Ai-driven transport layer security protocol adaptive optimization system

Abstract

This invention discloses an AI-driven adaptive optimization system for transport layer security protocols, relating to the field of traffic data access technology. It includes a data access module, a state awareness module, a risk assessment module, an optimized transmission module, and an adaptive encryption module. The data access module is used to capture raw data streams from the network and hosts in real time. The state awareness module is used to receive the raw data streams and set feature-engineered state indicators. The risk assessment module is used to quantitatively assess the current state security score based on the current traffic environment state. The adaptive encryption module is used to construct a cryptographic policy library and generate encryption configuration policies based on the current traffic state. The optimized transmission module is used to construct a parameter intelligent optimization model and control algorithm interaction to generate performance scheduling optimization actions.

Description

Technical Field

[0001] This invention relates to the field of traffic data access technology, and in particular to an AI-driven adaptive optimization system for transport layer security protocols. Background Technology

[0002] As AI applications evolve towards edge and cloud-based collaboration, and with the increasing prevalence of remote work and multi-branch collaboration, data transmission for AI applications faces complex network environment challenges. Traditional security architectures struggle to adapt to dynamically changing access locations and diverse network links, resulting in a trade-off between security protection and transmission efficiency. While the SASE architecture integrates network access and security services, it still lacks a targeted dynamic adjustment mechanism to meet the high-bandwidth, low-latency data transmission requirements unique to AI applications. Currently, if real-time transmission of AI training data focuses solely on security encryption while neglecting transmission path optimization, excessive latency can negatively impact training effectiveness; conversely, simply pursuing transmission speed may sacrifice security, leading to data leaks. Therefore, a system that can achieve coordinated security and transmission optimization tailored to the characteristics of AI applications is urgently needed. Summary of the Invention

[0003] The technical problem solved by this invention is that real-time transmission focuses only on security encryption while neglecting transmission path optimization, resulting in excessive latency that affects training results. On the other hand, increasing transmission speed may sacrifice security and cause data leakage.

[0004] To solve the above-mentioned technical problems, the present invention provides the following technical solution:

[0005] The AI-driven adaptive optimization system for transport layer security protocols includes a data access module, a state awareness module, a risk assessment module, an optimized transmission module, and an adaptive encryption module.

[0006] The data access module is used to capture raw data streams from the network and host in real time;

[0007] The state awareness module is used to receive the raw data stream and set feature engineering state indicators;

[0008] The risk assessment module is used to quantitatively assess the current security score based on the current traffic environment status.

[0009] The adaptive encryption module is used to build a cryptographic policy library and generate encryption configuration policies based on the current traffic status.

[0010] The optimized transmission module is used to construct a parameter intelligent optimization model and control the algorithm interaction to generate performance scheduling optimization actions.

[0011] Preferably, the data access module includes a data sensing unit and a data classification unit:

[0012] The data sensing unit includes:

[0013] The system captures raw data packets at high speed in user space and performs early preprocessing on the raw data packets based on the underlying logic. It collects raw data packets from multiple dimensions according to the running timestamp and saves them to a high-speed memory buffer area. It sets a first predetermined rule and performs encoding, compression and serialization operations on the raw data packets.

[0014] The first predetermined rule is used to unify the serialization protocol according to the size of the original data stream and select a portion of the original data stream as a data association key. The data association key is used by the downstream system for data association, data fusion and data classification.

[0015] Preferably, the data classification unit includes:

[0016] An internal streaming aggregator is set up to classify the raw data packets, generate raw data streams, and transmit them to a message queue. The raw data streams include a first data stream, a second data stream, a third data stream, and a fourth data stream. The first data stream includes RTT, jitter, packet loss rate, and bandwidth. The second data stream includes TLS handshake time, key exchange time, and cipher suites. The third data stream includes CPU utilization, user-mode CPU cycles, memory-mode CPU cycles, and TLS version. The fourth data stream includes application identifier, API request endpoint, content type, and business request ID.

[0017] The internal streaming aggregator is used to continuously receive different raw data packets, and the access end sets a discrimination mechanism to distribute the raw data packets to multiple processing threads to obtain the raw data stream;

[0018] The first data stream is used to quantify the underlying health status of the network;

[0019] The second data stream is used to record the current protocol's internal state information;

[0020] The third data stream is used to obtain information related to the current host resource consumption and memory.

