delay lower limit and the preset thread response delay upper limit.

[0060] If the thread response delay is less than the preset thread response delay lower limit, indicating that the system load is extremely low and the processing capacity is sufficient, then the retry interval timeout is decreased by arithmetically averaging the interception-block synergy effective value and the response delay correction amount. Shortening the retry interval allows failed requests to initiate retries more quickly, reducing user waiting time. In a low-delay state, the system can make the thread re-engage in task processing more quickly by reducing the waiting time of the retry interval, avoiding idle CPU resources. The retry interval timeout is shortened by subtracting the retry interval timeout lower limit from the retry interval timeout threshold. This is particularly important for compute-intensive applications, which can significantly improve throughput. Fast retries reduce the waiting time of requests in the queue, reducing the accumulation of pending tasks in memory, thereby reducing memory usage. The response delay correction amount represents the difference between the preset thread response delay lower limit and the thread response delay.

[0061] In this embodiment, the thread response delay dynamic adjustment mechanism realizes fine management and adaptive optimization of system resources through a three-level threshold strategy. The early warning mechanism triggers manual intervention in a timely manner, quickly locates and solves deep-seated problems such as thread blocking and resource competition, and prevents performance deterioration from causing system crashes. Releasing CPU resources to process other tasks using thread waiting time avoids resource waste caused by frequent retries and enhances the system's resilience to instantaneous traffic shocks by adjusting the pace smoothly. The system automatically shortens the retry interval, speeds up the retry speed of failed requests, fully utilizes idle CPU resources to improve throughput, reduces task queue backlog and memory usage, and achieves optimal performance optimization under low load. This mechanism dynamically balances response speed and resource utilization to keep the system in the best operating state within the full load range, especially suitable for high-concurrency and low-latency scenarios.

[0062] As a further specific description, the specific steps of judging whether to perform the interception state synchronization time threshold dynamic optimization are as follows: Among them, the sensitive behavior interception time refers to the total time from when the sensitive behavior is detected to when the SDK completes the generation of the interception result for the behavior, and the interception state synchronization time refers to the total time experienced by the SDK in generating an interception result (such as successful interception) and passing this state information to the DPI and receiving feedback from the DPI.

[0063] If the sensitive behavior interception time is greater than the preset upper limit of the sensitive behavior interception time, it means that the actual time consumed by the system in processing the sensitive behavior interception exceeds the pre-set reasonable threshold, then the interception state synchronization time upper limit is obtained by harmonic averaging the interception-block cooperation effective value and the interception time compensation amount, the synchronization period is extended to reduce the missed report caused by system busy, the interception state synchronization time upper limit is added to the interception state synchronization time upper limit threshold as the interception state synchronization time upper limit threshold of the next time, and there is more time for deep analysis and blocking operation, which avoids incomplete interception due to time pressure, and the interception time compensation amount represents the difference between the sensitive behavior interception time and the preset upper limit of the sensitive behavior interception time.

[0064] If the sensitive behavior interception time is within the preset sensitive behavior interception time standard interval, it means that the system's interception processing of the sensitive behavior is in the expected normal state, and no interception state synchronization time threshold dynamic optimization is performed. The preset sensitive behavior interception time standard interval represents a closed interval formed by the preset lower limit of the sensitive behavior interception time and the preset upper limit of the sensitive behavior interception time.

[0065] If the sensitive behavior interception time is less than the preset sensitive behavior interception time lower limit, meaning that the system's interception processing speed of sensitive behavior exceeds the expectation, then the interception state synchronization time lower limit threshold is subtracted from the interception state synchronization time lower limit adjustment amount obtained by harmonic averaging of the interception-blocking cooperative effectiveness value and the interception time correction amount to obtain the next interception state synchronization time lower limit threshold, shortening the interception state synchronization time lower limit, meaning that the system allows more frequent state synchronization. In the case of high interception efficiency, by increasing the synchronization frequency, the interception results (such as new blacklist rules, attack feature library) can be quickly spread to each node, avoiding resource idling, and the interception time correction amount represents the difference between the preset sensitive behavior interception time lower limit and the sensitive behavior interception time.

[0066] In the embodiment, through the three-level threshold response strategy of the sensitive behavior interception time dynamic adjustment mechanism, the accurate balance between security protection efficiency and system resource efficiency is realized. Both sufficient time is reserved for deep analysis and complete blocking of sensitive behavior, reducing the problem of false negatives or incomplete interception caused by hasty processing, and through smooth adjustment, excessive resource consumption is avoided, ensuring that the system maintains the optimal state between the stability of security protection and the rationality of resource utilization, without the need for additional adjustments to meet normal operation requirements. By increasing the state synchronization frequency, the interception results (such as blacklist rules, attack feature library updates) are quickly spread, idle resources are fully utilized to improve the collaborative defense capability of the whole network, and the risk of lagging behind in protection strategies caused by too fast processing is avoided. This mechanism comprehensively covers the running scenarios of the system under different loads and threat intensities, dynamically adapts the interception state synchronization time threshold, strengthens the interception depth of complex sensitive behavior, guarantees the protection response speed under low load, optimizes resource allocation, and makes the security protection system achieve dynamic balance between efficiency, reliability and economy, providing adaptive and multi-level security protection for the system.

