Data leakage real-time blocking system based on deep packet inspection

Abstract

The application discloses a data leakage real-time blocking system based on deep packet detection and relates to the technical field of data security. The system comprises a data integrity parameter quantification module, a data acquisition-transmission integrity optimization module, a collaborative effectiveness parameter quantification module and an interception-blocking collaborative effectiveness optimization module. The application obtains the integrity quantification result by acquiring the data integrity parameter quantification in the data acquisition and transmission link, judges whether to perform data acquisition-transmission integrity optimization, executes the interception and blocking collaboration link after the data acquisition-transmission integrity optimization if yes, otherwise, directly executes the interception and blocking collaboration link, obtains the effectiveness quantification result according to the acquired collaborative effectiveness parameter quantification, judges whether to perform interception-blocking collaborative effectiveness optimization, improves the data leakage real-time blocking effectiveness, and solves the problem of low data leakage real-time blocking effectiveness caused by the lack of full-link collaborative mechanism in the prior art.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data security, and particularly relates to a data leakage real-time blocking system based on deep packet detection. BACKGROUND

[0002] In the process of real-time behavior monitoring SDK (Software Development Kit), all operations related to personal information in the application are captured by embedding the SDK of the APP to realize the recording of the behavior source. The hook technology is used to intercept the sensitive function call, record the "function name, parameter, return value, call stack (positioning is the main APP or the third-party SDK call), capture the reading / uploading behavior of the device information (such as IMEI, MAC, Android ID) through the API (Application Programming Interface) hook, intercept the network request API in the application, and record the transmission content digest (after desensitization), target domain name / IP, transmission protocol (HTTP / HTTPS), initiator (main APP / SDK).

[0003] The real-time network traffic of the APP is obtained through the switch port mirroring or the optical splitter, and the application layer transmission content (such as the request body after HTTPS decryption, FTP file content) is analyzed. For non-standard protocols (such as APP self-defined private protocol), the characteristic field is analyzed by Wireshark packet capture, and the analysis rule is constructed (such as 0x01 is used to identify the user ID transmission of a social APP, and the deep packet detection extracts the transmitted user ID through the feature). The collected transmission content (such as mobile phone number, file hash) is associated with the claimed transmission content uploaded by the SDK (through the transmission time + source IP + target IP matching), and it is judged whether there is "hidden behavior of not recording by the SDK but actually transmitting sensitive data". Kafka is used as a message queue to receive the behavior data uploaded by the SDK and the traffic data pushed by the deep packet detection; through the Flink real-time stream processing framework, the repeated data is removed, and the missing fields are completed; based on the preset rules and machine learning models (such as classification algorithms), it is judged whether the behavior is illegal, and the responsible subject (main APP or third-party SDK) is located; the blocking action is executed, at the same time, the key information (used for audit tracing) needs to be recorded synchronously, and the alarm is sent to the administrator.

[0004] For example, the Chinese invention patent with publication number CN118445840A discloses a database sensitive data leakage protection method and device, which includes creating a sensitive data rule set, screening and monitoring operations involving sensitive data; auditing and collecting network traffic related to database sensitive data to obtain SQL statements of sensitive data; processing the SQL statements of sensitive data collected by the audit through a data processing engine to determine whether they hit sensitive data protection rules; if the result is yes, intercept the network traffic of the database, and if the result is no, allow the network traffic to access the database.

[0005] For example, the Chinese invention patent with publication number CN118898064B discloses a data leakage prevention processing method, system and data server, which includes monitoring the process behavior and file behavior of the data server to conduct in-depth monitoring from the behavior, avoiding security risks caused by monitoring only the process name; in addition, the method performs real-time feature matching and abnormality analysis on process behavior and file behavior, accurately identifies potential leakage behavior and blocks it in time, effectively preventing data leakage.

[0006] The above technology at least has the following technical problems:

[0007] During the running of the real-time behavior monitoring SDK, there are multiple technical pain points that affect each other and trigger chain problems. In the front-end data collection link, when multiple SDKs trigger sensitive behaviors (such as centralized permission application and device information function calling) at the same time in scenarios such as APP startup, due to the limited thread processing capacity of the JavaHook framework, if the time consumption of a single Hook callback exceeds the preset threshold, the subsequent behavior collection enters a queuing state, which in turn causes data timestamp drift and forms collection delay in high-concurrency scenarios.

[0008] In the data transmission link, the unoptimized JSON format has a large data volume when transmitting batch behavior records, which not only occupies the network traffic of the APP, causing network request blocking of normal business, but also may trigger the background traffic limiting mechanism, directly causing the upload failure of collected data, forming the dual risks of data loss caused by collection delay and transmission failure.

[0009] In the interception and blocking coordination link, even if part of the data is successfully uploaded and triggers risk interception, the coordination defects between the application layer and the network layer in the existing architecture will cause new problems. The strategies of application layer interception and network layer blocking are not synchronized in real time. The SDK has intercepted a behavior, but the DPI (Deep Packet Inspection) has not received the "interception success" feedback, and still performs network blocking, causing resource waste; conversely, when the SDK fails to intercept, the DPI does not timely compensate.

[0010] Finally lead to sensitive data transmission leaks through the network, form from the front-end collection to the back-end blocking of the whole link risk vulnerability, there is due to the lack of whole link collaborative mechanism caused by data leakage real-time blocking effectiveness low problem. SUMMARY

[0011] In order to solve the problem of low effectiveness of real-time blocking of data leakage due to the lack of whole link collaborative mechanism in the prior art, the present application provides a data leakage real-time blocking system based on deep packet inspection. The technical scheme is as follows:

[0012] In one aspect, a data leakage real-time blocking system based on deep packet inspection is provided, comprising the following steps: data integrity parameter quantization module, data collection-transmission integrity optimization module, collaborative effectiveness parameter quantization module and interception-blocking collaborative effectiveness optimization module: wherein the data integrity parameter quantization module is used to obtain the data integrity parameter in the front-end data collection and transmission link, to quantify the integrity of the APP end data collection and transmission process, and obtain the integrity quantization result; the data collection-transmission integrity optimization module is used to determine whether to perform data collection-transmission integrity optimization according to the integrity quantization result, if yes, then perform the interception and blocking collaboration link after data collection-transmission integrity optimization, otherwise directly perform the interception and blocking collaboration link, the data collection-transmission integrity optimization includes dynamic frame extraction optimization to reduce the amount of redundant data transmission, to avoid loss due to data overload, and thread pool core thread number optimization to avoid data processing delay and backlog caused by insufficient core thread number; the collaborative effectiveness parameter quantization module is used to obtain the collaborative effectiveness parameter in the interception and blocking collaboration link, to quantify the effectiveness of the application layer interception and network layer blocking collaboration, and obtain the effectiveness quantization result; the interception-blocking collaborative effectiveness optimization module is used to determine whether to perform interception-blocking collaborative effectiveness optimization according to the effectiveness quantization result, if yes, then perform the data leakage real-time blocking operation after interception-blocking collaborative effectiveness optimization, otherwise directly perform the data leakage real-time blocking operation, the interception-blocking collaborative effectiveness optimization includes retry interval timeout time dynamic optimization to avoid the blocking delay or failure caused by improper setting of invalid retry interval timeout time, and interception state synchronization time threshold dynamic optimization to avoid the inconsistency of interception and blocking actions caused by fixed interception state synchronization time.