[0021] The fourth data stream is used to obtain decision context information through API calls.

[0022] Preferably, the state sensing module includes:

[0023] The system continuously receives the raw data stream from the message queue, sets a time window, aligns the raw data streams sent within a unit of time according to the timestamp of the first sample data, and then associates the sample data belonging to the same connection according to the data association key of the raw data stream to generate a state connection table.

[0024] Samples with the same timestamp in the status connection table are extracted and aggregated for feature statistics to obtain feature engineering status indicators, which include a first indicator, a second indicator and a third indicator.

[0025] The statistical method for the first indicator is to calculate the average RTT, standard deviation, average movement speed, and average packet loss rate within a unit time window, generate n rows of indicator values, and save them as the first indicator according to the timestamp.

[0026] The statistical method for the second indicator is to calculate the quantile value of the handshake time, count the number of times different cipher suites are used per unit time, and save them as the second indicator.

[0027] The statistical method for the third indicator is to calculate the average movement speed of CPU utilization and save it as the third indicator.

[0028] Preferably, the risk assessment module includes a feature derivation unit, a state vector unit, and a risk assessment unit;

[0029] The feature derivation unit includes:

[0030] The average RTT, average packet loss rate, and jitter of the feature engineering state indicators are extracted as network state combinations. The network state combinations are then classified to generate network state ratings.

[0031] When the network state combination is within the first threshold range, the current network state is set to excellent;

[0032] When the network state combination is within the second threshold range, the current network state is set to good;

[0033] When the network state combination is within the third threshold range, the current network state is set to normal.

[0034] When the network state combination falls within the fourth threshold range, the current network state is set to poor.

[0035] The first threshold range is less than the second threshold range, less than the third threshold range, and less than the fourth threshold range.

[0036] Preferably, the state vector unit includes:

[0037] The network state rating is quantified by z-score standardization of the feature engineering state index. The quantified network state rating is mapped one-to-one with the standardized feature engineering state index to obtain a state combination vector. The state combination vector is then associated with the state connection table using the same timestamp information.

[0038] Preferably, the risk assessment unit includes:

[0039] An anomaly detection engine is constructed to perform numerical anomaly detection and behavioral sequence anomaly detection on the state combination vector. The numerical anomaly detection is used to perform interval mapping of the feature-engineered state indicators in the state combination vector using the sigmoid function to obtain an anomaly score.

[0040] The behavior sequence anomaly detection is used to set anomaly matching logic. Based on the cipher suites in the state connection table, the risk level of the sample is obtained. The risk level of the sample includes high risk, medium risk, and low risk. If the order of appearance of the cipher suites is found to be incorrect, the current sample in the state connection table is marked as high risk. If the cipher suites have configuration errors or are marked by malicious clients, the current sample is marked as medium risk. If duplicates are found in the cipher suites, the current sample is marked as low risk.

[0041] The risk level of the sample is quantified, and a basic risk score is assigned based on experience. The abnormal score and the basic risk score are superimposed to calculate a dynamic abnormal score. If multiple abnormal matching logic rules are triggered at the same time, the average of the sum of the products of the basic risk score and the abnormal score is calculated to obtain the current state safety score.

[0042] Preferably, the adaptive encryption module includes:

[0043] The current security score is numerically classified to obtain a first score, a second score, and a third score. The first score is processed using a first encryption strategy, the second score is processed using a second encryption strategy, and the third score is processed using a third encryption strategy, wherein the first score < the second score < the third score.

[0044] The first encryption strategy is used to invoke the performance-first mode, which uses the TLS-RTT protocol to fragment the data stream corresponding to the first score, thereby accelerating the connection between the user terminal and the backend data.

[0045] The second encryption strategy is used to invoke defense functions, filter cipher suites, temporarily disable the TLS-RTT protocol, strengthen the signature algorithm, and prioritize recording detailed handshake information of the current connection;

[0046] The third encryption strategy is used to invoke the security protection mode, restrict the current cipher suite, and force the use of the highest protocol.

