A method, apparatus and device for adaptive encryption of wireless network control signaling

Abstract

The application discloses a kind of adaptive encryption method, device and equipment of wireless network control signaling, by obtaining control signaling stream in wireless network, extract signaling timing characteristics and generate signaling fingerprint atlas, identify high-frequency control signaling node;Important degree score is obtained by correlation analysis to node, and floating layered encryption strategy is established;From the minimum control unit in signaling stream, after time sequence dislocation reorganization and key bit displacement injection, generate confused signaling sequence, construct layered key pool;According to encryption strategy, dynamically divide key section and ordinary section, respectively carry out strong encryption and light confusion processing, and interleave to form first encrypted signaling;Weak area is identified by entropy analysis, and second encrypted signaling is generated by superimposed chaos mask enhancement;Third encrypted signaling is generated by fractal analysis and compression code construction, multiple layer security enhancement and transmission optimization are realized, and the adaptive encryption of wireless network control signaling is completed.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of wireless network communication security, in particular to a wireless network control signaling adaptive encryption method, device and equipment. BACKGROUND

[0002] With the rapid development and wide application of wireless network technology, network management and resource scheduling information are transmitted in an open wireless channel, facing various security threats such as eavesdropping, tampering, and replay. The traditional fixed strength encryption method uses a unified protection strategy, which cannot dynamically adjust according to the importance of data and network environment, resulting in insufficient protection of important information or over-encryption of ordinary information, affecting security and reducing transmission efficiency.

[0003] The current encryption scheme lacks in-depth analysis of the intrinsic characteristics of the transmitted data, ignoring the regularity of network communication in multiple dimensions such as time and frequency. At the same time, the existing method is difficult to realize the dynamic adaptation of protection strength and network state, and cannot flexibly adjust in the face of traffic mutation or network congestion, causing performance bottlenecks.

[0004] Therefore, a method is needed to solve at least one of the above problems. SUMMARY

[0005] The present application provides a wireless network control signaling adaptive encryption method, device and equipment, aiming to realize dynamic optimization of encryption strategy through multi-level signaling analysis and processing. The method extracts control signaling features to generate a fingerprint map, evaluates node importance and establishes a floating layered encryption strategy; converts the signaling into a confusion sequence and constructs a layered key pool; through dynamic segment division and multiple encryption processing, generates a three-level progressive encryption signaling, completes the adaptive encryption of control signaling, and realizes the balance between security and efficiency.

[0006] The first aspect of the present application proposes a wireless network control signaling adaptive encryption method, comprising the following steps:

[0007] Obtain the control signaling stream in the wireless network, extract the signaling timing characteristics based on the control signaling stream, generate the signaling fingerprint map according to the signaling timing characteristics, and identify the high-frequency control signaling node through the signaling fingerprint map;

[0008] Perform correlation analysis on the high-frequency control signaling node to generate a node importance score, map the node importance score to an encryption level interval, perform burst characteristic analysis on the signaling timing characteristics to determine a boundary expansion parameter, and adjust the encryption level interval based on the boundary expansion parameter to generate a floating layered encryption strategy;

[0009] extract a minimum control unit from the control signaling stream, recombine the minimum control unit in time sequence dislocation to form an obfuscated signaling sequence, generate a pseudo-random key seed based on the obfuscated signaling sequence, and construct a hierarchical key pool using the pseudo-random key seed;

[0010] According to the floating hierarchical encryption strategy, the minimum control unit is dynamically divided into a key segment and a normal segment, the hierarchical key pool is used to encrypt the key segment to generate a ciphertext block, a displacement disturbance is applied to the normal segment to generate an obfuscated block, the ciphertext block and the obfuscated block are interleaved to form first encrypted signaling;

[0011] Entropy analysis is performed on the first encrypted signaling to obtain a confusion degree distribution, an encryption weak area is identified based on the confusion degree distribution, a chaotic mask is superimposed on the encryption weak area, and second encrypted signaling is generated through the chaotic mask;

[0012] Fractal analysis is performed on the second encrypted signaling to extract self-similar structures, a fractal compression code is constructed based on the self-similar structures, and third encrypted signaling is generated through the fractal compression code, thereby completing adaptive encryption of control signaling.

[0013] The second aspect of the present application proposes a wireless network control signaling adaptive encryption device, comprising:

[0014] The signaling acquisition module is used to obtain a control signaling stream in a wireless network, extract signaling time sequence characteristics based on the control signaling stream, generate a signaling fingerprint spectrum according to the signaling time sequence characteristics, and identify a high-frequency control signaling node through the signaling fingerprint spectrum;

[0015] The policy generation module is used to perform correlation analysis on the high-frequency control signaling node to generate a node importance score, map the node importance score to an encryption level interval, perform burst characteristic analysis on the signaling time sequence characteristics to determine a boundary expansion parameter, adjust the encryption level interval based on the boundary expansion parameter to generate a floating hierarchical encryption strategy;

[0016] The key construction module is used to extract a minimum control unit from the control signaling stream, recombine the minimum control unit in time sequence dislocation to form an obfuscated signaling sequence, generate a pseudo-random key seed based on the obfuscated signaling sequence, and construct a hierarchical key pool using the pseudo-random key seed;

[0017] The primary encryption module is used to dynamically divide the minimum control unit into a key segment and a normal segment according to the floating hierarchical encryption strategy, use the hierarchical key pool to encrypt the key segment to generate a ciphertext block, apply a displacement disturbance to the normal segment to generate an obfuscated block, and interleave the ciphertext block and the obfuscated block to form first encrypted signaling;

[0018] The enhanced encryption module is used for entropy analysis of the first encrypted signaling to obtain a confusion degree distribution, identifying an encryption weak area based on the confusion degree distribution, superimposing a chaotic mask in the encryption weak area, and generating second encrypted signaling through the chaotic mask enhancement.

[0019] The compression processing module is used for fractal analysis of the second encrypted signaling to extract self-similarity structure, constructing a fractal compression code based on the self-similarity structure, generating third encrypted signaling through the fractal compression code, and completing adaptive encryption of the control signaling.

[0020] The third aspect of the present application provides a computer device, comprising a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the adaptive encryption method of the wireless network control signaling disclosed in the first aspect when executing the program.

[0021] The beneficial effects of the present application are reflected in the following points: first, through the signaling fingerprint spectrum generation and high-frequency node identification technology, accurate classification and differentiated protection of control signaling are realized, key signaling and ordinary signaling can be accurately distinguished, encryption strategies with corresponding strength are configured for signaling with different importance, resource waste of traditional one-size-fits-all encryption mode is avoided, overall processing efficiency is improved while security is ensured. Secondly, the three-level progressive encryption mechanism constructs a multi-level security protection system, the first encrypted signaling breaks the original structure through the interlacing of ciphertext blocks and confusion blocks, the second encrypted signaling eliminates encryption weak points through chaotic masks, and the third encrypted signaling further confuses and optimizes the data volume through fractal compression. Each level of encryption enhances the security risks that may exist in the previous level, forming a mutually complementary and layer-by-layer deepening protection effect. Finally, the floating layered encryption strategy and adaptive decryption path design enable the system to have strong environmental adaptability, the encryption level can be dynamically adjusted according to the network state and emergency events, and the decryption end can select the optimal processing mode according to the device capability, realizing the dynamic balance between security and transmission efficiency under various network conditions.

[0022] It should be understood that the above general description and the following detailed description are only exemplary and explanatory, and cannot limit the present application. BRIEF DESCRIPTION OF DRAWINGS

[0023] The drawings herein show specific examples of the technical solutions described in the present application, and constitute part of the specification together with the specific embodiments, for explaining the technical solutions, principles and effects of the present application.

[0024] Unless specifically stated, the same reference signs in different drawings represent the same or similar technical features, and different reference signs may also be used to represent the same or similar technical features.

[0025] Figure 1 is a flow diagram of an adaptive encryption method of wireless network control signaling according to the present application.