[0013] The one or more technical solutions provided in the embodiments of the present application have at least the following technical effects or advantages:

[0014] 1、obtain the integrity quantization result by obtaining the data integrity parameter in the data acquisition and transmission link of the front end to represent the integrity of the data acquisition and transmission in the APP end, judge whether to perform data acquisition-transmission integrity optimization according to the integrity quantization result to avoid the integrity loss caused by data overload, processing delay or uneven resource allocation, ensure the accuracy of the key data in the whole link circulation process, obtain the effectiveness quantization result by obtaining the cooperation effectiveness parameter in the interception and blocking cooperation link to represent the effectiveness of the cooperation between the application layer interception and the network layer blocking, judge whether to perform interception-blocking cooperation effectiveness optimization according to the effectiveness quantization result to eliminate the protection vulnerabilities caused by synchronization delay, inefficient retry mechanism or inconsistent state in real time, ensure the accurate identification and rapid blocking of the leaked data, improve the overall protection effectiveness and response speed of the system, and further improve the effectiveness of real-time blocking of data leakage.

[0015] 2、judge whether to perform data acquisition-transmission integrity optimization according to the integrity quantization result, if yes, judge whether to perform dynamic frame extraction optimization according to the interface change rate to reduce the amount of redundant data transmission, avoid the loss caused by data overload, dynamically identify the interface change characteristics and intelligently adjust the frame extraction strategy, accurately exclude redundant data frames, avoid the bandwidth resource occupation caused by invalid data transmission, and judge whether to perform thread pool core thread number optimization according to the average number of Hook callback to avoid the data processing delay and backlog caused by insufficient core thread number, eliminate the integrity risks caused by overload or insufficient resources from both data source and processing bottleneck, guarantee the real-time performance and accuracy of data acquisition and transmission in high-concurrency scenarios, and further improve the effectiveness of real-time blocking of data leakage.

[0016] 3、judge whether to perform interception-blocking cooperation effectiveness optimization according to the effectiveness quantization result, if yes, judge whether to perform retry interval timeout time dynamic optimization according to the thread response delay to avoid the blocking delay or failure caused by improper invalid retry interval timeout time setting, accurately avoid the invalid retry resource consumption or blocking failure caused by improper timeout setting due to fixed parameters, improve the interception success rate of the system for real leakage events, and judge whether to perform interception state synchronization time threshold dynamic optimization according to the sensitive behavior interception time to avoid the inconsistency between the interception and blocking actions caused by fixed interception state synchronization time, improve the single blocking success rate while ensuring the seamless connection of the application layer and network layer protection actions, eliminate the cooperation protection vulnerabilities from the time control and state consistency dimensions, and further improve the effectiveness of real-time blocking of data leakage. BRIEF DESCRIPTION OF DRAWINGS

[0017] Figure 1 The structural schematic diagram of the data leakage real-time blocking system based on deep packet inspection provided by the embodiment of the application is shown in the figure.

[0018] Figure 2The structure thread pool core thread number optimization flowchart of the data leakage real-time blocking system based on deep packet detection provided by the embodiment of the application is as follows:

[0019] Figure 3 The retry interval timeout time dynamic optimization flowchart of the data leakage real-time blocking system based on deep packet detection provided by the embodiment of the application is as follows. DETAILED DESCRIPTION

[0020] The technical solutions in the application will be described below with reference to the drawings.

[0021] In the embodiments of the application, the words such as “for example”, “for instance”, “such as”, “exemplary” and the like are used to represent an example, an illustration or a description. Any embodiment or design solution described as “for example” in the application should not be interpreted as more preferred or more advantageous than other embodiments or design solutions. Rather, the word “for example” is intended to present a concept in a specific manner. In addition, in the embodiments of the application, the meaning expressed by “and / or” can be both, or can be either of the two.

[0022] The embodiment of the application provides a data leakage real-time blocking system based on deep packet detection, solves the problem of low data leakage real-time blocking effectiveness caused by the lack of full-link cooperation mechanism in the prior art, obtains an integrity quantization result by quantizing data integrity parameters in a front-end data collection and transmission link, and judges whether to perform data collection-transmission integrity optimization. If yes, the interception and blocking cooperation link is executed after the data collection-transmission integrity optimization; otherwise, the interception and blocking cooperation link is directly executed. According to the obtained cooperation effectiveness parameter, an effectiveness quantization result is obtained, and it is judged whether to perform interception-blocking cooperation effectiveness optimization, thereby improving the data leakage real-time blocking effectiveness.

[0023] The technical solutions in the embodiments of the application are to solve the problem of low data leakage real-time blocking effectiveness caused by the lack of full-link cooperation mechanism, and the general idea is as follows:

[0024] The data integrity parameter in the front-end data acquisition and transmission link is acquired to quantify the integrity of the APP end data acquisition to the transmission process, the integrity quantization result is obtained, whether the data acquisition-transmission integrity optimization is performed is judged according to the integrity quantization result, if yes, the interception and blocking cooperation link is executed after the data acquisition-transmission integrity optimization, otherwise the interception and blocking cooperation link is directly executed, the cooperation effectiveness parameter in the interception and blocking cooperation link is acquired to quantify the effectiveness of the application layer interception and the network layer blocking cooperation, the effectiveness quantization result is obtained, whether the interception-blocking cooperation effectiveness optimization is performed is judged according to the effectiveness quantization result, if yes, the data leakage real-time blocking operation is executed after the interception-blocking cooperation effectiveness optimization, otherwise the data leakage real-time blocking operation is directly executed, and the data leakage real-time blocking effectiveness is improved.

[0025] To make the technical problems, technical solutions and advantages of the present application clearer, the following will be described in detail with reference to the drawings and specific embodiments.

[0026] As shown in Figure 1 The structure schematic diagram of the data leakage real-time blocking system based on the deep packet detection provided by the embodiment of the present application is shown, and the processing flow of the system can include the following steps: a data integrity parameter quantization module, a data acquisition-transmission integrity optimization module, a cooperation effectiveness parameter quantization module and an interception-blocking cooperation effectiveness optimization module.

[0027] The data integrity parameter quantization module is used for acquiring the data integrity parameter in the front-end data acquisition and transmission link to quantify the integrity of the APP end data acquisition to the transmission process, and obtaining the integrity quantization result. The data integrity parameter quantization module specifically includes: a data integrity parameter acquisition unit, a data integrity threshold and an influence factor storage unit and a data integrity parameter quantization unit.

[0028] It should be noted that the data integrity parameter acquisition unit is configured to acquire data integrity parameters, specifically including: Hook callback delay, sensitive behavior record data timestamp offset, and sensitive behavior record data upload rate. Specifically, the time difference between the sensitive behavior triggering time recorded by the timestamp and the callback processing completion time is recorded as the Hook callback delay. The absolute difference between the timestamp of the preset sensitive behavior record data and the actual occurrence time of the sensitive behavior record data recorded by the timestamp is recorded as the sensitive behavior record data timestamp offset. The ratio of the amount of sensitive behavior record data transmitted from the APP end to the backend by the SDK maintained by the code integrated in the APP to the upload time recorded by the time interface is recorded as the sensitive behavior record data upload rate. The callback processing refers to recording information such as sensitive behavior type, occurrence time, and calling party, and the sensitive behavior record data specifically refers to the sensitive behavior record data collected by the real-time behavior monitoring SDK, that is, the record data of sensitive behaviors related to personal information during APP running, such as permission application, device information calling, and sensitive function calling. The data integrity threshold and influence factor storage unit is configured to acquire the data integrity threshold and the data integrity influence factor corresponding to the data integrity parameters from the constructed real-time blocking database, specifically including: Hook callback delay threshold, sensitive behavior record data timestamp offset threshold, sensitive behavior record data upload rate threshold, Hook callback delay influence factor, sensitive behavior record data timestamp offset influence factor, and sensitive behavior record data upload rate influence factor. The data integrity parameter quantization unit is configured to correct the proportion analysis result of the Hook callback delay threshold and the Hook callback delay by the Hook callback delay influence factor to obtain a first complete value, correct the proportion analysis result of the sensitive behavior record data timestamp offset threshold and the sensitive behavior record data timestamp offset by the sensitive behavior record data timestamp offset influence factor to obtain a second complete value, and correct the proportion analysis result of the sensitive behavior record data upload rate and the sensitive behavior record data upload rate threshold by the sensitive behavior record data upload rate influence factor to obtain a third complete value. The first complete value, the second complete value, and the third complete value are coupled to obtain a data collection-transmission complete value.