[0047] Preferably, the optimized transmission module includes a model building unit and an algorithm interaction unit:

[0048] The model building unit includes:

[0049] A parameter intelligent optimization model is constructed, which receives abstract instructions from the AI ​​decision engine. The instruction parser of the parameter intelligent optimization model extracts the optimization target and intensity of the abstract instructions. Based on the optimization target, the network subdomains are dynamically adjusted to obtain the corresponding mapping relationship and a model knowledge base is constructed. The model knowledge base is called to dynamically select the adjustable parameters of each network subdomain and adjust the subdomain buffer size according to the current real-time network state.

[0050] Preferably, the algorithm interaction unit includes:

[0051] Based on the abstract instructions of the AI ​​decision engine, the parameter intelligent optimization model is used to convert the abstract instructions into specific parameter values. The specific parameters are then applied through the configuration interface to adjust the network protocol environment and generate a new network state. The AI ​​decision engine observes the new network state, calculates the interpolation between the old and new network states, sets a reward function, and updates the parameter intelligent optimization model.

[0052] The beneficial effects of this invention are as follows: It utilizes the network stack and host application layer to capture raw data streams in real time, completing initial clarification and classification. The state awareness module receives multi-dimensional data and constructs a comprehensive state vector through feature engineering, quantifying indicators such as network health, internal protocol state, and business context. The risk assessment module performs dynamic threat analysis based on this state vector, generating a quantitative security score by combining abnormal behavior detection and external intelligence. The system's core adaptive capability is reflected in the coordinated response of the encryption and transmission modules. The adaptive encryption module has a built-in hierarchical cryptographic policy library, dynamically selecting encryption suites and parameters based on the security score. In low-risk scenarios, performance-oriented algorithms are prioritized, while in high-risk scenarios, the highest security configuration is forcibly enabled, even involving application layer verification. The optimized transmission module constructs an intelligent parameter optimization model, translating AI decisions into concrete actions. It calculates the optimal protocol stack parameters using rule-based or lightweight ML models and implements resource scheduling based on the security score, limiting bandwidth and introducing latency for high-risk connections to suppress attack efficiency. Attached Figure Description

[0053] Figure 1 This is a basic flowchart of an AI-driven adaptive optimization system for transport layer security protocols provided in one embodiment of the present invention. Detailed Implementation

[0054] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0055] Example, refer to Figure 1It provides an AI-driven adaptive optimization system for transport layer security protocols, including a data access module, a state awareness module, a risk assessment module, an optimized transmission module, and an adaptive encryption module.

[0056] The data access module is used to capture raw data streams from the network and host in real time;

[0057] The state awareness module is used to receive the raw data stream and set the feature engineering state indicators;

[0058] The risk assessment module is used to quantitatively assess the current security score based on the current traffic environment status.

[0059] The adaptive encryption module is used to build a cryptographic policy library and generate encryption configuration policies based on the current traffic status.

[0060] The optimized transmission module is used to build an intelligent parameter optimization model and control the interaction of algorithms to generate performance scheduling optimization actions.

[0061] This embodiment first utilizes the network stack and host application layer to capture raw data streams in real time, and performs preliminary clarification and classification. After receiving multi-dimensional data, the state awareness module constructs a comprehensive state vector through feature engineering, quantifying indicators such as network health, internal protocol state, and business context. The risk assessment module performs dynamic threat analysis based on this state vector, and generates a quantitative security score by combining abnormal behavior detection and external intelligence. The core adaptive capability of the system is reflected in the coordinated response of the encryption and transmission modules. The adaptive encryption module has a built-in hierarchical cryptographic policy library, which dynamically selects encryption suites and parameters according to the security score. In low-risk scenarios, performance-oriented algorithms are prioritized, while in high-risk scenarios, the highest security configuration is forcibly enabled, and even application layer verification is linked. The optimized transmission module constructs a parameter intelligent optimization model, converting AI decisions into specific actions. It calculates the optimal protocol stack parameters (such as buffer size and congestion algorithms) through rule-based or lightweight ML models, and implements resource scheduling according to the security score. It limits bandwidth and introduces latency for high-risk connections to suppress attack efficiency.

[0062] The data access module includes a data sensing unit and a data classification unit.

[0063] The data sensing unit includes:

[0064] The system captures raw data packets at high speed in user space and performs early preprocessing on the raw data packets based on the underlying logic. It collects raw data packets from multiple dimensions according to the runtime timestamp and saves them to a high-speed memory buffer area. It sets the first predetermined rule and performs encoding, compression and serialization operations on the raw data packets.