[0067] Overall, the SDK and DPI coordination mechanism comprehensively solves the core problems of repeated blocking, position missing, and policy conflict in sensitive behavior interception through multi-level synchronization strategies and dynamic adaptation logic, significantly improving the security protection efficiency and resource utilization efficiency of the system. At the level of intercept result synchronization, the SDK actively pushes the interceptState (interception state) message within a preset time and uses a preset retry time mechanism (preset number of retries) to ensure that the DPI can learn about the interception state in a timely manner, avoiding resource waste caused by network fluctuations, such as "SDK successfully intercepts the contact permission application, but DPI still blocks". After the SDK successfully intercepts the contact permission application, the DPI can immediately cancel the blocking of the corresponding network request, reducing CPU parsing overhead. The DPI pushes the blockState (blocking state) message in real time after executing the blocking, and the SDK records the missed features to optimize the rules, solving the problem of "SDK interception failure but DPI not missing position". The coordinated decision-making mechanism dynamically allocates responsibilities based on risk levels, uses a double confirmation mechanism for high-risk behaviors to ensure interception reliability, and reduces DPI resource consumption through division of labor for medium and low-risk behaviors. At the same time, both sides implement elastic scheduling based on their resource occupancy (such as DPI CPU utilization greater than the preset CPU utilization, reducing priority, and SDK memory greater than the preset memory, simplifying message fields). Finally, this mechanism can control the repeated blocking rate within the preset ideal state, reduce the missing blocking rate and state synchronization delay, and achieve an efficient balance between security protection and system performance. The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any skilled person in the art can easily think of changes or replacements within the technical scope disclosed by the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A real-time data leakage blocking system based on deep packet inspection, characterized in that, It includes a data integrity parameter quantification module, a data acquisition-transmission integrity optimization module, a collaborative effectiveness parameter quantification module, and an interception-blocking collaborative effectiveness optimization module. The data integrity parameter quantification module is used to obtain data integrity parameters in the front-end data collection and transmission process, so as to quantify the integrity of data collection and transmission from the APP end and obtain the integrity quantification result. The data acquisition-transmission integrity optimization module is used to determine whether to perform data acquisition-transmission integrity optimization based on the integrity quantification result. If so, the interception and blocking coordination step is executed after the data acquisition-transmission integrity optimization; otherwise, the interception and blocking coordination step is executed directly. The data acquisition-transmission integrity optimization includes dynamic frame extraction optimization to reduce redundant data transmission and avoid data loss due to data overload, and optimization of the core thread count of the thread pool to avoid data processing delay and backlog caused by insufficient core thread count. The coordination effectiveness parameter quantification module is used to obtain the coordination effectiveness parameters in the interception and blocking coordination process, so as to quantify the effectiveness of application layer interception and network layer blocking coordination and obtain the effectiveness quantification result. The intercept-blocking coordination effectiveness optimization module is used to determine whether to perform intercept-blocking coordination effectiveness optimization based on the effectiveness quantification result. If so, the real-time data leakage blocking operation is performed after the intercept-blocking coordination effectiveness optimization; otherwise, the real-time data leakage blocking operation is performed directly. The intercept-blocking coordination effectiveness optimization includes dynamic optimization of the retry interval timeout to avoid blocking delays or failures caused by improper setting of the invalid retry interval timeout, and dynamic optimization of the interception status synchronization time threshold to avoid inconsistencies between interception and blocking actions caused by a fixed interception status synchronization time.

2. The real-time data leakage blocking system based on deep packet inspection as described in claim 1, characterized in that, The data integrity parameter quantification module includes a data integrity parameter acquisition unit, a data integrity threshold and impact factor storage unit, and a data integrity parameter quantification unit. The data integrity parameter acquisition unit is used to acquire data integrity parameters, specifically including: Hook callback delay, sensitive behavior record data timestamp offset, and sensitive behavior record data upload rate; The data integrity threshold and impact factor storage unit is used to obtain the data integrity threshold and data integrity impact factor corresponding to the data integrity parameters through the constructed real-time blocking database. Specifically, it includes: Hook callback delay threshold, sensitive behavior record data timestamp offset threshold, sensitive behavior record data upload rate threshold, Hook callback delay impact factor, sensitive behavior record data timestamp offset impact factor, and sensitive behavior record data upload rate impact factor.