[0026] Figure 2 is a structural block diagram of an adaptive encryption device of wireless network control signaling according to the present application.

[0027] Figure 3 is a structural diagram of a computer device according to the present application. DETAILED DESCRIPTION

[0028] In the following description, for purposes of explanation and not limitation, specific details are set forth, such as particular sequences of steps, techniques, etc., in order to provide a thorough understanding of the embodiments of the present application. However, it will be apparent to those skilled in the art that the present application can be practiced in other embodiments that depart from these specific details. In other instances, detailed descriptions of well-known methods, devices, and circuits are omitted so as not to obscure the description of the present application with unnecessary detail.

[0029] In this specification, the reference to "one embodiment" or "some embodiments" means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the application. The appearances of the phrase "in one embodiment" or "in some embodiments" in various places in the specification are not necessarily all referring to the same embodiment, although it can. The terms "including," "comprising," "having" and variations thereof are meant to encompass the item listed thereafter and equivalents thereof as well as additional items. The terms "coupled" and "connected," as well as variations thereof, are intended to encompass a connection between two members, directly or indirectly, which is rigid or flexible, fixed or removable, and / or includes the presence of an intervening member.

[0030] The technical solutions of the embodiments of the present application are described below.

[0031] As shown in Figure 1 The present application provides an adaptive encryption method of wireless network control signaling, comprising the following steps S110-S160:

[0032] In step S110, the control signaling flow in the wireless network is acquired, the signaling timing characteristics are extracted based on the control signaling flow, the signaling fingerprint map is generated according to the signaling timing characteristics, and the high-frequency control signaling node is identified through the signaling fingerprint map.

[0033] Specifically, the control signaling data of multiple protocol layers is captured in real time through a wireless network interface to form a raw control signaling stream. The signaling capture adopts a hierarchical collection architecture: the physical layer capture includes pilot signals, synchronization signals, and reference signals, and the sampling rate meets the requirements of the LTE / 5G NR standard; the MAC layer capture includes control PDUs, including random access responses, scheduling requests, and time advance commands; and the RRC layer capture includes connection establishment, reconfiguration, and release messages. The signaling stream preprocessing adopts a sliding window mechanism, and the window parameters are optimized to ensure the timing continuity of the captured signaling. The protocol analysis engine processes multiple signaling in parallel and supports the signaling format of the 3GPP standard. The signaling integrity check is completed through CRC and sequence number continuity checking. The timestamp marking reaches a microsecond level of precision, and GPS synchronization is used to ensure the time consistency of multiple nodes. The signaling stream buffer adopts a ring buffer structure and supports historical data backtracking analysis. The abnormal signaling filtering mechanism excludes signaling with format errors, timeouts, and retransmissions. The multiple layers of collection, analysis, and preprocessing are closely coordinated, and the output control signaling stream contains three key elements: the protocol level information identifies the signaling type and function, the accurate timestamp records the signaling occurrence time, and the signaling content carries the control parameters and state information.

[0034] The three key elements of the control signaling stream are analyzed to deeply excavate the timing behavior patterns of the signaling. The timing analysis extracts the signaling arrival time intervals from the accurate timestamps to form an interval sequence and calculate statistical features; the protocol level information is used for classification statistics, and the time intervals of the physical layer signaling are concentrated at the millisecond level, the MAC layer presents a clear scheduling period, and the RRC layer interval distribution is relatively discrete; the signaling content analysis obtains control parameter values, and the parameter change frequency and amplitude reflect the dynamics of the network state. Feature extraction adopts multi-scale analysis: microscale uses sliding variance to detect burst events, and marks the start and end points of the burst when the variance exceeds the threshold; macroscale uses moving average to identify long-term trends, and a smoothing window is used to eliminate short-term disturbances. Autocorrelation analysis processes the timestamp sequence, calculates the correlation coefficients at different delays, and the peak position corresponds to the signaling period. Power spectral density transforms the time domain interval sequence to the frequency domain, and the main frequency and harmonic components reveal the multi-level periodic structure. Statistical features are extracted from the signaling content: the mean value of the parameter value reflects the steady state level, the variance reflects the fluctuation degree, the kurtosis judges the burst strength, and the skewness identifies the distribution asymmetry. The phase feature is obtained through Hilbert transform, and the instantaneous phase jump corresponds to the state switching time. The multi-dimensional feature vector constructed by combining the timestamp, protocol type, and content parameters comprehensively describes the timing behavior of the signaling source.

[0035] In some embodiments, the generating the signaling fingerprint atlas according to the signaling timing features comprises: performing waveform reconstruction on the signaling timing features to generate reconstructed waveforms; extracting signaling texture information based on the reconstructed waveforms; establishing a signaling imprint matrix based on the texture information, the signaling imprint matrix comprising intensity imprint, frequency imprint and phase imprint; and encoding the signaling imprint matrix to form the signaling fingerprint atlas.

[0036] The multi-dimensional feature vector is reconstructed into a waveform, converting discrete numerical values into continuous time-domain signals. The reconstruction uses a parametric synthesis method: the dominant cycle frequency from the feature vector is extracted as the carrier base frequency, which comes from the main peak position of the power spectral density; the arrival rate feature modulates the carrier amplitude, with high arrival rates corresponding to large amplitudes, and the modulation depth being proportional to the variance feature; the burst feature controls the phase modulation, with each burst event causing a phase jump at the corresponding time, and the jump amplitude being determined by the kurtosis value; the skewness in the statistical feature is used to generate an asymmetric envelope, with positive skew producing an envelope with a steep rising edge. Feature fusion is completed by weighted superposition, with the weights being dynamically adjusted according to the discriminability of each feature. Cross-modulation between features is also introduced in the waveform generation: the periodic feature is multiplied by the burst feature to produce intermittent pulses, and the statistical feature modulates the overall envelope shape. Nonlinear transformation enhances the differences between different signaling sources, with the transformation function being adaptively selected according to the feature distribution. The reconstruction quality is evaluated by feature fidelity to ensure that the original features can be extracted from the waveform in reverse. The combination of features for each signaling source produces a unique waveform pattern, with the same type of signaling presenting a similar waveform family.

[0037] Multi-level texture information is extracted from the time-domain, frequency-domain and time-frequency domain characteristics of the reconstructed waveform. Time-domain texture analysis processes the waveform amplitude sequence: the distribution of local extreme points is calculated, with the extreme value density reflecting the signal complexity; the zero-crossing rate feature is extracted, with high zero-crossing rates corresponding to high frequency components; and the envelope line shape is analyzed, with the difference between the upper and lower envelopes representing the modulation depth. Frequency-domain texture is obtained through Fourier transform: the fluctuation degree of the spectral envelope is quantified as spectral flatness; the harmonic structure is represented by the energy ratio of the fundamental frequency to each harmonic; and the spectral centroid and bandwidth describe the energy distribution characteristics. Time-frequency domain texture uses short-time Fourier transform to generate a time-frequency map: the energy ridge line traces the instantaneous frequency change trajectory; the time-frequency block energy distribution forms a texture pattern; and the instantaneous bandwidth change reflects the modulation characteristics. Texture features also include: contrast, correlation, energy and uniformity extracted from the gray level co-occurrence matrix; texture components at different scales and directions captured by the Gabor filter bank response; and microstructure changes described by the local binary pattern. Spatial features are obtained by dividing the time-frequency map into grids: the time-frequency plane is divided into grids, and local texture features are calculated for each grid; the feature difference between grids forms a spatial distribution pattern; and the correlation between adjacent grids reflects the texture continuity.