[0065] The first predetermined rule is used to unify the serialization protocol based on the size of the original data stream and select a portion of the original data stream as the data association key. The data association key is used by the downstream system for data association, data fusion and data classification.

[0066] Using DPDK as the core data development tool, data packets can be processed directly in user space or early in the kernel driver layer. Preprocessing is performed at the earliest possible moment when the data packet arrives, using a timestamp counter such as the CPU's TSC to mark the received timestamp. A hash value is calculated based on the five-tuple of the data packet: source IP, destination IP, source port, destination port, and transport layer protocol, which serves as a temporary identifier flow_id for the connection to which the data packet belongs. Ethernet, IP, and TCP / UDP headers are parsed to extract key fields (such as protocol type, packet length, TCP flags, TTL, etc.). The record layer header of the TLS packet is deeply parsed to extract information such as handshake type and version. After the above processing, the original data packet is transformed into a structured data stream with key metadata such as timestamp and flow_id and is written to a designated area of ​​a high-speed memory buffer.

[0067] The first predetermined rule is triggered when the data in the circular buffer accumulates to a certain amount or reaches a time window (such as 100 milliseconds).

[0068] Data classification units include:

[0069] An internal streaming aggregator is set up to classify raw data packets, generate raw data streams, and transmit them to a message queue. The raw data streams include a first data stream, a second data stream, a third data stream, and a fourth data stream. The first data stream includes RTT, jitter, packet loss rate, and bandwidth. The second data stream includes TLS handshake time, key exchange time, and cipher suites. The third data stream includes CPU utilization, user-space CPU cycles, memory-space CPU cycles, and TLS version. The fourth data stream includes application identifier, API request endpoint, content type, and business request ID.

[0070] An internal streaming aggregator is used to continuously receive different raw data packets. The access end sets up a discrimination mechanism to distribute the raw data packets to multiple processing worker threads to obtain the raw data stream.

[0071] The first data stream is used to quantify the underlying health status of the network.

[0072] The second data stream is used to record the current internal state information of the protocol;

[0073] The third data stream is used to obtain information related to the current host resource consumption and memory.

[0074] The fourth data stream is used for decision context information obtained through API calls.

[0075] The access end is equipped with a flow-based dispatcher. This dispatcher calculates the flow_id hash value of each data entry, and then applies a consistent hashing algorithm or a simple modulo operation to ensure that all data packets of the same flow are always distributed to the same background worker thread for processing. Data packets of the same connection are processed by one thread, avoiding the out-of-order data packet problem caused by concurrent processing. Each worker thread independently processes its own set of flows, and there is no need for threads to share state (such as statistics for each connection), thus completely eliminating lock contention.

[0076] The first data stream calculates the RTT (Round-Trip Time) by matching sequence numbers and acknowledgment numbers. After calculating multiple RTTs consecutively, the variance can be calculated to obtain jitter. Packet loss rate is statistically analyzed by checking for duplicate ACKs or directly retransmitted packets. Bandwidth is estimated by counting the number of bytes successfully received per unit time.

[0077] The second data stream records the arrival timestamp of each handshake message, subtracts the ClientHello timestamp from the ServerHello timestamp to obtain the server processing time, extracts the negotiated cipher suite from the handshake message, and obtains the key exchange time by calculating the time difference before and after the execution of the key exchange algorithm.

[0078] The third data stream receives execution events from TLS library functions, which carry CPU cycle count, call time, and amount of data processed, and periodically outputs a message containing metrics such as total CPU consumption and memory usage for the connection.

[0079] The fourth data stream extracts the X-Request-ID from the HTTP header as the business request ID, obtains the content type from the Content-Type header, parses the API request endpoint from the URL path, and determines the application identifier (such as video-streamer) based on the configured mapping table.

[0080] The state awareness module includes:

[0081] The system continuously receives raw data streams from the message queue and sets a time window. It aligns the raw data streams sent within a unit of time according to the timestamp of the first sample data. Then, it associates sample data belonging to the same connection according to the data association key of the raw data stream to generate a state connection table.

[0082] Samples with the same timestamp in the state connection table are extracted and aggregated for feature statistics to obtain feature engineering state indicators. The feature engineering state indicators include the first indicator, the second indicator, and the third indicator.