3. The real-time data leakage blocking system based on deep packet inspection as described in claim 1, characterized in that, The data integrity parameter quantification unit is used to: correct the Hook callback delay threshold and the proportion of Hook callback delay analysis results by using the Hook callback delay influence factor to obtain a first complete value; correct the sensitive behavior record data timestamp offset threshold and the proportion of sensitive behavior record data timestamp offset analysis results by using the sensitive behavior record data timestamp offset influence factor to obtain a second complete value; correct the sensitive behavior record data upload rate and the proportion of sensitive behavior record data upload rate threshold analysis results by using the sensitive behavior record data upload rate influence factor to obtain a third complete value; and couple the first complete value, the second complete value, and the third complete value to obtain the data acquisition-transmission complete value.

4. The real-time data leakage blocking system based on deep packet inspection as described in claim 1, characterized in that, The specific steps for determining whether to perform data acquisition-transmission integrity optimization based on the integrity quantification results are as follows: Obtain the preset data acquisition-transmission complete threshold from the established real-time blocking database; If the data acquisition-transmission integrity value is greater than or equal to the preset data acquisition-transmission integrity threshold, then no data acquisition-transmission integrity optimization will be performed. If the data acquisition-transmission complete value is not greater than the preset data acquisition-transmission complete threshold, then determine whether to perform dynamic frame extraction optimization based on the interface change rate. If so, then determine whether to perform thread pool core thread number optimization after dynamic frame extraction optimization; otherwise, directly determine whether to perform thread pool core thread number optimization.

5. The real-time data leakage blocking system based on deep packet inspection as described in claim 4, characterized in that, The specific process for determining whether to perform dynamic frame skipping optimization based on the interface change rate is as follows: If the interface change rate is greater than the preset upper limit of the interface change rate, the frame sampling frequency is increased by arithmetically averaging the data acquisition-transmission integrity deviation and the increase in the change rate. The frame sampling frequency increase is then superimposed on the frame sampling frequency threshold to increase the frame sampling frequency for the next time. The data acquisition-transmission integrity deviation reflects the degree of deviation between the preset data acquisition-transmission integrity threshold and the data acquisition-transmission integrity value, and the increase in the change rate reflects the degree of deviation between the interface change rate and the preset upper limit of the interface change rate. If the interface change rate is within the preset interface change rate standard range, the current frame extraction frequency is maintained and no dynamic frame extraction optimization is performed. The preset interface change rate standard range represents the closed interval formed by the preset lower limit of the interface change rate and the preset upper limit of the interface change rate. If the interface change rate is less than the preset lower limit of interface change rate, the frame sampling frequency reduction amount is obtained by arithmetically averaging the data acquisition-transmission complete deviation amount and the change rate correction amount. The frame sampling frequency threshold is subtracted from the frame sampling frequency reduction amount to reduce the frame sampling frequency of the next time. The change rate correction amount is used to reflect the degree of deviation between the preset lower limit of interface change rate and the interface change rate.

6. The real-time data leakage blocking system based on deep packet inspection as described in claim 4, characterized in that, The specific steps for determining whether to optimize the core thread count of the thread pool are as follows: If the average number of Hook callbacks is greater than the preset upper limit of the average number of Hook callbacks, the result of the harmonic averaging of the data collection-transmission integrity deviation and the average number compensation is rounded up and used as the adjustment amount of the core thread number of the thread pool. The core thread number of the thread pool is adjusted in the next adjustment. The average number compensation is used to reflect the degree of deviation between the average number of Hook callbacks and the preset upper limit of the average number of Hook callbacks. If the average number of Hook callbacks is within the preset standard range of the average number of Hook callbacks, then the current core thread count of the thread pool is maintained and no optimization of the core thread count of the thread pool is performed. The standard range of the average number of Hook callbacks represents the closed interval formed by the preset lower limit of the average number of Hook callbacks and the preset upper limit of the average number of Hook callbacks. If the average number of Hook callbacks is less than the preset lower limit of the average number of Hook callbacks, the result of the harmonic averaging of the data acquisition-transmission integrity deviation and the average number correction, rounded down, is used as the adjustment amount for the core thread count of the thread pool. The average number correction is used to reflect the degree of deviation between the preset lower limit of the average number of Hook callbacks and the average number of Hook callbacks.