[0038] A structured signaling footprint matrix is constructed using the extracted global, local and spatial texture features. The matrix construction follows the principle of physical meaning mapping: the intensity footprint area is filled with energy-related features, including time-domain envelope energy, spectral power density and time-frequency map energy ridge strength, which reflect the signal power level; the frequency footprint area organizes periodic features, including spectral centroid, dominant frequency position, harmonic structure parameters and Gabor filter frequency response, which embody the temporal regularity of the signaling; the phase footprint area records phase-related information, including instantaneous phase trajectory, phase jump position, local binary pattern and zero-crossing rate distribution, which depict the fine timing structure of the signal. The integration of spatial features uses embedded coding: the grid-based spatial distribution pattern is dispersedly embedded into the three footprint areas, maintaining spatial adjacency; the feature difference between grids is coded as boundary strength and embedded at the area junction; the spatial correlation matrix is compressed and filled into the remaining positions. Nonlinear scaling is used for the mapping of features to matrix elements to enhance the discriminability of key features. Matrix normalization ensures numerical range consistency, facilitating comparison and processing.

[0039] The three-layer structural information of the signaling footprint matrix is converted into a compact fingerprint representation through hierarchical coding. The coding process uses different strategies for each layer of footprint characteristics: the intensity footprint has energy concentration characteristics, and the discrete cosine transform is used to extract low-frequency principal components, preserving the overall profile of energy distribution; the frequency footprint presents a periodic pattern, and wavelet packet decomposition is used to capture multi-scale periodic features, and the sparse representation of wavelet coefficients achieves efficient compression; the phase footprint contains fine structure information, and run-length coding is used to save the phase jump position and amplitude, and the key mutation point coordinates are accurately recorded. The three-layer coding results generate a unified fingerprint through feature-level fusion: the intensity coding occupies the front segment of the fingerprint, providing fast matching of energy features; the frequency coding is in the middle segment, used for periodic pattern identification; the phase coding is in the rear segment, supporting fine comparison. Redundancy protection is introduced in the coding, and error correction codes are used for key positions to improve the robustness of the fingerprint. The balance between compression rate and fidelity is achieved through rate-distortion optimization, ensuring that the footprint features can still be accurately reconstructed after compression. The fingerprint format includes a synchronization header, feature data and a verification tail, supporting fast positioning and integrity verification.

[0040] By analyzing the encoding content of the fingerprint and reconstructing the imprint characteristics, the high-frequency control signaling nodes in the network are identified. The identification process starts with fingerprint decoding: extract the intensity encoding part, recover the energy distribution by inverse DCT transformation, calculate the total energy and energy concentration; analyze the frequency encoding, obtain the periodic characteristics by wavelet packet reconstruction, analyze the stability of the main frequency and the richness of the harmonics; recover the phase encoding, reconstruct the phase jump sequence, and count the mutation frequency and regularity. The high-frequency characteristics are identified by feature-level analysis: in the energy dimension, nodes with continuous high energy and concentration exceeding the threshold are listed as candidates; in the frequency dimension, nodes with stable strong periodicity are given priority; in the phase dimension, regular phase patterns indicate stable control functions. The relationship between nodes is established by fingerprint similarity: calculate the distance of each part of the fingerprint, and get the comprehensive similarity by weighted combination; similar nodes are clustered to find functional groups, and nodes in the same group may undertake related control tasks. Time stability analysis tracks the evolution of fingerprints: collect fingerprints at different time periods, calculate the autocorrelation of time series; stable high energy, strong periodicity and regular phase pattern indicate high-frequency control nodes.

[0041] In step S120, the high-frequency control signaling nodes are analyzed to generate node importance scores, the node importance scores are mapped to an encryption level interval, the burst characteristics of the signaling time sequence characteristics are analyzed to determine boundary expansion parameters, and the encryption level interval is adjusted based on the boundary expansion parameters to generate a floating layered encryption strategy.

[0042] In some embodiments, the correlation analysis of the high-frequency control signaling nodes to generate node importance scores includes: key entropy value analysis of the high-frequency control signaling nodes to generate node encryption intensity distribution; identifying inter-node synergistic effects based on the node encryption intensity distribution; using the synergistic effects to enhance the node encryption intensity distribution to obtain an enhanced intensity distribution; and generating node importance scores according to the enhanced intensity distribution.

[0043] The entropy of the current key configuration of the high-frequency control signaling node is analyzed to evaluate the strength distribution of the existing encryption system. The key entropy calculation starts from the key sequence of each node: the master key, session key and temporary key used by the node are extracted, and the keys are converted into binary sequences; the information entropy H = -∑(pi x log2(pi)) of the sequence is calculated, where pi is the probability of bit pattern i appearing; the entropy is normalized, and the normalized entropy of an ideal random key is close to 1. The encryption strength of the node not only considers the key entropy, but also includes: key update frequency, high-frequency update provides better forward security; the number of iterations of the key derivation function, more iterations increase the cracking difficulty; the selection of encryption algorithm, from different strength levels of DES to AES-256. The strength distribution is generated by multi-dimensional quantization: each node obtains an encryption strength vector, which includes entropy, update frequency, algorithm strength and other components; the vector is converted into a scalar strength value by weighted summation; the strength values of all nodes form a distribution graph, presenting the overall encryption capability of the network.

[0044] The mode and rule in the node encryption strength distribution are analyzed to identify the node group with synergistic characteristics. The synergistic effect identification starts from the statistical characteristics of the strength distribution: the mean and standard deviation of the distribution are calculated to identify the node aggregation area with similar strength values, and the nodes in the same aggregation area may have similar functions and need to be synergistic; the multi-peak characteristics of the distribution are analyzed, each peak corresponds to a type of encryption demand, and the nodes in the transition area between peaks are potential synergistic bridge nodes. The spatial correlation analysis uses the spatial distribution of the node strength value: a strength difference matrix is constructed, element (i, j) is the absolute value of the strength difference between nodes i and j; the node pairs with a strength difference less than a threshold (0.1 x distribution standard deviation) are marked as strength similar pairs; the distance analysis of similar pairs on the network topology finds that physically adjacent nodes with similar strength have natural synergy. The strength complementarity identification is achieved through pattern matching: the pairing of high-strength nodes (upper quartile of the distribution) and medium-strength nodes (around the median) is common in primary and backup architectures; the node chain with smooth strength gradient (decreasing or increasing strength value) corresponds to a hierarchical processing structure. The time consistency analysis tracks the dynamic changes of the strength distribution: node groups with synchronous changes in strength value have operational synergy; node pairs with stable strength ordering maintain long-term cooperative relationships. The synergistic strength quantification combines multiple indicators: the weighted combination of strength similarity, spatial proximity and change synchronization forms the synergy coefficient.

[0045] For example, the enhanced strength distribution obtained by enhancing the node encryption strength distribution based on the synergistic effect includes: factor analysis of the synergistic effect to obtain strengthening factors and inhibiting factors; enhancing the node encryption strength distribution based on the strengthening factors to obtain a strengthened distribution; noise suppression of the node encryption strength distribution based on the inhibiting factors to obtain a purified distribution; and superimposing the strengthened distribution and the purified distribution to obtain an enhanced strength distribution.

[0046] Factor analysis adopts principal component analysis method: construct the correlation matrix of the synergy matrix, calculate the eigenvalues and eigenvectors; according to Kaiser criterion, retain the principal components with eigenvalues greater than 1; obtain the interpretable factor structure by maximizing variance rotation. The identification characteristics of reinforcing factors include: factors corresponding to positive eigenvalues, indicating positive synergy between nodes; high load on functionally related nodes, such as high load on primary and backup node pairs; strong time stability, consistent factor pattern in different time periods. Inhibitory factors are characterized by: components corresponding to negative eigenvalues or eigenvalues close to zero; factor loadings are scattered and mixed in sign, reflecting synergy conflicts; high time variability, unstable factors fluctuating with network state. Factor score calculation projects the original synergy data into the factor space: each node pair obtains scores on each factor; reinforcing factor scores reflect the security synergy potential of the node pair; inhibitory factor scores indicate possible security risks.