[0083] The statistical method for the first indicator is to calculate the average RTT, standard deviation, average movement speed, and average packet loss rate within a unit time window, generate n rows of indicator values, and save them as the first indicator according to the timestamp.

[0084] The statistical method for the second indicator is to calculate the quantile value of the handshake time, count the number of times different cipher suites are used per unit time, and save them as the second indicator.

[0085] The statistical method for the third indicator is to calculate the average movement speed of CPU utilization and save it as the third indicator.

[0086] A fixed scrolling time window `window_size` is set to 1 second. When any data stream reads the first piece of data, its timestamp `t0` is used as the starting point of the first time window. All subsequent data are divided into corresponding windows based on their timestamps, with each window ranging from [t0 + n × window_size, t0 + (n + 1) × window_size]. At the end of each time window, i.e., when the first piece of data belonging to the next window is received, processing of all data within that window is triggered. Afterwards, an empty state connection table is created for each time window. This table's structure in memory can be viewed as a dictionary. The key is flow_id. During the duration of the window, data entries from the four data streams are aggregated into the corresponding row in the state connection table according to their data association key (flow_id). At the end of the window, each row in the state connection table represents a multi-dimensional state of a connection within that time window. Feature calculations are performed on each row (i.e., each connection) in the state connection table. The RTT average moving speed is not calculated directly, but rather the difference between the RTT average value and the RTT average value of the previous time window is calculated to characterize the RTT trend. A tuple of four values ​​is generated as the first indicator of the connection in that window.

[0087] Extract all TLS handshake time samples of the connection in a recent period (e.g., the past 5 windows), calculate the 50th quartile (median) and 95th quartile of the sample set, count the number of times the connection uses each cipher suite in the current window, and generate a second indicator;

[0088] Based on the array of CPU utilization sample values ​​within this window, similar to RTT, the difference between the CPU average value and the previous time window is calculated to represent the trend of CPU load change, thus generating a third indicator.

[0089] The risk assessment module includes a feature derivation unit, a state vector unit, and a risk assessment unit.

[0090] Feature-derived units include:

[0091] The average RTT, average packet loss rate, and jitter of the feature engineering state indicators are extracted as network state combinations. The network state combinations are then classified to generate network state ratings.

[0092] When the network status combination is within the first threshold range, the current network status is set to excellent;

[0093] When the network status combination is within the second threshold range, the current network status is set to good;

[0094] When the network state combination is within the third threshold range, the current network state is set to normal.

[0095] When the network state combination is within the fourth threshold range, the current network state is set to poor.

[0096] The first threshold range is less than the second threshold range, which is less than the third threshold range, which is less than the fourth threshold range.

[0097] The feature engineering state indicators received from the state awareness module, namely the average RTT (milliseconds), the average packet loss rate (percentage), and the jitter (milliseconds), are first ensured to be within a reasonable range (e.g., the packet loss rate is not negative), and extreme outliers are smoothed or truncated to prevent them from interfering with the classification results. The threshold range is precisely divided according to the state threshold table.

[0098] The state threshold table is as follows:

[0099] Experience rating RTT average Shaking Packet loss rate excellent <50ms <10ms <0.1％ good 50ms~100ms 10ms~20ms 0.1％～1％ generally 100ms~200ms 20ms~50ms 1％～2.5％ Poor >200ms >50ms >2.5％

[0100] The state vector unit includes:

[0101] The network state rating is quantified by standardizing the feature-engineered state indicators using z-scores. The quantized network state ratings are then mapped one-to-one with the standardized feature-engineered state indicators to obtain a state combination vector. Using the same timestamp information, the state combination vector is associated with the state connection table.

[0102] The network status rating quantification standard is Excellent -> 0, Good -> 1, Average -> 2, Poor -> 3, with the following assumptions:

[0103] If the quantization rating is excellent, then the standardized feature = [0.5, -0.2, 1.1, -0.8], and the generated state combination vector is [1, 0.5, -0.2, 1.1, -0.8]. The state vector unit completes the transformation from multi-source heterogeneous features to a standardized state vector through three steps: quantization, standardization, and concatenation. By retaining and attaching association keys such as flow_id and timestamp, it ensures the uniqueness and traceability of each state vector in the spatiotemporal dimension.