[0029] It should be further explained that, to support the efficient operation of the real-time data leakage blocking system based on deep packet inspection, a real-time blocking database is pre-built. This database is specifically used to store various key setting parameters, including essential preset data such as Hook callback delay, timestamp offset of sensitive behavior log data, and upload rate of sensitive behavior log data. The initial values ​​of these parameters are not subjectively determined but are based on actual data. For example, the initial value of the Hook callback delay threshold is calculated by summing and averaging historical Hook callback delays accumulated in the database, ensuring that the initial settings have objective basis and representativeness. Furthermore, considering the complexity of actual application scenarios and the dynamic changes in requirements, all parameter values ​​in the database remain adjustable. Technical personnel can manually set, adjust, and fine-tune these values ​​based on the system's performance during actual debugging, ultimately achieving optimal configuration of system parameters.

[0030] It needs to be explained that, firstly, the specific constraint expression for obtaining the first complete value is:

[0031] ;

[0032] In the formula, A represents the first complete value, T1 represents the Hook callback delay impact factor obtained from the real-time blocking database, B0 represents the Hook callback delay threshold obtained from the real-time blocking database, and B represents the Hook callback delay. The Hook callback delay is negatively correlated with the data collection-transmission complete value; a higher Hook callback delay results in some sensitive behaviors not being recorded or uploaded in a timely manner, and a lower data collection-transmission complete value.

[0033] Secondly, the specific constraint expression for obtaining the second complete value is:

[0034] ;

[0035] In the formula, C represents the second complete value, T2 represents the impact factor of the timestamp offset of sensitive behavior record data obtained from the real-time blocking database, D0 represents the timestamp offset threshold of sensitive behavior record data obtained from the real-time blocking database, and D represents the timestamp offset of sensitive behavior record data. The timestamp offset of sensitive behavior record data is negatively correlated with the data acquisition-transmission complete value. A larger timestamp offset leads to data temporal disorder, affecting the accuracy of subsequent analysis and even causing some data to be discarded due to temporal issues. Conversely, a smaller data acquisition-transmission complete value results in a smaller data acquisition-transmission complete value.

[0036] Then, the specific constraint expression for obtaining the third complete value is:

[0037] ;

[0038] In the formula, E represents the second complete value, T3 represents the influence factor of the upload rate of sensitive behavior record data obtained from the real-time blocking database, F0 represents the threshold of the upload rate of sensitive behavior record data obtained from the real-time blocking database, and F represents the upload rate of sensitive behavior record data. There is a positive correlation between the upload rate of sensitive behavior record data and the data acquisition-transmission complete value. The higher the upload rate of sensitive behavior record data, the higher the efficiency of data transmission, the greater the probability that sensitive behavior records are delivered to the server in a timely manner, and the higher the data acquisition-transmission complete value.

[0039] Finally, by coupling the first complete value, the second complete value, and the third complete value, the specific constraint expression for the data acquisition-transmission complete value is obtained as follows:

[0040] ;

[0041] In the formula, G represents the complete data acquisition-transmission value.

[0042] It's important to explain that the real-time blocking database stores influencing factors corresponding to data integrity parameters. These include Hook callback delay influencing factors, timestamp offset influencing factors for sensitive behavior record data, and upload rate influencing factors for sensitive behavior record data. The values ​​of these influencing factors are mostly between 0 and 1, and the sum of the three values ​​is 1. Furthermore, there is a pre-defined mapping relationship between these influencing factors and data integrity parameters. This relationship can be a one-to-one direct correspondence or a many-to-one aggregated correspondence.

[0043] Specifically, there are correlations among data integrity parameters, as follows: The higher the Hook callback delay, the larger the deviation between the recorded time and the actual time of the action, resulting in a larger timestamp offset for sensitive action records; the larger the timestamp offset for sensitive action records, the more disordered the data upload sequence becomes, the longer the time interval between data collection and transmission, and the slower the data upload rate for sensitive action records; the higher the Hook callback delay, the less timely the data can enter the transmission queue, leading to data backlog and reducing the upload volume per unit time, thus slowing down the data upload rate for sensitive action records.

[0044] In this embodiment, understanding the correlation between data integrity parameters helps to accurately locate the root cause of integrity damage in the data acquisition and transmission process, forming a closed-loop mechanism of problem tracing and targeted optimization. Ultimately, this ensures the time accuracy, temporal consistency, and transmission efficiency of sensitive behavior records throughout the entire acquisition and transmission chain, improving the controllability of data integrity and the system's adaptive adjustment capabilities. Understanding the positive and negative correlation between data integrity parameters and data acquisition-transmission integrity values ​​helps to construct a quantitative correlation between parameters and integrity, providing a clear direction for precise optimization of the data acquisition and transmission process. On the one hand, it can quickly identify the core driving factors affecting integrity; on the other hand, it can achieve early prediction and dynamic control of integrity risks, continuously ensuring the integrity of sensitive behavior data throughout the entire acquisition and transmission chain, and providing a reliable data foundation for subsequent interception-blocking coordination and other processes.

[0045] The data acquisition-transmission integrity optimization module is used to determine whether to perform data acquisition-transmission integrity optimization based on the integrity quantification results. If so, the interception and blocking coordination step is executed after the data acquisition-transmission integrity optimization; otherwise, the interception and blocking coordination step is executed directly. Data acquisition-transmission integrity optimization includes dynamic frame extraction optimization to reduce redundant data transmission and avoid data loss due to data overload, as well as optimization of the core thread count of the thread pool to avoid data processing delays and backlogs caused by insufficient core thread count.

[0046] The collaborative effectiveness parameter quantification module is used to acquire collaborative effectiveness parameters in the interception and blocking collaborative process, thereby quantifying the effectiveness of application-layer interception and network-layer blocking collaboration and obtaining effectiveness quantification results. Specifically, the collaborative effectiveness parameter quantification module includes a collaborative effectiveness parameter acquisition unit, a collaborative effectiveness threshold and influence factor storage unit, and a collaborative effectiveness quantification unit.

[0047] It should be noted that the collaborative effectiveness parameter acquisition unit is used to acquire collaborative effectiveness parameters, specifically including: interception status synchronization delay and replacement response time, and simultaneously acquires the data acquisition-transmission integrity value; the collaborative effectiveness threshold and influence factor storage unit is used to acquire the collaborative effectiveness threshold and collaborative effectiveness influence factor corresponding to the collaborative effectiveness parameters from the constructed real-time blocking database, specifically including: data acquisition-transmission integrity threshold, interception status synchronization delay threshold, replacement response time threshold, data acquisition-transmission integrity influence factor, interception status synchronization delay influence factor, and replacement response time influence factor; the collaborative effectiveness quantification unit is used to correct and couple the collaborative effectiveness threshold and collaborative effectiveness parameter ratio analysis results through the collaborative effectiveness influence factor, and record it as the first effective value; it corrects the data acquisition-transmission integrity value and data acquisition-transmission integrity threshold ratio analysis results through the data acquisition-transmission integrity influence factor, and records it as the second effective value; the first effective value and the second effective value are coupled to obtain the interception-blocking collaborative effective value.