[0047] The extracted reinforcing factors are used to direct the enhancement of the original node encryption strength distribution, generating a reinforced distribution. The enhancement process calculates the reinforcement increment for each node: the higher the reinforcing factor load of a node, the greater the enhancement amplitude it obtains; the synergy relationship with high load nodes also contributes to the enhancement effect, which is achieved through cooperative propagation. The enhancement function is designed in a nonlinear form: S_enhanced=S_original×(1+α×tanh(β×F_reinforce)), where S_enhanced represents the enhanced encryption strength, S_original is the original encryption strength value, F_reinforce is the reinforcing factor score, α and β control the steepness and saturation characteristics of the enhancement curve. The synergy enhancement mechanism enables related nodes to be synchronized: when the encryption strength of a node is enhanced, nodes with strong synergy relationships with it are enhanced proportionally; enhancement propagates through the synergy network, but the propagation strength decays with distance. The upper limit of enhancement prevents over-optimization: set the maximum enhancement multiple to avoid abnormally high encryption strength of individual nodes; maintain a reasonable strength gradient between adjacent nodes to ensure interoperability.

[0048] The noise suppression process of the node encryption intensity distribution is performed using the suppression factor to eliminate interference and inconsistency and generate a purified distribution. Noise identification starts from the load mode of the suppression factor: nodes with high suppression factor load may have configuration errors or version inconsistencies; nodes with frequent changes in load symbols exhibit unstable encryption behavior. Noise type classification processing: configuration noise is eliminated through parameter correction, and abnormal parameters are adjusted to a reasonable range; time series noise is removed using median filtering, and stable encryption strength values are retained; associated noise is decoupled to break the error coordination relationship. The suppression algorithm uses an adaptive threshold: the noise judgment threshold is dynamically set according to the local distribution characteristics; abnormal values exceeding the threshold are limited to a reasonable range; normal fluctuations below the threshold remain unchanged. Spatial consistency constraints ensure smooth transition of adjacent nodes: the spatial change rate is measured using the graph Laplacian operator; the mutation is reduced through iterative optimization to maintain overall continuity. Time consistency is achieved through Kalman filtering: the prediction-update mechanism tracks encryption intensity changes; abnormal jumps are identified as noise and filtered out.

[0049] The enhanced reinforcement distribution and the purified distribution after noise suppression are weighted and superimposed to generate the final enhanced intensity distribution. The superimposition strategy considers the complementary characteristics of the two distributions: the reinforcement distribution provides positive security enhancement, increasing encryption intensity in key areas; the purification distribution ensures overall consistency and stability, eliminating potential security vulnerabilities. The weight allocation uses an adaptive scheme: for nodes with significant synergy effects, the reinforcement distribution weight is larger, fully leveraging the synergy advantage; for isolated or edge nodes, the purification distribution weight is larger, focusing on stability. The superposition process maintains normalization: W_enhanced = w1 x S_reinforced + w2 x S_purified, where W_enhanced is the final enhanced intensity value, S_reinforced is the intensity value in the reinforcement distribution, S_purified is the intensity value in the purification distribution, and w1 + w2 = 1; the result is normalized again to a reasonable range to avoid numerical overflow. Boundary processing ensures smooth transition: the distribution edge uses a gradual weight, adjusting the weight proportion from the center to the edge; the intensity of the boundary node is obtained through interpolation, maintaining continuity.

[0050] The final importance score of each high-frequency control signaling node is calculated according to the enhanced intensity distribution. The score calculation comprehensively considers the enhanced encryption intensity value and its relative position in the network: first, extract the numerical value of each node in the enhanced intensity distribution, which reflects the integrated encryption capability considering the synergistic effect; then calculate the percentile ranking of the node intensity value in the whole network distribution, identify the relative importance; at the same time, evaluate the local significance of node intensity, that is, the intensity difference with neighbor nodes. The importance score adopts a multi-factor weighted model: the absolute intensity contributes to the basic score, which accounts for a certain proportion of the total score; the relative ranking contributes to the position score; the local significance contributes to the difference score; the time stability contributes to the reliability score. The score is normalized to a standard interval for easy understanding and use. The time evolution of the score is tracked by exponential moving average, which smooths short-term fluctuations while retaining long-term trends.

[0051] Map the node importance score to the encryption level interval. The mapping adopts a piecewise function design: the importance score is first normalized to the [0, 1] interval, and then enhanced by exponential transformation to enhance the discrimination, so that the encryption needs of high-score nodes are more prominent. Encryption levels are defined as multiple levels, each level corresponds to different key length and algorithm complexity: the highest level uses the strongest encryption, suitable for core nodes with scores exceeding the threshold; the middle level has moderate strength, covering secondary control nodes; the lower level gradually reduces, balancing security and efficiency. The determination of level boundaries uses cluster analysis: K-means clustering is performed on the importance scores of all nodes, and the cluster centers are used as representative values of each level, and the boundaries of adjacent clusters are used as level demarcation points. The boundary setting considers security redundancy, and a buffer zone is set near the demarcation point, and the nodes in the buffer zone can switch between adjacent levels according to the real-time state. The width of the level interval is dynamically adjusted according to the node distribution: when there are too many nodes in a certain level, sub-levels are subdivided; when there are few nodes in a certain level, it is merged with adjacent levels. In the time dimension, the level interval is updated regularly to adapt to changes in network topology and traffic.

[0052] The burst characteristics of the signaling timing characteristics are analyzed to determine the boundary expansion parameters. Starting from the arrival rate sequence in the timing characteristic vector: the mean and standard deviation in the sliding window are calculated, and when the instantaneous arrival rate exceeds the mean plus double the standard deviation, it is marked as the burst starting point; the burst duration is determined by tracking the time when the arrival rate falls below the threshold; the burst intensity is measured by the ratio of the peak arrival rate to the average arrival rate. Burst pattern analysis identifies different types: periodic bursts correspond to timed batch signaling, with fixed intervals and durations; random bursts are triggered by burst events and exhibit Poisson distribution characteristics; cascading bursts exhibit a chain reaction of multiple burst events. The calculation of the boundary expansion parameters considers the burst characteristics: the expansion width is proportional to the burst duration, ensuring that the entire burst period is covered; the expansion strength is related to the burst peak, and high-intensity bursts require more safety margin; the expansion direction is determined according to the burst propagation characteristics, with forward expansion addressing burst prediction and backward expansion handling delay effects.

[0053] Based on the boundary expansion parameters, the encryption level interval is adjusted to generate a floating layered encryption strategy. First, it acts on the level boundary: when a burst event is detected, the expansion width in the boundary expansion parameter is added to the original boundary value, causing more nodes to temporarily upgrade the encryption level; the expansion strength determines the rate of boundary movement, and strong bursts cause rapid boundary adjustment; the expansion direction controls the movement trend of the boundary, forward expansion moves the boundary ahead of time, and backward expansion produces a lag effect. The encryption parameters within the level also float: nodes located in the expansion area have their key lengths increased proportionally, with the increase amplitude being inversely related to the distance from the node to the boundary; the encryption algorithm complexity is correspondingly improved, switching from the basic algorithm to the enhanced algorithm. The time characteristics of the floating strategy are managed by a state machine: the static level interval is used in the normal state; the boundary pre-expansion is started in the burst warning state; the complete expansion is implemented in the burst proceeding state; and the recovery state gradually shrinks to the normal boundary. Multi-node coordination ensures strategy consistency, achieving dynamic adaptation of security strength to network state.

[0054] Step S130, extract the minimum control unit from the control signaling stream, time sequence dislocation reorganization of the minimum control unit to form the confusion signaling sequence, generate a pseudo-random key seed based on the confusion signaling sequence, and use the pseudo-random key seed to construct a layered key pool.

[0055] Specifically, the identification of the minimum control unit is based on the hierarchy of the signaling protocol: at the physical layer, the minimum unit is the Resource Block, containing control information on specific time-frequency resources; at the MAC layer, the minimum unit is the MAC Control Element (MAC CE), carrying independent control functions such as scheduling, power control, etc.; at the RRC layer, the minimum unit is the Information Element (IE), each IE containing complete configuration parameters. The extraction algorithm uses a protocol-aware parsing method: determine the current level according to the protocol identification field in the signaling stream; locate the control unit boundaries of each layer according to the message format defined in the 3GPP specification; ensure the integrity of the unit through the length indication field and the end marker. The unit verification mechanism excludes incomplete or damaged data: CRC check confirms the correctness of the physical layer unit; sequence number continuity check verifies the integrity of the MAC layer unit; syntax parsing verifies the legality of the RRC layer unit. The extraction process preserves the timestamp information of the unit, recording its position in the original signaling stream and the arrival time. The unit classification is based on functional attributes: system information class, access control class, mobility management class, session management class, etc., and different categories of units will adopt different processing strategies.