[0104] The risk assessment unit includes:

[0105] An anomaly detection engine is built to perform numerical anomaly detection and behavioral sequence anomaly detection on the state combination vector. The numerical anomaly detection uses the sigmoid function to perform interval mapping on the feature-engineered state indicators in the state combination vector to obtain anomaly scores.

[0106] Behavioral sequence anomaly detection is used to set anomaly matching logic. Based on the cipher suites in the state connection table, the risk level of the sample is obtained. The risk level of the sample includes high risk, medium risk and low risk. If the order of appearance of the cipher suite is found to be incorrect, the current sample in the state connection table is marked as high risk. If the cipher suite has a configuration error or is marked by a malicious client, the current sample is marked as medium risk. If duplicates are found in the cipher suite, the current sample is marked as low risk.

[0107] The risk level of the sample is quantified, and a basic risk score is assigned based on experience. The abnormal score and the basic risk score are combined to calculate a dynamic abnormal score. If multiple abnormal matching logic rules are triggered at the same time, the average of the sum of the products of the basic risk score and the abnormal score is calculated to obtain the current state safety score.

[0108] The feature-engineered state is extracted from the state vector. This feature engineering has been standardized, so the value can directly identify the standard deviation of the deviation from the mean. The absolute value of the z-score is extracted as the degree of deviation. The Sigmoid function is used to map it to the [0,1] interval to obtain the anomaly score. The expression of the Sigmoid function is anomaly_score=2*(sigmoid(|z|*k)-0.5), where anomaly_score is the anomaly score and k is the sensitivity coefficient used to control the steepness of the curve. Then, for each continuous feature in the state vector, a corresponding anomaly score value is calculated. The average of the anomaly scores of the data set is taken as the overall numerical anomaly score.

[0109] The system detects logical errors and malicious patterns in the TLS handshake protocol process, and examines the chronological order of protocol elements such as cipher suites. For example, if the cipher suite chosen by the server is not in the suite list provided by the client's ClientHello message, it is marked as high risk with a base risk score of 0.8. It also checks the cipher suite configuration; for example, if the client's suite list contains explicitly deprecated (e.g., RC4, MD5) or weak (e.g., DES) suites, this may indicate an outdated client software version, misconfiguration, or malicious scanning tools intentionally using weak suites, and is marked as medium risk with a base risk score of 0.4. Finally, it checks for duplicate entries in the cipher suite list. Duplicate entries usually indicate flaws in the client implementation or may be low-quality malware, and are marked as low risk with a base risk score of 0.2. The output of this behavior detection is one or more triggered rules and their corresponding base risk scores.

[0110] The adaptive encryption module includes:

[0111] The current security score is numerically classified to obtain a first score, a second score, and a third score. The first score is processed using a first encryption strategy, the second score is processed using a second encryption strategy, and the third score is processed using a third encryption strategy. The first score < the second score < the third score.

[0112] The first encryption strategy is used to call the performance-first mode, which uses the TLS-RTT protocol to process the data stream corresponding to the first score in segments, thereby accelerating the connection between the user end and the backend data.

[0113] The second encryption strategy is used to invoke defense functions, filter cipher suites, temporarily disable the TLS-RTT protocol function, strengthen the signature algorithm, and prioritize recording detailed handshake information of the current connection.

[0114] The third encryption strategy is used to invoke the security protection mode, restrict the current cipher suite, and force the use of the highest protocol.

[0115] The typical threshold division in this embodiment is as follows:

[0116] First score (low risk): 0.0 <= security_score < 0.3;

[0117] Second rating (medium risk): 0.3 <= security_score < 0.7;

[0118] Third rating (high risk): 0.7 <= security_score <= 1.0;

[0119] Through this tiered response mechanism, the system achieves a precise dynamic balance between security and performance: providing an exceptional experience for normal users, implementing conservative defenses against suspicious connections, and strictly blocking malicious attacks.

[0120] The optimized transmission module includes a model building unit and an algorithm interaction unit:

[0121] The model building units include:

[0122] A parameter intelligent optimization model is constructed, which receives abstract instructions from the AI ​​decision engine. The instruction parser of the parameter intelligent optimization model extracts the optimization target and intensity of the abstract instructions. Based on the optimization target, the network subdomains are dynamically adjusted to obtain the corresponding mapping relationship and build a model knowledge base. The model knowledge base is called to dynamically select the adjustable parameters of each network subdomain and adjust the subdomain buffer size according to the current real-time network state.