[0048] It needs to be explained that, firstly, the specific constraint expression for obtaining the first valid value is:

[0049] ;

[0050] In the formula, P represents the first effective value, S1 represents the interception status synchronization delay impact factor obtained from the real-time blocking database, V0 represents the interception status synchronization delay threshold obtained from the real-time blocking database, and V represents the interception status synchronization delay. S2 represents the replacement response time impact factor obtained from the real-time blocking database, R0 represents the replacement response time threshold obtained from the real-time blocking database, and R represents the replacement response time. Specifically, the interception status synchronization delay is negatively correlated with the interception-blocking collaborative effective value. The larger the interception status synchronization delay, the less timely the DPI can obtain the latest interception status, leading to repeated or missed interceptions, and a lower interception-blocking collaborative effective value. Similarly, the replacement response time is negatively correlated with the interception-blocking collaborative effective value. The longer the replacement response time, the longer the time it takes for the network layer to execute network blocking after receiving the failure signal, and a smaller interception-blocking collaborative effective value.

[0051] Then, the specific constraint expression for obtaining the second valid value is:

[0052] ;

[0053] In the formula, Q represents the second effective value, S3 represents the data acquisition-transmission integrity impact factor obtained from the real-time blocking database, W0 represents the data acquisition-transmission integrity threshold obtained from the real-time blocking database, and W represents the data acquisition-transmission integrity value. The data acquisition-transmission integrity value is positively correlated with the interception-blocking collaborative effective value. A higher data acquisition-transmission integrity value indicates more complete data acquisition and transmission, ensuring accurate synchronization of the interception status to the DPI and preventing collaborative failure due to data loss.

[0054] Finally, the specific constraint expression for the effective value of the intercept-blocking coordination is obtained as follows:

[0055] ;

[0056] In the formula, Y represents the effective value of the interception-blocking collaboration.

[0057] It should be explained that the real-time blocking database stores influencing factors corresponding to the collaborative effectiveness parameters, specifically including data acquisition-transmission integrity influencing factors, interception status synchronization delay influencing factors, and replacement response time influencing factors. These influencing factors mostly range from 0 to 1, and the sum of the three values ​​is 1. Furthermore, there is a pre-defined mapping relationship between these influencing factors and the collaborative effectiveness parameters; this relationship can be a one-to-one direct correspondence or a many-to-one aggregated correspondence.

[0058] Specifically, there are correlations among the parameters of collaborative effectiveness, as follows: The lower the data acquisition-transmission integrity value, the lower the integrity of the recorded and uploaded data, the longer it takes for the application layer to report the interception status to the network layer after completing the sensitive behavior interception, and the greater the interception status synchronization delay; the greater the interception status synchronization delay, the longer the start time of the interpolation blocking will be due to the DPI not receiving the signal in time due to the synchronization delay, increasing the risk of sensitive data leakage, and the longer the interpolation response time; the lower the data acquisition-transmission integrity value, the more likely the SDK interception will fail and the DPI interpolation blocking will not be timely, and sensitive data may have already been leaked through network transmission, and the longer the interpolation response time will be.

[0059] In this embodiment, understanding the correlation between the parameters of collaborative effectiveness helps to construct a collaborative protection link of problem transmission and precise intervention. On the one hand, it can realize the root cause of collaborative failure, and on the other hand, it can establish a predictive mechanism for risk transmission. Understanding the positive and negative correlation between the parameters of collaborative effectiveness and the effective value of interception-blocking collaboration helps to construct a precise control system of parameters and effectiveness, and realize the targeted optimization and effectiveness improvement of the interception-blocking collaboration mechanism. On the one hand, it can clarify the core target of collaborative optimization, and on the other hand, it can establish a dynamic early warning and intervention mechanism for collaborative effectiveness.

[0060] The intercept-blocking coordination effectiveness optimization module is used to determine whether to perform intercept-blocking coordination effectiveness optimization based on the effectiveness quantification result. If so, real-time data leakage blocking operation is performed after the intercept-blocking coordination effectiveness optimization; otherwise, real-time data leakage blocking operation is performed directly. The intercept-blocking coordination effectiveness optimization includes dynamic optimization of retry interval timeout to avoid blocking delays or failures caused by improper setting of invalid retry interval timeout, and dynamic optimization of interception status synchronization time threshold to avoid inconsistencies between interception and blocking actions caused by fixed interception status synchronization time.

[0061] In this embodiment, the above modules achieve a closed-loop performance improvement from data acquisition and transmission to interception and blocking through a full-link design of quantification, optimization, and collaboration. The data integrity parameter quantification module provides an objective basis for subsequent optimization by accurately quantifying the integrity of front-end data acquisition and transmission. The data acquisition-transmission integrity optimization module reduces redundant data transmission by dynamically extracting frames and optimizes the core thread count of the thread pool to avoid processing delays and backlogs. These dual measures significantly improve the integrity of data from acquisition to transmission on the APP side and reduce the data loss rate caused by overload or insufficient resources. On this basis, the collaboration effectiveness parameter quantification module quantifies the collaboration effectiveness between the application layer and the network layer. The interception-blocking collaboration effectiveness optimization module avoids blocking delays or failures by dynamically adjusting the retry interval timeout and optimizes the interception status synchronization time threshold to prevent inconsistent actions, further improving the accuracy and timeliness of collaborative interception and blocking. Overall, the four modules work in a progressive and collaborative manner. They lay a reliable data foundation for interception and blocking collaboration through data acquisition and transmission integrity optimization and ensure the efficient execution of interception and blocking actions through collaboration effectiveness optimization. Ultimately, this significantly reduces the risk of sensitive data leakage and improves the system's emergency response capability and data security protection level in complex scenarios.

[0062] It should be further explained that during the real-time data leakage blocking operation, interception and blocking collaborative instructions, whether optimized or not by the interception-blocking collaborative effectiveness optimization module, are obtained. These instructions contain the characteristics of the leaked data to be blocked. These characteristics include at least one of data identifier, transmission path, application-layer triggering conditions, and network-layer triggering conditions. The interception and blocking collaborative instructions are generated based on the front-end data acquisition and transmission integrity results output by the data acquisition-transmission integrity optimization module and the collaborative effectiveness quantification results output by the collaborative effectiveness parameter quantification module. Real-time parsing of the target data transmission stream (including cross-application / cross-process data transmission (such as communication data with third-party services) and data streams between local storage and network transmission) is performed using deep packet inspection technology. The parsing results are matched with the leaked data characteristics to locate the data stream to be blocked. The located data stream is the actual leaked data after integrity verification. The application layer executes the interception state synchronization time threshold dynamically optimized based on the interception state synchronization time threshold or the default interception state synchronization time threshold. The system performs front-end interception actions on leaked data, including at least one of terminating the data transmission interface and clearing the cache; it synchronizes the application layer interception status to the network layer in real time, and the network layer executes blocking actions on matching network traffic based on cooperative instructions, including at least one of disconnecting the connection and dropping data packets, with application layer interception and network layer blocking being consistent in time; it records the execution status of blocking actions in real time, including at least one of whether the interception was successful, whether the blocking was successful, the time taken, and the amount of data involved, while monitoring for any missing data or false blocking; when the real-time monitoring step detects that the initial blocking was unsuccessful, it dynamically adjusts the retry frequency and performs secondary blocking within the timeout threshold based on the dynamically optimized retry interval timeout or the default retry interval timeout, until successful blocking or the timeout limit is reached; it generates a blocking log containing complete information about the blocking operation, including at least one of the blocking object, time, method, result, associated integrity parameters, and associated cooperative validity parameters.