[0056] In some embodiments, the time sequence dislocation reorganization of the minimum control unit to form the confused signaling sequence comprises: obtaining time sequence characteristics based on time sequence mode analysis of the minimum control unit; generating dislocation reorganization rules by using the time sequence characteristics; performing interleaving processing on the minimum control unit based on the dislocation reorganization rules to obtain interleaving units; and performing key bit displacement injection on the interleaving units to form the confused signaling sequence.

[0057] Based on the extracted minimum control unit set, the time sequence relationship and arrival mode between units are analyzed. Starting from the timestamp sequence of the unit: calculate the time interval of adjacent units to form an interval sequence Δt_i=t_(i+1)-t_i; perform statistical analysis on the interval sequence to identify basic characteristics such as mean, variance, and distribution form; find periodic patterns through autocorrelation analysis, and the correlation coefficients at different delays reveal the implicit time sequence rules. The correlation analysis of unit type and time sequence finds that: system information class units present fixed periods (such as 80ms, 160ms); access control class units exhibit burst characteristics, concentrated in a specific time window; the arrival of mobility management class units follows a Poisson process. Sequence pattern recognition uses time series mining technology: use SAX (Symbolic Aggregate Approximation) to discretize continuous time sequences; identify frequently occurring time sequence motifs through pattern matching algorithms; construct a time sequence feature vector containing period intensity, burst frequency, sequence entropy, and other multi-dimensional features. Phase feature extraction is achieved through Fourier analysis to identify the phase relationship of different frequency components.

[0058] The timing characteristics obtained by analysis are used to design targeted misplacement reorganization rules to disrupt the original timing relationship. The core idea of rule generation is to maximize the timing confusion degree while maintaining the integrity of the unit. The basic misplacement rule is designed according to different dimensions of timing characteristics: for units with obvious periodic characteristics, the misplacement step is selected as a non-periodic prime number to avoid generating new regularity; for units with burst characteristics, random misplacement with exponential distribution is used to increase unpredictability; for unit pairs with causal relationship, the order is deliberately reversed or irrelevant units are inserted. The determination of misplacement amplitude considers the balance between security and recoverability: the maximum misplacement is no more than 50% of the original sequence length to ensure decryption end recovery; the minimum misplacement is more than 3 times the average time interval to ensure sufficient confusion effect. The dynamic nature of the rule is achieved through parameterization: the misplacement parameter is calculated in real time according to the timing characteristics, and different misplacement values are used for the same type of unit at different times; a pseudo-random number generator is introduced to generate a misplacement sequence with the current timestamp as the seed.

[0059] Based on the generated misplacement reorganization rules, the minimum control unit sequence is executed to maintain the interleaving processing of the attribute. The interleaving algorithm preserves the integrity of the unit's attribute information while disrupting the timing: each control unit carries its type identifier, content load and original index to participate in interleaving; an extended unit structure is constructed to encapsulate the original unit as a {type, content, index} triplet. The multi-dimensional interleaving matrix design considers the unit attribute: the matrix dimension MxN is determined according to the number distribution of different types of units; system information class units are preferentially filled in the matrix edge position to ensure their relative stability; access control and mobility management class units fill the center area to achieve maximum confusion. Deep interleaving is achieved through multiple iterations, each iteration maintaining the integrity of the unit attribute: the first round exchanges positions according to the misplacement rule, and the triplet moves as a whole; the second round adjusts the fine within the group under the premise of maintaining the type grouping; the third round performs global optimization while maintaining the attribute label of each unit. Interleaving effect evaluation ensures attribute preservation: verify that each position of the interleaved unit still contains complete type and content information; statistics of the dispersion of each type of unit ensure that no type is lost; check the reversibility of the index mapping to ensure that the original order can be restored.

[0060] The key displacement injection utilizes the type information of the interleaving unit for differential processing: a type-related displacement base is derived from a pre-shared key, and a smaller base is used for system information type and a larger base is used for other types; the specific displacement value of each unit is determined by the combination hash of the key, type and index, V_i = Hash(Key||Type_i||Index_i) mod Range_type. The displacement execution maintains the integrity of the triple of the unit: the entire {type, content, index} structure is moved as an atomic unit; the position mapping table is updated in real time during the displacement process, recording the correspondence between the original index and the new position; units of the same type use the same family of displacement parameters to maintain the relative stability within the type. The special processing of high-priority units is based on type identification: the displacement amplitude of system information type units is limited to within 10% of the sequence length; emergency control type units are kept in the front 1 / 3 region of the sequence; and ordinary units are allowed to be displaced in the full range. The solution to the displacement conflict adopts a priority mechanism: when multiple units compete for the same position, high-priority type units have priority; and conflicts of the same priority are solved by secondary hash. After the injection is completed, each position in the obfuscated signaling sequence still retains the complete information of the unit, but the position distribution completely depends on the key.

[0061] Based on the generated obfuscated signaling sequence, the chaotic characteristics thereof are extracted to generate a high-quality pseudo-random key seed. Multiple dimensions of the obfuscated sequence are utilized: the content entropy is obtained by calculating the distribution of different bytes in the sequence, and a high entropy value ensures the randomness of the seed; the position entropy is the uniformity of the distribution of the unit in the sequence, avoiding predictable patterns of the seed; and the timing residual is extracted by differential analysis to convert the original timing information into random components. The feature extraction adopts a sliding window method: the window size is set to 128 bytes, and the step is 64 bytes, ensuring coverage of the entire sequence; a local feature vector is calculated for each window, including the byte histogram, bit flip rate, and run length distribution; and the feature vectors of all windows are combined nonlinearly to generate a candidate seed pool. Seed screening ensures quality: NIST randomness test suite is used to evaluate each candidate seed; multiple indicators such as frequency test, run test, and spectrum test are used; and seeds that pass all tests are retained as the final key seed. Seed enhancement is achieved through cryptographic hash: the screened seed is combined with system parameters (timestamp, node ID, etc.); SHA-512 is used to generate a 512-bit master seed; and multiple sub-seeds are derived from the master seed to support hierarchical key generation. The generated pseudo-random key seed has high randomness and unpredictability.

[0062] The hierarchical key pool design adopts a tree hierarchy: the root key is generated by the master seed through a KDF (key derivation function), and the HKDF-SHA256 is used to ensure the strength of the key; multiple branch keys are derived from the root key, and each branch represents a security level; each branch key further derives a working key for actual encryption operation. The key derivation path design ensures security: different context identifiers are used to distinguish keys at different levels to prevent cross-layer derivation; a unique salt value is added each time the key is derived, so that the same input produces different keys; the number of iterations of the derivation function increases with the depth of the hierarchy, and the calculation of deep-layer keys is more complex. The key pool capacity is dynamically managed: the basic capacity is determined according to the quality of the seed during initialization, and a high-quality seed supports a larger key pool; an expansion factor is set to automatically expand the capacity when the usage rate exceeds the threshold; an aging mechanism periodically cleans up expired keys to maintain the freshness of the keys in the pool. Key attributes are defined in multiple dimensions: key strength is set from 128 bits to 256 bits; the life cycle is configured according to security requirements, from hours to days; usage restrictions include maximum number of uses and number of concurrent uses. Key pool access is optimized through caching: hot keys are kept in the fast access area; a pre-generation mechanism ensures uninterrupted key supply; load balancing avoids overuse of specific keys.