[0123] In this embodiment, an abstract optimization target is mapped to the affected network subdomain through a multi-level mapping process. Within the determined subdomain, the optimal value of specific parameters is dynamically calculated based on the current real-time network status and intensity instructions. This transforms the intelligent decision-making intent into precise physical control actions, enabling the entire system to adapt to complex and ever-changing network environments.

[0124] The algorithm interaction unit includes:

[0125] Based on the abstract instructions from the AI ​​decision engine, the parameter intelligent optimization model is used to convert the abstract instructions into specific parameter values. The specific parameters are then applied through the configuration interface to adjust the network protocol environment, generate a new network state, observe the new network state, calculate the interpolation between the old and new network states, set the reward function, and update the feedback parameter intelligent optimization model.

[0126] The unit receives a specific, executable list of performance scheduling optimization actions from the output of the model building unit. The unit calls the configuration interface provided by the operating system, protocol stack, or hardware to apply these parameters, modifies global TCP parameters using congestion control algorithms, and the execution process must be atomic, that is, either all parameters are applied successfully, or the system can roll back to the previous state when an error is encountered, in order to ensure system stability. The implementation logic of this unit completes a complete closed loop of state -> decision -> action -> new state -> reward -> update, and the system can continuously try different parameter adjustments.

[0127] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product implemented on one or more computer-usable storage media containing computer-usable program code. The storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0128] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. An AI driven transport layer security protocol adaptive optimization system, characterized in that, It includes a data access module, a status awareness module, a risk assessment module, an optimized transmission module, and an adaptive encryption module: the data access module is used to capture raw data streams from the network and the host in real time; The state awareness module is used to receive the raw data stream and set feature engineering state indicators; the risk assessment module is used to quantitatively assess the current state security score based on the current traffic environment state; the adaptive encryption module is used to build a password policy library and generate encryption configuration policies based on the current traffic state; the optimized transmission module is used to build a parameter intelligent optimization model and control the algorithm interaction to generate performance scheduling optimization actions; the state awareness module includes: continuously receiving the raw data stream from the message queue, setting a time window, aligning the raw data streams sent within a unit time according to the timestamp of the first sample data, and then associating sample data belonging to the same connection according to the data association key of the raw data stream to generate a state connection table; Samples with the same timestamp in the state connection table are extracted and aggregated for feature statistics to obtain feature-engineered state indicators. These indicators include a first indicator, a second indicator, and a third indicator. The first indicator is calculated by taking the average RTT, standard deviation, average movement speed, and average packet loss rate within a unit time window, generating n rows of indicator values, and saving them as the first indicator based on the timestamp. The second indicator is calculated by taking the quantile value of the handshake time, counting the number of times different cipher suites are used within a unit time, and saving them as the second indicator. The third indicator is calculated by taking the average movement speed with CPU utilization and saving it as the third indicator. The risk assessment module includes a feature derivation unit, a state vector unit, and a risk assessment unit. The risk assessment unit includes: constructing an anomaly detection engine to perform numerical anomaly detection and behavioral sequence anomaly detection on the state combination vector. The numerical anomaly detection uses a sigmoid function to perform interval mapping on the feature-engineered state indicators in the state combination vector to obtain an anomaly score. The behavioral sequence anomaly detection sets anomaly matching logic to obtain the sample risk level based on the cipher suites in the state connection table. The sample risk level includes high risk, medium risk, and low risk. If the cipher suites are found to have an incorrect order of appearance, the current sample in the state connection table is marked as high risk. If the cipher suites have configuration errors or are marked by malicious clients, the current sample is marked as medium risk. If duplicates are found in the cipher suites, the current sample is marked as low risk. The sample risk level is quantified, and a basic risk score is allocated based on experience. The anomaly score and the basic risk score are combined to calculate a dynamic anomaly score. If multiple anomaly matching logic rules are triggered simultaneously, the average of the sum of the products of the basic risk score and the anomaly score is calculated to obtain the current state security score. The adaptive encryption module includes: numerically classifying the current state security score to obtain a first score, a second score, and a third score. The third scoring method employs a first encryption strategy for the first scoring, a second encryption strategy for the second scoring, and a third encryption strategy for the third scoring, with the first scoring < the second scoring < the third scoring. The first encryption strategy is used to invoke a performance-priority mode, utilizing the TLS-RTT protocol to fragment the data stream corresponding to the first scoring, accelerating the connection between the user end and the backend data. The second encryption strategy is used to invoke defense functions, filtering cipher suites, temporarily disabling the TLS-RTT protocol, strengthening the signature algorithm, and prioritizing the recording of detailed handshake information for the current connection. The third encryption strategy is used to invoke a security protection mode, restricting current cipher suites and forcing the use of the highest-level protocol. The optimized transmission module includes a model building unit and an algorithm interaction unit. The model building unit includes: constructing a parameter intelligent optimization model, receiving abstract instructions from the AI ​​decision engine, extracting the optimization target and strength of the abstract instructions from the instruction parser of the parameter intelligent optimization model, dynamically adjusting network subdomains according to the optimization target to obtain corresponding mapping relationships and constructing a model knowledge base, invoking the model knowledge base, and dynamically selecting adjustable parameters for each network subdomain and adjusting the subdomain buffer size according to the current real-time network status.