[0063] Furthermore, the specific steps for determining whether to perform data acquisition-transmission integrity optimization based on the integrity quantification results are as follows: obtain the preset data acquisition-transmission integrity threshold from the constructed real-time blocking database; if the data acquisition-transmission integrity value is greater than or equal to the preset data acquisition-transmission integrity threshold, then no data acquisition-transmission integrity optimization is performed; if the data acquisition-transmission integrity value is not greater than the preset data acquisition-transmission integrity threshold, then determine whether to perform dynamic frame extraction optimization based on the interface change rate; if so, then determine whether to perform thread pool core thread number optimization after dynamic frame extraction optimization; otherwise, directly determine whether to perform thread pool core thread number optimization.

[0064] As a further explanation, the specific process for determining whether to perform dynamic frame skipping optimization based on the interface change rate is as follows:

[0065] Among them, the interface change rate is the core indicator for measuring the dynamism of the APP interface content. Specifically, it refers to the ratio of the pixel change area in the interface image to the total interface area. The frame extraction frequency refers to the number of frames extracted within a preset time in a continuous video stream or animation sequence.

[0066] If the interface change rate exceeds the preset upper limit of the interface change rate, it means that the high-frequency changes in the interface content may generate a large amount of repetitive or non-critical data (such as video frames, dynamic interface elements, etc.). In this case, the arithmetic mean of the data acquisition-transmission integrity deviation and the change rate increase is used to avoid excessive frame extraction that could damage data integrity. This results in the frame extraction frequency adjustment amount. The frame extraction frequency adjustment amount is then superimposed on the frame extraction frequency threshold to increase the frame extraction frequency for the next time. In highly dynamic interface scenarios, this significantly reduces transmission pressure while ensuring the integrity and timeliness of critical data, providing high-quality front-end data support for subsequent interception-blocking coordination. The data acquisition-transmission integrity deviation amount reflects the degree of deviation between the preset data acquisition-transmission integrity threshold and the data acquisition-transmission integrity value. The change rate increase amount represents the difference between the interface change rate and the preset upper limit of the interface change rate.

[0067] If the interface change rate is within the preset interface change rate standard range, it means that the changes in the interface content are within the reasonable and stable range preset by the system. At this time, the interface will not generate a large amount of redundant data due to high-frequency drastic changes, nor will it cause a delay in the update of key information due to low-frequency changes. In this state, the default frame sampling frequency can achieve a balance between redundancy control and data integrity. There is no need to increase the frame sampling frequency (to avoid excessive frame sampling leading to data loss) or decrease the frequency (to prevent invalid data accumulation). It can maintain a stable frame acquisition rhythm, ensuring that the transmitted data includes complete key interface changes (such as element status updates triggered by user operations) and eliminates repetitive static content (such as background areas that have not changed for a long time). The preset interface change rate standard range represents the closed interval formed by the preset lower limit and the preset upper limit of the interface change rate.

[0068] If the interface change rate is less than the preset lower limit of the interface change rate, it means that the interface content is in a low-frequency change state (such as a static text page or an interface that has not been operated for a long time). At this time, an excessively high frame sampling frequency will generate a large amount of duplicate data (such as consecutive frames on the same page). Therefore, the arithmetic mean of the data acquisition-transmission integrity deviation and the change rate correction is used to avoid insufficient frame sampling affecting data integrity, and the frame sampling frequency reduction amount is obtained. The frame sampling frequency threshold is subtracted from the frame sampling frequency reduction amount to reduce the frame sampling frequency of the next time. In low dynamic scenarios (such as users slowly browsing images and text or pausing operations), although the interface changes are few, key frames (such as scrolling to a new paragraph or the moment of clicking a button) still need to be accurately captured to avoid missing key changes due to too sparse frame sampling. This linkage response of static degree and frame sampling density allows data acquisition to adapt to low dynamic rhythm without disrupting the temporal continuity due to excessive frequency reduction. The change rate correction amount represents the difference between the preset lower limit of the interface change rate and the interface change rate.

[0069] In this embodiment, precise scene-specific control achieves a triple technical effect of redundancy suppression, integrity assurance, and resource adaptation. It not only eliminates redundant data such as video frames and dynamic elements by increasing the frame extraction frequency, but also avoids excessive frame extraction by using integrity deviation constraints, ensuring that critical changes (such as interface jumps triggered by operations) are not lost. This provides highly timely front-end data for interception-blocking coordination and prevents disruption of temporal continuity due to excessively sparse frame extraction. Overall, this mechanism achieves adaptive matching between the frame extraction strategy and interface dynamics, significantly reducing transmission and computing resource consumption across all scenarios while ensuring data integrity and the timeliness of critical information. This lays a high-quality data foundation for subsequent data acquisition-transmission optimization and interception-blocking coordination stages.

[0070] It should be noted that, as Figure 2 The diagram shows the optimization flowchart for the core thread count of the thread pool in the real-time data leakage blocking system based on deep packet inspection provided in this application embodiment. The specific logic is as follows: The system determines whether to optimize the core thread count based on the average number of Hook callbacks. If the average number of Hook callbacks is greater than the preset upper limit of the average number of Hook callbacks, the harmonic average of the data acquisition-transmission integrity deviation and the average number compensation, rounded up, is used as the upward adjustment amount for the core thread count. If the average number of Hook callbacks is within the preset standard range of the average number of Hook callbacks, the current core thread count is maintained. If the average number of Hook callbacks is less than the preset lower limit of the average number of Hook callbacks, the harmonic average of the data acquisition-transmission integrity deviation and the average number correction, rounded down, is used as the downward adjustment amount for the next core thread count adjustment.

[0071] As a further explanation, the specific steps to determine whether to optimize the core thread count of the thread pool are as follows:

[0072] Among them, the average number of Hook callbacks represents the average efficiency of the number of Hook callbacks within a preset time window, and the core thread count of the thread pool refers to the number of threads that remain in the thread pool for more than a preset time.

[0073] If the average number of Hook callbacks exceeds the preset upper limit for the average number of Hook callbacks, it means that the fixed number of threads cannot cope with the peak load, resulting in a performance degradation. In this case, the result of harmonic averaging of the data collection-transmission complete deviation and the average number compensation is rounded up and used as the adjustment amount for the core thread count of the thread pool. This ensures that the adjustment magnitude is positively correlated with the degree of load overload, achieving precise resource allocation. The adjustment amount for the core thread count of the thread pool is added to the core thread count of the thread pool to extend the core thread count. The rounding adjustment method ensures that the number of threads increases by at least 1, avoiding insufficient adjustment due to small deviations. At the same time, the use of harmonic averaging makes the adjustment process smoother and reduces system oscillations caused by large adjustments. The average number compensation represents the difference between the average number of Hook callbacks and the preset upper limit for the average number of Hook callbacks.

[0074] If the average number of Hook callbacks is within the preset standard range for the average number of Hook callbacks, it means that the current thread pool configuration can fully meet the business needs. There will be no backlog of tasks due to insufficient threads, nor will there be a waste of resources due to excessive threads. Therefore, the current core thread count of the thread pool will be maintained, and no optimization of the core thread count of the thread pool will be performed. The standard range for the average number of Hook callbacks represents the closed interval formed by the preset lower limit and the preset upper limit of the average number of Hook callbacks.