[0063] In step S140, according to the floating hierarchical encryption strategy, the minimum control unit is dynamically divided into a key segment and a normal segment, the key segment is encrypted using a hierarchical key pool to generate a ciphertext block, the normal segment is subjected to a bit shift to generate a confusion block, and the ciphertext block and the confusion block are interleaved to form a first encrypted signaling.

[0064] In some embodiments, the dynamic division of the minimum control unit into a key segment and a normal segment according to the floating hierarchical encryption strategy includes: analyzing the minimum control unit based on the floating hierarchical encryption strategy to obtain a hierarchical guide; generating an encryption depth level using the hierarchical guide; establishing a hierarchical boundary range through the encryption depth level; starting saturation detection based on the hierarchical boundary range to complete the dynamic division of the key segment and the normal segment.

[0065] Based on the floating hierarchical encryption strategy, the encryption requirements of the minimum control unit are analyzed to generate hierarchical guidance. The analysis process extracts the key parameters of the strategy: the current encryption level interval configuration output by S120 is extracted, including the boundary values and node distribution of each level; the real-time state of the boundary expansion parameter is obtained to determine whether it is in the burst adjustment period; the time decay factor is extracted to evaluate the dynamic change trend of the strategy. The matching of the unit and the strategy is realized through attribute mapping: the unit type identifier output by S130 is extracted, and system information class is mapped to high-level interval, access control class is mapped to medium level, and session management class is mapped to lower level; the content load of the unit is analyzed to identify sensitive fields containing keys and authentication information, which require higher protection; the timestamp information of the unit is used, and newly arrived units obtain level promotion during the burst period. The generation of hierarchical guidance includes static and dynamic parts: static guidance is based on the inherent sensitivity analysis of unit type and content, and the key field position is identified by scanning the content load; dynamic guidance responds to the real-time adjustment of S120, and when the boundary expansion parameter is activated, the protection requirements of the unit are correspondingly improved. The encoding of the guidance information uses a compact format: a bitmap is used to represent the importance distribution of the unit content, and a 0 / 1 marker is generated by byte-by-byte scanning; the key area (such as the key field) is marked as 1, and the ordinary area (such as the padding field) is marked as 0; the transition area uses a probability value to represent, supporting flexible boundaries.

[0066] Using the generated hierarchical guidance, the encryption depth level distribution inside each control unit is calculated. The definition of depth level corresponds to the fine-grained division of encryption strength: on the basis of the aforementioned levels, it is further divided into multiple depth levels; the highest depth corresponds to complete encryption, and the lowest depth only does simple confusion; intermediate depth provides progressive protection strength. The level calculation starts from the bitmap of the hierarchical guidance: a continuous 1 value region is assigned the highest depth level; a continuous 0 value region sets the lowest depth; the transition area is linearly mapped to the intermediate level according to the probability value. The influence of unit structure on depth distribution is reflected through weight adjustment: although the protocol header may be marked as an ordinary area, it still maintains the basic depth to ensure integrity; the depth of the payload part strictly follows the guidance to achieve differentiated protection; the verification field obtains additional depth guarantee to prevent tampering. The spatial continuity of depth level is guaranteed through smoothing processing: the depth difference of adjacent areas is limited within a certain range to avoid sudden changes; the local average depth is calculated using a sliding window to eliminate isolated outliers. The time factor affects depth allocation: newly generated control units tend to have higher depth; the depth of retransmitted units can be appropriately reduced.

[0067] The hierarchical boundary range establishment adopts an adaptive threshold method: calculate the statistical features of the depth level vector, including mean, median and distribution density; take the mean as the initial threshold, and the region above the threshold is classified as a key segment candidate; adjust the threshold according to the distribution form, and select the valley bottom as the boundary in the bimodal distribution. The boundary optimization considers data integrity: expand the boundary to include complete data fields to avoid splitting related information; identify protocol-defined indivisible units to ensure their complete attribution; align the boundary to the byte boundary for subsequent encryption processing. Multi-segment support allows non-continuous key regions: when multiple high-value regions appear in the depth level, multiple key segments are generated; maintain a minimum interval between segments, and small ordinary segments are integrated into adjacent key segments; segment number limit prevents excessive fragmentation. The dynamic characteristics of the boundary respond to level changes: when real-time updates of the depth level are detected, the boundary is adjusted accordingly; the adjustment adopts a gradual approach to avoid frequent boundary jumps; historical boundary information is used to predict future trends. The final determination of the boundary range generates segment descriptors: each segment contains the starting offset, length and type identifier; key segments additionally record the required encryption depth; ordinary segments are marked with confusion strength requirements.

[0068] Based on the established hierarchical boundary range, saturation detection is performed to complete the final dynamic division of key segments and ordinary segments. Saturation detection evaluates the rationality of the current division: calculate the proportion of key segments in the total length to prevent performance problems caused by excessive encryption; trigger the saturation state when the proportion of key segments exceeds the preset threshold; check the minimum length of ordinary segments to ensure confusion effect. Saturation processing adopts an intelligent compression strategy: identify redundant parts in key segments, such as repeated padding fields; evaluate the actual importance of each part and downgrade the edge region to an ordinary segment; maintain core sensitive information in the key segment. Dynamic adjustment responds to real-time load: monitor the encryption processing capacity of the current system; appropriately reduce the proportion of key segments under high load; expand the coverage of key segments under low load. Division verification ensures security: simulate attack scenarios to verify whether key information is adequately protected; check whether ordinary segments leak sensitive patterns; evaluate whether the overall security strength meets the requirements. The output of the final division result contains complete segment mapping: each control unit generates a segment list that explicitly identifies the type and location of each segment; key segments are associated with corresponding encryption parameters; ordinary segments are configured with confusion parameters.

[0069] The identified key segments are subjected to strong encryption using a hierarchical key pool. First, a mapping of encryption requirements and key resources is established: the type of key segment source unit is analyzed, and system information and emergency control classes require the strongest protection; the length and content complexity of the key segment are evaluated to determine the required encryption strength; the current security threat level is calculated, and stronger keys are selected in high threat situations. The key selection strategy takes into account multiple factors: from the tree structure of the S130 key pool, the required strength selects the corresponding depth of the key, and the strongest protection selects the third layer of working keys, and the second layer of branch keys for moderate protection; check the usage status and remaining life cycle of the key, and prefer to use fresh and less frequently used keys; ensure that adjacent key segments use different keys to avoid correlation attacks caused by key reuse. The encryption algorithm is adapted according to the length of the selected key: when a 256-bit key is selected, it is combined with the AES-256-GCM mode to provide authenticated encryption; when a 128-bit key is selected, the AES-128-CTR mode is used to ensure stream encryption efficiency; when the key length is between the two, the corresponding strength algorithm variant is selected. Encryption execution uses pipeline processing: the key segment is divided according to the encryption block size to ensure alignment; each block is independently encrypted to support parallel processing; the generated ciphertext maintains the original length. The management of encryption metadata ensures decryptability: record the key path identifier selected from the key pool; save the initialization vector and authentication tag; establish a ciphertext block index.

[0070] A lightweight bit shift perturbation process is applied to the identified normal segments to generate obfuscated blocks. The design principle of bit shift perturbation is fast reversibility: the perturbation algorithm has much lower complexity than encryption, reducing processing overhead; preserves recoverability, allowing the receiver to restore the original data; but is sufficient to confuse visual patterns to prevent analysis. The basic bit shift uses a circular shift: each byte is circularly left or right shifted by a certain number of bits; the number of bits is determined by the segment offset and a global parameter; the number of bits for adjacent bytes is different, breaking the byte association. Enhanced perturbation is achieved through XOR operation: a pseudo-random sequence of the same length as the segment is generated as a perturbation mask; the mask is generated by hashing the segment index and timestamp; the normal segment and the mask are XORed byte by byte to achieve content obfuscation. Byte-level permutation increases the degree of confusion: the bytes within the segment are rearranged according to a specific pattern; the permutation table is dynamically generated based on segment characteristics; maintain the locality of the permutation to facilitate streaming processing. Adaptive adjustment of perturbation strength: select the perturbation strength according to the content characteristics of the segment; segments containing partial structural information use stronger perturbation; segments with pure filler content use the simplest perturbation.