2. The Al-driven transport layer security protocol adaptation optimization system of claim 1, wherein, The data access module includes a data sensing unit and a data classification unit. The data sensing unit includes: capturing raw data packets at high speed in user space, performing early preprocessing on the raw data packets based on underlying logic, collecting raw data packets from multiple dimensions according to runtime timestamps and saving them to a high-speed memory buffer area, setting a first predetermined rule, and encoding, compressing, and serializing the raw data packets. The first predetermined rule is used to unify the serialization protocol according to the size of the raw data stream and select a portion of the raw data stream as a data association key. The data association key is used by downstream systems for data association, data fusion, and data classification.

3. The Al-driven Transport Layer Security protocol adaptation and optimization system of claim 2, wherein, The data classification unit includes: setting up an internal streaming aggregator to classify the raw data packets, generate raw data streams, and transmit them to a message queue. The raw data streams include a first data stream, a second data stream, a third data stream, and a fourth data stream. The first data stream includes RTT, jitter, packet loss rate, and bandwidth. The second data stream includes TLS handshake time, key exchange time, and cipher suites. The third data stream includes CPU utilization, user-mode CPU cycles, memory-mode CPU cycles, and TLS version. The fourth data stream includes application identifier, API request endpoint, content type, and business request ID. The internal streaming aggregator is used to continuously receive different raw data packets. The access end sets up a discrimination mechanism to distribute the raw data packets to multiple processing threads to obtain raw data streams. The first data stream is used to quantify the underlying network health status. The second data stream is used to record the current protocol's internal state information. The third data stream is used to obtain current host resource consumption and memory-related information. The fourth data stream is used to obtain decision context information through API calls.

4. The Al-driven Transport Layer Security protocol adaptation and optimization system of claim 3, wherein, The risk assessment module includes a feature derivation unit, a state vector unit, and a risk assessment unit. The feature derivation unit includes: extracting the average RTT, average packet loss rate, and jitter of the feature-engineered state indicators as network state combinations, classifying the network state combinations, and generating a network state rating. When the network state combination is within a first threshold range, the current network state is set to excellent; when the network state combination is within a second threshold range, the current network state is set to good; when the network state combination is within a third threshold range, the current network state is set to average; when the network state combination is within a fourth threshold range, the current network state is set to poor. The first threshold range is less than the second threshold range, less than the third threshold range, and less than the fourth threshold range.

5. The AI-driven adaptive optimization system for transport layer security protocols as described in claim 4, characterized in that, The state vector unit includes: quantizing the network state rating, standardizing the feature engineering state index using z-score, mapping the quantized network state rating to the standardized feature engineering state index to obtain a state combination vector, and associating the state combination vector with a state connection table using the same timestamp information.

6. The AI-driven adaptive optimization system for transport layer security protocols as described in claim 1, characterized in that, The algorithm interaction unit includes: according to the abstract instructions of the AI ​​decision engine, using the parameter intelligent optimization model, converting the abstract instructions into specific parameter values, applying the specific parameters through a configuration interface, adjusting the network protocol environment, generating a new network state, the AI ​​decision engine observing the new network state, calculating the interpolation between the old and new network states, setting a reward function, and updating the parameter intelligent optimization model.

Images