[0075] If the average number of hook callbacks is less than the preset lower limit for the average number of hook callbacks, it means that the current thread pool size is too large and there are a large number of idle threads. In this case, the harmonic averaging of the data collection-transmission integrity deviation and the average number correction, rounded down, is used as the reduction amount for the core thread count of the thread pool. The core thread count is then subtracted from this reduction amount to shorten the core thread count. Too many threads increase the operating system's scheduling burden, leading to frequent task switching. Reducing the thread count improves CPU cache hit rate and reduces context switching overhead, thereby speeding up the execution of active threads. When the number of hook callbacks is insufficient, the task queue in the thread pool may be empty for a long time, causing some threads to be in a waiting state. By dynamically adjusting the thread count, the system can maintain a reasonable task queue length and avoid resource waste. The average number correction amount represents the difference between the preset lower limit for the average number of hook callbacks and the average number of hook callbacks.

[0076] In this embodiment, by dynamically adjusting the core thread count of the thread pool, precise response to system load changes and optimized resource allocation are achieved. This ensures that the adjustment magnitude of the thread count is positively correlated with the degree of load exceeding limits. It guarantees that at least one thread is added to avoid insufficient optimization due to minor deviations, while the smoothing characteristics of harmonic averaging reduce system oscillations that may be caused by large adjustments. Maintaining the existing thread configuration avoids unnecessary adjustments, ensuring that the system maximizes resource utilization while meeting business needs. This effectively reduces the operating system scheduling burden and context switching overhead, improves CPU cache hit rate, and avoids resource waste and long-term idle task queues caused by too many threads. Ultimately, the system achieves adaptive optimization in response to different load scenarios, ensuring a dynamic balance between task processing efficiency and resource utilization efficiency.

[0077] Furthermore, the specific steps for determining whether to perform interception-blocking coordination effectiveness optimization based on the effectiveness quantification results are as follows: Obtain the preset interception-blocking coordination effective range from the constructed real-time blocking database. The preset interception-blocking coordination effective range represents the closed interval formed by the preset lower limit and the preset upper limit of the interception-blocking coordination effectiveness. If the effective value of the interception-blocking coordination is greater than the preset upper limit, no interception-blocking coordination effectiveness optimization is performed. If the effective value of the interception-blocking coordination is within the preset interception-blocking coordination effective range, determine whether to dynamically optimize the retry interval timeout based on the thread response latency. If so, determine whether to dynamically optimize the interception status synchronization time threshold after dynamically optimizing the retry interval timeout; otherwise, directly determine whether to dynamically optimize the interception status synchronization time threshold. If the effective value of the interception-blocking coordination is less than the preset lower limit, issue an alarm to the preset personnel.

[0078] It should be noted that, as Figure 3 The diagram shown is a flowchart of the dynamic optimization process for the retry interval timeout of the real-time data leakage blocking system based on deep packet inspection provided in this application embodiment. The specific logic is as follows: Based on the thread response latency, it is determined whether to dynamically optimize the retry interval timeout. If the thread response latency is greater than the preset upper limit of thread response latency, a latency warning is issued to preset personnel. If the thread response latency is within the preset standard range of thread response latency, the retry interval timeout is increased by averaging the interception-blocking collaborative effective value and the thread response latency, thus extending the retry interval timeout interval. If the thread response latency is less than the preset lower limit of thread response latency, the retry interval timeout is decreased by averaging the interception-blocking collaborative effective value and the response latency correction amount, thus shortening the retry interval timeout interval.

[0079] As a further explanation, the specific process for dynamically optimizing the retry interval timeout based on thread response latency is as follows:

[0080] Among them, the retry interval timeout time represents the waiting time after the SDK pushes the interception status message to the DPI and does not receive confirmation of receipt from the DPI, triggering message retransmission. The thread response latency refers to the time difference between the Hook callback thread receiving the sensitive behavior trigger and the time when the sensitive behavior is successfully intercepted.

[0081] If the thread response delay exceeds the preset thread response delay limit, it indicates that there are deficiencies in the system in terms of resource configuration and thread scheduling strategy, and a delay warning will be issued to the preset personnel.

[0082] If the thread response latency is within the preset standard range, the current load is considered manageable, but there is still room for optimization. The retry interval timeout adjustment is then calculated by arithmetically averaging the effective value of the intercept-blocking coordination and the thread response latency. Extending the retry interval means that threads can release CPU resources during the waiting period to process other tasks. This is particularly important for multi-core systems, as it improves overall CPU utilization and avoids resource waste caused by frequent retries. The retry interval timeout adjustment is added to the retry interval timeout threshold to extend the next retry interval timeout. By dynamically extending the retry interval, the system can automatically adjust its processing rhythm without triggering warnings, preventing system crashes caused by excessive instantaneous load. The preset standard range for thread response latency represents the closed interval formed by the preset lower and upper limits of thread response latency.

[0083] If the thread response latency is less than the preset lower limit of thread response latency, it indicates that the system load is extremely low and the processing capacity is sufficient. The retry interval timeout reduction amount is obtained by arithmetically averaging the effective value of the intercept-blocking collaboration and the response latency correction amount. Shortening the retry interval allows failed requests to be retried more quickly, reducing user waiting time. In low-latency conditions, the system reduces the waiting time of the retry interval, allowing threads to be re-engaged in task processing more quickly and avoiding CPU resource idleness. The retry interval timeout threshold is subtracted from the retry interval timeout reduction amount to shorten the next retry interval timeout. This is especially important for compute-intensive applications, as it can significantly improve throughput. Fast retries reduce the waiting time of requests in the queue, reduce the accumulation of pending tasks in memory, and thus reduce memory usage. The response latency correction amount represents the difference between the preset lower limit of thread response latency and the thread response latency.

[0084] In this embodiment, the dynamic thread response latency adjustment mechanism achieves fine-grained management and adaptive optimization of system resources through a three-level threshold strategy. The early warning mechanism promptly triggers manual intervention, quickly locating and resolving deep-seated issues such as thread blocking and resource contention, preventing continuous performance degradation that could lead to system crashes. Utilizing thread waiting time to release CPU resources for other tasks avoids resource waste caused by frequent retries and enhances the system's resilience to sudden traffic surges by smoothly adjusting the cadence. The system automatically shortens the retry interval, accelerating the retry speed of failed requests, fully utilizing idle CPU resources to increase throughput, while reducing task queue backlog and memory usage, achieving extreme performance optimization under low load. This mechanism, by dynamically balancing response speed and resource utilization, keeps the system in optimal operating condition across the entire load range, making it particularly suitable for scenarios with high concurrency and low latency requirements.

[0085] As a further explanation, the specific steps for determining whether to perform dynamic optimization of the interception state synchronization time threshold are as follows:

[0086] Among them, the sensitive behavior interception time refers to the total time from the time the sensitive behavior is detected to the time when the SDK completes the generation of the interception result for the behavior, and the interception status synchronization time refers to the total time from the time when the SDK generates the interception result (such as successful interception) to the time when it transmits the status information to the DPI and receives the confirmation feedback from the DPI.

[0087] If the sensitive behavior interception time exceeds the preset sensitive behavior interception time limit, it means that the actual time consumed by the system in processing the sensitive behavior interception exceeds the preset reasonable threshold. In this case, the interception status synchronization time adjustment amount is obtained by harmonic averaging the effective value of interception-blocking coordination and the interception time compensation amount. Extending the synchronization cycle can reduce the missed detection caused by the system being busy. The interception status synchronization time adjustment amount is added to the interception status synchronization time limit threshold as the next interception status synchronization time limit threshold, allowing more time for in-depth analysis and blocking operations, avoiding incomplete interception due to time constraints. The interception time compensation amount represents the difference between the sensitive behavior interception time and the preset sensitive behavior interception time limit.