[0071] The generated ciphertext blocks and the confusion blocks are interleaved according to a specific strategy to form the first encrypted signaling. The design goal of the interleaving strategy is to maximize the overall confusion effect: the distribution of ciphertext blocks and confusion blocks avoids obvious patterns; blocks of the same type are not arranged continuously; but a certain regularity is maintained to support efficient decryption. The interleaving mode is dynamically determined according to the number and proportion of blocks: when ciphertext blocks dominate, a uniform dispersion mode is used; when there are more confusion blocks, clustering and dispersion are combined; when the number of blocks is similar, a chessboard alternating mode is used. Interleaving is implemented through index mapping: a mapping table from the original position to the interleaved position is constructed; ciphertext blocks are placed in key positions first; confusion blocks fill the remaining space. The interleaving process maintains the integrity of the blocks: each block is involved in interleaving as an atomic unit; the internal structure of the block is not affected by interleaving; the type identification of the block moves with the block. Interleaving optimization considers cache friendliness: related blocks are placed as close as possible; the size of the processor cache line is considered; the overhead of random access is reduced. After interleaving, necessary meta information is added: the signaling header contains the interleaving mode identifier; the block index table supports fast positioning; but the meta information itself is also subjected to confusion processing. The final generated first encrypted signaling combines the advantages of strong encryption and lightweight confusion, achieving a balance between security and efficiency.

[0072] At step S150, entropy analysis is performed on the first encrypted signaling to obtain a confusion degree distribution, and based on the confusion degree distribution, an encryption weak area is identified, and a chaotic mask is superimposed on the encryption weak area to generate a second encrypted signaling through the chaotic mask.

[0073] Specifically, a comprehensive entropy analysis is performed on the first encrypted signaling to quantitatively evaluate the spatial distribution of the encryption effect. Entropy calculation starts from the byte sequence of the first encrypted signaling: the signaling is divided according to the analysis window size, and the window size is set to the least common multiple of the ciphertext blocks and the confusion blocks to ensure complete coverage of different types of blocks; the byte distribution in each window is counted, and the information entropy H = -∑(p_i × log2(p_i)) is calculated, where p_i is the probability of byte value i appearing; the entropy value is normalized to the [0, 1] interval, and the normalized entropy of an ideal random distribution is close to 1. Sliding window analysis captures local features: the window slides with a half-window length step to generate an overlapping entropy sequence; the confusion degree at each position is the weighted average of the entropy values of all windows covering that position; the weight is determined according to the distance from the window center to the position, and the closer the distance, the greater the weight. Multi-scale entropy analysis identifies regularity at different granularities: small-scale windows (8-16 bytes) detect local patterns; medium-scale windows (64-128 bytes) identify block-level regularity; large-scale windows (512-1024 bytes) evaluate global randomness. Cross-scale fusion generates a comprehensive confusion degree: the entropy values of different scales are combined through weighted combination, with small-scale weight 0.5, medium-scale weight 0.3, and large-scale weight 0.2;

[0074] In some embodiments, the identifying the encryption weak zone based on the chaos degree distribution comprises: performing entropy gradient analysis on the chaos degree distribution to identify a chaos degree trough region; performing evolution trend analysis on the chaos degree trough region to obtain an evolution direction; predicting a weak zone diffusion range based on the evolution direction; and determining a location of the encryption weak zone according to the diffusion range.

[0075] An entropy gradient is calculated from the generated chaos degree distribution to identify a region with a significant decrease in chaos degree. The gradient calculation uses a numerical differentiation method: the central difference formula is used on the chaos degree sequence wherein represents the chaos degree gradient at position i, is the chaos degree value at position i, and are the chaos degree values of adjacent positions, and Δx is the sampling interval; a second derivative is calculated to identify the change trend, wherein represents the second derivative; the gradient amplitude reflects the degree of change in chaos degree, wherein represents taking the absolute value. The identification of the trough region is based on multiple criteria: the absolute value of the chaos degree is lower than 80% of the global average; the negative gradient lasts for more than a certain length, indicating that the chaos degree is continuously decreasing; the second derivative is positive, confirming that it is at the bottom of the valley. The trough feature extraction includes: the valley bottom position and its minimum chaos degree value; the trough width, i.e., the length of the continuous interval with a chaos degree lower than the threshold; the trough depth, i.e., the difference between the valley bottom value and the surrounding peak value. Correlation analysis of adjacent troughs: calculate the distance distribution between the troughs to identify periodic patterns; evaluate the spatial correlation of the troughs to determine whether they are caused by the same reason. The severity score of the trough region is a combination of depth, width, and isolation, and a deep and wide isolated trough is the most dangerous.

[0076] Evolutionary trend analysis of low-disorder regions reveals the evolutionary direction. Causal analysis begins with the location and characteristics of the lows: comparing the low location with the structure of the first encrypted signaling, and calculating the distance from the low center to the boundary of the nearest ciphertext block or obfuscated block; if the low is mainly located in the obfuscated block region and its width is similar to the block size, it indicates that the obfuscation algorithm may have generated a regular pattern; if the low crosses the boundaries of ciphertext and obfuscated blocks, it suggests that the interleaving pattern may be periodic. The depth and shape of the lows provide additional clues: deep and narrow lows are usually caused by locally identical byte sequences, possibly padding or specific fields; shallow and wide lows indicate a gradual decrease in randomness, possibly due to algorithmic characteristics. Evolutionary trends are based on causal analysis: if the low is caused by a fixed interleaving pattern, this structural factor will persist, and the evolutionary direction tends to stabilize; if it is caused by a specific content pattern, the possibility of change in that content needs to be assessed; lows related to ciphertext blocks are relatively stable because the encryption algorithm is fixed; lows related to obfuscated blocks may change depending on the input data. Construction of evolution direction vectors: The stability component reflects the continued possibility of the trough, and the structural cause gives high stability; the expansion component is based on the gradient at the edge of the trough, and the gentle gradient indicates possible expansion; the deepening component is based on the degree of isolation of the local minimum, and isolated extreme points may be further deepened.

[0077] Based on the evolution direction obtained from the analysis, the potential diffusion range of the encryption weak zone is predicted. The diffusion model draws on the physical diffusion process: low disorder is regarded as "concentration," and high disorder areas diffuse towards low disorder areas; the diffusion rate is proportional to the gradient, and a steep gradient slows down the diffusion; a diffusion coefficient D is set, determined according to the characteristics of the encryption algorithm. The diffusion range prediction adopts a probabilistic method: starting from the current trough boundary, the diffusion probability is calculated along the evolution direction; the diffusion probability decays exponentially with distance, P(x)=exp(-x² / 2σ²), where σ is the diffusion parameter; areas with a probability exceeding a threshold are included in the potential diffusion range. Worst-case analysis ensures a security margin: assuming all adverse factors occur simultaneously, the maximum possible diffusion range is calculated; cascading effects are considered, as the diffusion of one trough may trigger a chain reaction in adjacent areas; a security factor of 1.5-2 times expands the prediction range. Time factors are considered: rapid diffusion may occur in milliseconds and needs to be dealt with immediately; slow diffusion can be dealt with in the next update; a classification and processing strategy is adopted according to the diffusion rate. The output of the diffusion range includes: the core diffusion area, the area with a high probability of being affected; the edge diffusion area, the buffer zone that may be affected; and the expected impact time for each area.