7. The real-time data leakage blocking system based on deep packet inspection as described in claim 1, characterized in that, The collaborative effectiveness parameter quantification module includes a collaborative effectiveness parameter acquisition unit, a collaborative effectiveness threshold and impact factor storage unit, and a collaborative effectiveness quantification unit. The coordination effectiveness parameter acquisition unit is used to acquire coordination effectiveness parameters, specifically including: interception status synchronization delay and padding response time, and to acquire the complete data acquisition-transmission value. The collaborative effectiveness threshold and influence factor storage unit is used to obtain the collaborative effectiveness threshold and collaborative effectiveness influence factor corresponding to the collaborative effectiveness parameters from the constructed real-time blocking database. Specifically, it includes: data acquisition-transmission integrity threshold, interception status synchronization delay threshold, replacement response time threshold, data acquisition-transmission integrity influence factor, interception status synchronization delay influence factor, and replacement response time influence factor. The synergy effectiveness quantification unit is used to couple the results of the synergy effectiveness threshold and synergy effectiveness parameter ratio analysis after correcting them with the synergy effectiveness influence factor to obtain a first effective value; to correct the results of the data acquisition-transmission integrity value and data acquisition-transmission integrity threshold ratio analysis after correcting them with the data acquisition-transmission integrity influence factor to obtain a second effective value; and to couple the first effective value and the second effective value to obtain the interception-blocking synergy effective value.

8. The real-time data leakage blocking system based on deep packet inspection as described in claim 1, characterized in that, The specific steps for determining whether to perform interception-blocking collaborative effectiveness optimization based on the effectiveness quantification results are as follows: Obtain the preset interception-blocking coordination effective interval from the constructed real-time blocking database. The preset interception-blocking coordination effective interval represents the closed interval formed by the preset lower limit of the preset interception-blocking coordination effective interval and the preset upper limit of the preset interception-blocking coordination effective interval. If the effective value of the interception-blocking coordination is greater than the preset effective upper limit of the interception-blocking coordination, then no optimization of the effectiveness of the interception-blocking coordination will be performed. If the effective value of the intercept-blocking coordination is within the preset effective range of the intercept-blocking coordination, then it is determined whether to dynamically optimize the retry interval timeout based on the thread response delay. If so, it is determined whether to dynamically optimize the interception state synchronization time threshold after the retry interval timeout is dynamically optimized. Otherwise, it is directly determined whether to dynamically optimize the interception state synchronization time threshold. If the effective value of the interception-blocking coordination is less than the preset lower limit of the effective interception-blocking coordination, an alarm will be issued to the preset personnel.

9. The real-time data leakage blocking system based on deep packet inspection as described in claim 8, characterized in that, The specific process for dynamically optimizing the retry interval timeout based on thread response latency is as follows: If the thread response delay exceeds the preset thread response delay limit, a delay warning will be issued to a preset number of personnel. If the thread response delay is within the preset thread response delay standard range, the retry interval timeout adjustment amount is obtained by arithmetically averaging the intercept-blocking coordination effective value and the thread response delay. The retry interval timeout adjustment amount is then superimposed with the retry interval timeout threshold to extend the next retry interval timeout. The preset thread response delay standard range represents the closed interval formed by the preset thread response delay lower limit and the preset thread response delay upper limit. If the thread response latency is less than the preset thread response latency lower limit, the retry interval timeout reduction amount is obtained by arithmetically averaging the intercept-blocking cooperative effective value and the response latency correction amount. The retry interval timeout threshold is subtracted from the retry interval timeout reduction amount to shorten the next retry interval timeout. The response latency correction amount is used to reflect the degree of deviation between the preset thread response latency lower limit and the thread response latency.

10. The real-time data leakage blocking system based on deep packet inspection as described in claim 8, characterized in that, The specific steps for determining whether to perform dynamic optimization of the interception state synchronization time threshold are as follows: If the sensitive behavior interception time is greater than the preset upper limit of the sensitive behavior interception time, the interception state synchronization time is adjusted upward by harmonic averaging the effective value of interception-blocking coordination and the interception time compensation amount. The upper limit of the interception state synchronization time is then superimposed with the upper limit threshold of the interception state synchronization time as the upper limit threshold of the next interception state synchronization time. The interception time compensation amount is used to reflect the degree of deviation between the sensitive behavior interception time and the preset upper limit of the sensitive behavior interception time. If the sensitive behavior interception time is within the preset sensitive behavior interception time standard range, then no dynamic optimization of the interception status synchronization time threshold will be performed. The preset sensitive behavior interception time standard range represents the closed interval formed by the preset lower limit of the sensitive behavior interception time and the preset upper limit of the sensitive behavior interception time. If the sensitive behavior interception time is less than the preset lower limit of sensitive behavior interception time, the interception state synchronization time reduction amount is obtained by harmonic averaging the effective value of interception-blocking coordination and the interception time correction amount. The lower limit threshold of interception state synchronization time is subtracted from the lower limit threshold of interception state synchronization time to obtain the lower limit threshold of interception state synchronization time for the next time. The interception time correction amount is used to reflect the degree of deviation between the preset lower limit of sensitive behavior interception time and the sensitive behavior interception time.

Images