[0088] If the sensitive behavior interception time is within the preset sensitive behavior interception time standard range, it means that the system's interception and processing of sensitive behaviors is in the expected normal state. Therefore, no dynamic optimization of the interception status synchronization time threshold is performed. The preset sensitive behavior interception time standard range represents the closed interval formed by the preset lower limit of the sensitive behavior interception time and the preset upper limit of the sensitive behavior interception time.

[0089] If the sensitive behavior interception time is less than the preset lower limit for sensitive behavior interception time, it means that the system's interception and processing speed for sensitive behavior exceeds expectations. In this case, the interception state synchronization time reduction is obtained by harmonic averaging the effective value of the interception-blocking collaboration and the interception time correction amount. The lower limit threshold for interception state synchronization time is then subtracted from the lower limit threshold for interception state synchronization time to obtain the next lower limit threshold for interception state synchronization time. Shortening the lower limit for interception state synchronization time means that the system can perform state synchronization more frequently. With high interception efficiency, increasing the synchronization frequency allows interception results (such as newly added blacklist rules and attack signature databases) to be promptly disseminated to various nodes, avoiding resource idleness. The interception time correction amount represents the difference between the preset lower limit for sensitive behavior interception time and the sensitive behavior interception time.

[0090] In this embodiment, a dynamic adjustment mechanism for sensitive behavior interception time, employing a three-level threshold response strategy, achieves a precise balance between security protection effectiveness and system resource efficiency. This provides ample time for in-depth analysis and complete blocking of sensitive behaviors, reducing missed detections or incomplete interception due to rushed processing. Furthermore, smooth adjustments prevent excessive resource consumption, ensuring the system maintains an optimal balance between security protection stability and resource utilization. It meets normal operation requirements without additional adjustments. By increasing the state synchronization frequency, interception results (such as blacklist rules and attack signature database updates) are rapidly disseminated, fully utilizing idle resources to enhance network-wide collaborative defense capabilities and avoiding the risk of lagging protection strategies due to overly rapid processing. This mechanism comprehensively covers system operation scenarios under different loads and threat intensities. By dynamically adapting the interception state synchronization time threshold, it strengthens the interception depth of complex sensitive behaviors while ensuring protection response speed under low load. Simultaneously, it optimizes resource allocation, achieving a dynamic balance between efficiency, reliability, and economy in the security protection system, providing adaptive, multi-layered security assurance.

[0091] Overall, the SDK and DPI collaboration mechanism comprehensively addresses core issues in sensitive behavior interception, such as duplicate blocking, missing information, and policy conflicts, through multi-layered synchronization strategies and dynamic adaptation logic. This significantly improves the system's security protection effectiveness and resource utilization efficiency. At the interception result synchronization level, the SDK proactively pushes `interceptState` (interception state) messages within a preset time and employs a retry mechanism with a preset countdown time (preset number of retries) to ensure that the DPI is promptly informed of the interception status. This avoids resource waste caused by network fluctuations, where "SDK successfully intercepts but DPI still blocks." For example, after the SDK successfully intercepts a contact permission request, the DPI can immediately cancel the blocking of the corresponding network request, reducing CPU parsing overhead. The DPI, by querying the SDK's interception records within a preset time and pushing `blockState` (blocking state) messages in real time after executing its own blocking, prompts the SDK to record missed detection features to optimize rules, resolving the issue of "SDK interception failing but DPI not filling in the gaps." The collaborative decision-making mechanism dynamically allocates responsibilities based on risk levels. High-risk behaviors employ a double-confirmation mechanism to ensure reliable interception, while medium- and low-risk behaviors reduce DPI resource consumption through division of labor and cooperation. Simultaneously, both parties achieve elastic scheduling based on their own resource consumption (e.g., lowering priority when DPI CPU utilization exceeds a preset threshold, simplifying message fields when SDK memory exceeds a preset threshold). Ultimately, this mechanism can control the duplicate blocking rate within a preset ideal state, reduce the missed blocking rate and state synchronization delay, achieving a highly efficient balance between security protection and system performance.

[0092] The above are merely specific embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A deep packet inspection based data breach real-time blocking system, characterized in that, The application comprises a data integrity parameter quantification module, a data acquisition-transmission integrity optimization module, a collaborative effectiveness parameter quantification module, and an interception-blockade collaborative effectiveness optimization module. The data integrity parameter quantification module is configured to obtain data integrity parameters in the front-end data acquisition and transmission link to quantify the integrity of the data acquisition and transmission process, and obtain an integrity quantification result. The data acquisition-transmission integrity optimization module is configured to determine whether to perform data acquisition-transmission integrity optimization according to the integrity quantification result. The collaborative effectiveness parameter quantification module is configured to obtain collaborative effectiveness parameters in the interception and blockade collaboration link to quantify the effectiveness of the application layer interception and network layer blockade collaboration, and obtain an effectiveness quantification result. The interception-blockade collaborative effectiveness optimization module is configured to determine whether to perform interception-blockade collaborative effectiveness optimization according to the effectiveness quantification result. The data integrity parameter quantification module comprises a data integrity parameter acquisition unit, a data integrity threshold and influence factor storage unit, and a data integrity parameter quantification unit. The data integrity parameter acquisition unit is configured to obtain data integrity parameters, specifically including Hook callback delay, sensitive behavior record data timestamp offset, and sensitive behavior record data upload rate. The data integrity threshold and influence factor storage unit is configured to obtain data integrity thresholds and data integrity influence factors corresponding to the data integrity parameters from the constructed real-time blocking database, specifically including Hook callback delay threshold, sensitive behavior record data timestamp offset threshold, sensitive behavior record data upload rate threshold, Hook callback delay influence factor, sensitive behavior record data timestamp offset influence factor, and sensitive behavior record data upload rate influence factor.

2. The deep packet inspection based data breach real-time blocking system of claim 1, wherein, The data integrity parameter quantification unit is configured to correct the proportion analysis result of the Hook callback delay threshold and the Hook callback delay by a Hook callback delay influence factor to obtain a first integrity value, correct the proportion analysis result of the sensitive behavior record data timestamp offset threshold and the sensitive behavior record data timestamp offset by a sensitive behavior record data timestamp offset influence factor to obtain a second integrity value, and correct the proportion analysis result of the sensitive behavior record data upload rate and the sensitive behavior record data upload rate threshold by a sensitive behavior record data upload rate influence factor to obtain a third integrity value, and couple the first integrity value, the second integrity value and the third integrity value to obtain a data collection-transmission integrity value.

3. The deep packet inspection based data breach real-time blocking system of claim 1, wherein, The specific determination step of determining whether to perform data collection-transmission integrity optimization according to the integrity quantification result is as follows: obtaining a preset data collection-transmission integrity threshold from the constructed real-time blocking database; if the data collection-transmission integrity value is greater than or equal to the preset data collection-transmission integrity threshold, no data collection-transmission integrity optimization is performed; if the data collection-transmission integrity value is not greater than the preset data collection-transmission integrity threshold, whether to perform dynamic frame extraction optimization is determined by the interface change rate, if yes, whether to perform thread pool core thread number optimization is determined after dynamic frame extraction optimization, otherwise, whether to perform thread pool core thread number optimization is directly determined.

4. The deep packet inspection based data breach real-time blocking system of claim 3, wherein, The specific process of determining whether to perform dynamic frame extraction optimization by the interface change rate is as follows: if the interface change rate is greater than a preset upper limit of the interface change rate, an arithmetic average of a data collection-transmission integrity deviation amount and a change rate increase amount is performed to obtain a frame extraction frequency increase amount, and the frame extraction frequency increase amount is superimposed on a frame extraction frequency threshold to increase the frame extraction frequency in the next time, the data collection-transmission integrity deviation amount is used to reflect the deviation degree of the preset data collection-transmission integrity threshold and the data collection-transmission integrity value, and the change rate increase amount is used to reflect the deviation degree of the interface change rate and the preset upper limit of the interface change rate; if the interface change rate is within a preset interface change rate standard interval, the current frame extraction frequency is maintained, and no dynamic frame extraction optimization is performed, the preset interface change rate standard interval represents a closed interval formed by a preset lower limit of the interface change rate and the preset upper limit of the interface change rate; if the interface change rate is less than the preset lower limit of the interface change rate, an arithmetic average of the data collection-transmission integrity deviation amount and a change rate correction amount is performed to obtain a frame extraction frequency decrease amount, and the frame extraction frequency threshold is subtracted by the frame extraction frequency decrease amount to reduce the frame extraction frequency in the next time, and the change rate correction amount is used to reflect the deviation degree of the preset lower limit of the interface change rate and the interface change rate.

5. The deep packet inspection based data breach real-time blocking system of claim 3, wherein, The specific steps of determining whether to perform thread pool core thread number optimization are as follows: If the average number of Hook callbacks is greater than the preset upper limit of the average number of Hook callbacks, a result of rounding up after harmonic mean of the data collection-transmission complete deviation and average number compensation is taken as an up adjustment amount of the thread pool core thread number, and the thread pool core thread number of the next time is adjusted, and the average number compensation is used to reflect the deviation degree of the average number of Hook callbacks from the preset upper limit of the average number of Hook callbacks; If the average number of Hook callbacks is within the preset average number of Hook callback standard interval, the current thread pool core thread number is maintained, and the thread pool core thread number is not optimized, and the average number of Hook callback standard interval represents a closed interval formed by the preset lower limit of the average number of Hook callbacks and the preset upper limit of the average number of Hook callbacks; If the average number of Hook callbacks is less than the preset lower limit of the average number of Hook callbacks, a result of rounding down after harmonic mean of the data collection-transmission complete deviation and average number correction is taken as a down adjustment amount of the thread pool core thread number, and the thread pool core thread number of the next time is adjusted, and the average number correction is used to reflect the deviation degree of the preset lower limit of the average number of Hook callbacks from the average number of Hook callbacks.

6. The deep packet inspection based data breach real-time blocking system of claim 1, wherein, The cooperative effectiveness parameter quantification module comprises a cooperative effectiveness parameter acquisition unit, a cooperative effectiveness threshold and influence factor storage unit, and a cooperative effectiveness quantification unit; The cooperative effectiveness parameter acquisition unit is configured to acquire the cooperative effectiveness parameter, and specifically comprises the interception state synchronization delay and the bit filling response time, and simultaneously acquires the data collection-transmission complete value; The cooperative effectiveness threshold and influence factor storage unit is configured to acquire the cooperative effectiveness threshold and the cooperative effectiveness influence factor corresponding to the cooperative effectiveness parameter from the constructed real-time blocking database, and specifically comprises the data collection-transmission integrity threshold, the interception state synchronization delay threshold, the bit filling response time threshold, the data collection-transmission integrity influence factor, the interception state synchronization delay influence factor, and the bit filling response time influence factor; The cooperative effectiveness quantification unit is configured to couple the proportion analysis result of the cooperative effectiveness threshold and the cooperative effectiveness parameter after correction by the cooperative effectiveness influence factor to obtain a first effective value, correct the proportion analysis result of the data collection-transmission complete value and the data collection-transmission integrity threshold by the data collection-transmission integrity influence factor to obtain a second effective value, and couple the first effective value and the second effective value to obtain the interception-blocking cooperative effective value.

7. The deep packet inspection based data breach real-time blocking system of claim 1, wherein, The specific steps of determining whether to perform the interception-blocking cooperative effectiveness optimization according to the effectiveness quantification result are as follows: A preset interception-blocking cooperative effective interval is acquired from the constructed real-time blocking database, and the preset interception-blocking cooperative effective interval represents a closed interval formed by the preset interception-blocking cooperative effective lower limit and the preset interception-blocking cooperative effective upper limit; If the interception-blocking cooperative effective value is greater than the preset interception-blocking cooperative effective upper limit, the interception-blocking cooperative effectiveness optimization is not performed; and If the interception-blocking cooperative effective value is less than the preset interception-blocking cooperative effective lower limit, the interception-blocking cooperative effectiveness optimization is performed. If the interception-block synergy effective value is within the preset interception-block synergy effective interval, whether to perform retry interval timeout time dynamic optimization is determined according to thread response delay, if yes, whether to perform interception state synchronization time threshold dynamic optimization is determined after the retry interval timeout time dynamic optimization, otherwise, whether to perform interception state synchronization time threshold dynamic optimization is directly determined; If the interception-block synergy effective value is less than the preset interception-block synergy effective lower limit, an alarm prompt is sent to the preset personnel.

8. The Deep Packet Inspection based data breach real-time blocking system of claim 7, wherein, The specific process of determining whether to perform retry interval timeout time dynamic optimization according to thread response delay is as follows: If the thread response delay is greater than the preset thread response delay upper limit, a delay warning prompt is sent to the preset personnel; If the thread response delay is within the preset thread response delay standard interval, the retry interval timeout time upper limit is obtained by arithmetically averaging the interception-block synergy effective value and the thread response delay, the retry interval timeout time upper limit is superimposed on the retry interval timeout time threshold to extend the next retry interval timeout time, and the preset thread response delay standard interval represents a closed interval formed by the preset thread response delay lower limit and the preset thread response delay upper limit; If the thread response delay is less than the preset thread response delay lower limit, the retry interval timeout time lower limit is obtained by arithmetically averaging the interception-block synergy effective value and the response delay correction amount, and the retry interval timeout time threshold is subtracted by the retry interval timeout time lower limit to shorten the next retry interval timeout time, and the response delay correction amount is used to reflect the deviation degree of the preset thread response delay lower limit and the thread response delay.

9. The Deep Packet Inspection based data breach real-time blocking system of claim 7, wherein, The specific steps of determining whether to perform interception state synchronization time threshold dynamic optimization are as follows: If the sensitive behavior interception time is greater than the preset sensitive behavior interception time upper limit, the interception state synchronization time upper limit is obtained by harmonic averaging the interception-block synergy effective value and the interception time compensation amount, the interception state synchronization time upper limit is superimposed on the interception state synchronization time upper limit threshold to be the next interception state synchronization time upper limit threshold, and the interception time compensation amount is used to reflect the deviation degree of the sensitive behavior interception time and the preset sensitive behavior interception time upper limit; If the sensitive behavior interception time is within the preset sensitive behavior interception time standard interval, the interception state synchronization time threshold dynamic optimization is not performed, and the preset sensitive behavior interception time standard interval represents a closed interval formed by the preset sensitive behavior interception time lower limit and the preset sensitive behavior interception time upper limit; If the sensitive behavior interception time is less than the preset sensitive behavior interception time lower limit, the interception state synchronization time lower limit is obtained by harmonic averaging the interception-block synergy effective value and the interception time correction amount, and the interception state synchronization time lower limit is subtracted by the interception state synchronization time lower limit to be the next interception state synchronization time lower limit threshold, and the interception time correction amount is used to reflect the deviation degree of the preset sensitive behavior interception time lower limit and the sensitive behavior interception time.

Images