[0078] According to the predicted diffusion range, the location of the encryption weak area that needs to be enhanced is accurately determined. The location determination integrates static and dynamic factors: the static weak area includes all the low valley area centers currently identified and their certain radius range; the dynamic weak area covers the entire predicted diffusion range, including the core area and the edge area; the priority is determined according to the product of the chaos degree value and the diffusion probability. Boundary refinement ensures complete coverage: merging consecutive weak points into weak area intervals, reducing processing fragments; extending the interval boundary to natural boundaries such as block boundaries or byte boundaries; ensuring the minimum interval length, and merging small intervals into adjacent intervals. Hierarchical management of weak areas: severe weak areas (chaos degree <0.3) require strong enhancement; moderate weak areas (0.3-0.5) require moderate enhancement; mild weak areas (0.5-0.7) require preventive enhancement. Efficient representation of location coding: use start offset and length to describe each weak area interval; establish bitmap index for fast positioning; record weak reason label to guide subsequent enhancement strategy. Spatial relationship analysis optimizes processing order: identify mutually influencing weak areas for unified processing; isolated weak areas can be processed in parallel; weak areas on the critical path are processed first.

[0079] Based on the identified encryption weak area location information, the corresponding area is superimposed with chaos mask. Before generating the chaos mask, the mapping between the weak area and the original structure is established: the position index of the ciphertext block and the confusion block is extracted from the structure information of the first encrypted signaling in S140; the weak area interval determined in paragraph 5 is compared with the block index to determine the type of block covered by each weak area; the proportion and distribution of ciphertext blocks and confusion blocks in the weak area are recorded. The generation of chaos mask uses a deterministic chaotic system: the Logistic mapping x_{n+1}=r×x_n×(1-x_n) is selected as the basic chaotic generator, where r=3.9 ensures chaotic behavior; the initial value x_0 is derived from the weak area location, interval length and covered block type information; a chaotic sequence equal in length to the weak area is generated by iteration, and each value is mapped to [0, 255] as a mask byte. The mask strength is adaptively adjusted according to the weakness: the severe weak area uses the complete strength of the chaos mask; the moderate weak area scales the chaos value to an appropriate range; the mild weak area further reduces the strength. The superposition operation is differentially processed according to the difference in the underlying data type: for the part of the weak area covering the ciphertext block, the mask is superimposed using the XOR operation to maintain the statistical properties of the ciphertext; for the part covering the confusion block, the modulo addition operation is used to enhance the nonlinearity of the confusion; for the weak area spanning both types of blocks, the operation mode is switched at the boundary. The mask parameters and the location mapping relationship are recorded together to ensure that the receiving end can accurately reconstruct and remove the mask.

[0080] After superimposing the chaotic mask on the weak encryption area, a second encrypted signaling is generated through additional enhancement processing. The enhancement processing not only improves the local chaos degree, but also improves the global randomness distribution. Global optimization is achieved through iterative adjustment: calculate the chaos degree distribution after enhancement, check if there is still a low valley; apply a secondary chaotic mask to the residual low valley, use different chaotic systems such as Henon mapping; repeat until the chaos degree of all areas exceeds the set threshold. The elimination of boundary effects ensures continuity: the enhancement of the weak area may produce discontinuity at the boundary, use the boundary smoothing algorithm; extract the statistical features on both sides of the boundary to generate a transition sequence; the transition length is determined according to the original gradient, and a short transition is used for steep boundaries. Enhancement verification ensures effectiveness: recalculate the entropy value distribution of the entire signaling, confirm that the weak area has been eliminated; perform randomness tests, including frequency tests, run tests, and autocorrelation tests; evaluate the security strength improvement before and after enhancement. Performance optimization maintains efficiency: record the enhanced area mapping table to support selective decryption; compress the storage of enhancement parameters to reduce transmission overhead; design a fast enhancement algorithm with a complexity of O(n). The generation of the second encrypted signaling completes the adaptive security enhancement: the basic security characteristics of the first encrypted signaling are retained, the identified weak links are targetedly eliminated, and the overall randomness and anti-analysis capability are improved.

[0081] In step S160, fractal analysis is performed on the second encrypted signaling to extract self-similar structures, a fractal compression code is constructed based on the self-similar structures, and a third encrypted signaling is generated through the fractal compression code to complete the adaptive encryption of the control signaling.

[0082] Specifically, fractal analysis starts with multiscale similarity detection: the second encrypted signaling is divided into fragments of different lengths, from the smallest analysis unit (byte level) to larger blocks (kilobyte level); the similarity between fragments of different scales is calculated, and the normalized Hamming distance is used to measure the difference between binary sequences; a scale-similarity curve is constructed to identify patterns that repeat at a certain scale ratio. The quantitative evaluation of self-similarity uses the box-counting method: map the signaling sequence to a multi-dimensional space, with each dimension representing a specific statistical feature; use boxes of different sizes to cover the data distribution and count the number of non-empty boxes; calculate the fractal dimension D = lim (log N(ε)) / (log (1 / ε)), where N(ε) is the number of boxes at scale ε. The extraction of local self-similar structures is achieved through sliding search: set a similarity threshold, scan the signaling to find fragment pairs that meet the threshold; record the position, length, and transformation relationship of similar fragments; construct a self-similarity graph, with nodes representing fragments and edges representing similarity relationships. Statistical analysis reveals the fractal characteristics of the second encrypted signaling: the chaotic mask enhancement of S150 produces a complex hierarchical structure; certain areas exhibit statistical similarity under certain scale transformations; while maintaining high randomness, there are local self-similar patterns. The extracted self-similar structures include position information, scale relationships, and similarity quantization values.

[0083] In some embodiments, constructing fractal compressed codes based on the self-similar structure includes: performing encryption similarity grading based on the self-similar structure to generate a similarity grading structure, wherein the similarity grading structure includes a high encryption similarity structure, a medium encryption similarity structure, and a low encryption similarity structure; performing stability evaluation on the similarity grading structure to obtain a stability level; adjusting the compression method according to the stability level, performing multiplexing compression on the high encryption similarity structure, performing transform compression on the medium encryption similarity structure, and performing retention processing on the low encryption similarity structure; and fusing the results of the multiplexing compression, the transform compression, and the retention processing to form fractal compressed codes.

[0084] The encryption similarity grading standard comprehensively considers both similarity and security: It extracts the similarity value, segment length, and frequency of occurrence for each pair of similar segments in a self-similar structure; analyzes the distribution of segments in the second encryption signaling, assigning higher security weights to segments in the central region; and calculates the encryption similarity index ES = α × similarity + β × security weight + γ × frequency of occurrence, where α = 0.4, β = 0.4, and γ = 0.2 are normalization coefficients. High encryption similarity structures are characterized by: segment pairs with similarity exceeding 0.85 and located in key signaling positions; structures maintaining stable similarity across multiple scales; and repetitive patterns with high frequency of occurrence that do not affect security. Medium encryption similarity structures are characterized by: similarity between 0.6 and 0.85, which may be improved through specific transformations; distribution in the transition region of the signaling; and self-similar features within a local range. Low encryption similarity structures are characterized by: similarity below 0.6, approaching random distribution; mainly appearing in regions enhanced by S150 processing; preserving these structures helps maintain overall randomness. The hierarchical process generates a three-layer structured representation, with each layer containing a self-similar fragment index, similarity parameters, and location distribution features belonging to that level.

[0085] Stability evaluation is performed on the classified similarity structures to ensure that compression does not compromise encryption security. Stability analysis starts with perturbation sensitivity testing: a small perturbation, such as flipping a single bit, is applied to each similarity structure; the magnitude of similarity change after perturbation is measured, with smaller changes indicating a stable structure; the critical perturbation amount that causes significant similarity change is recorded. Temporal stability is evaluated through simulation evolution: considering the avalanche effect of encryption algorithms, the persistence of similarity structures is evaluated; the ability of structures to maintain under small data changes is analyzed; stable structures are suitable for long-term compression reuse. Spatial stability checks the locality of structures: the dispersion of similar fragments in physical location is evaluated; structures with concentrated distribution have higher stability; dispersed structures require more complex index maintenance. Security stability ensures that compression does not leak information: the change in information entropy before and after compression is analyzed; the difficulty of inferring original information from compressed codes is evaluated; it is ensured that the compression process does not introduce new correlations. Comprehensive evaluation generates a three-level stability rating: high stability (score > 0.8) structures can be safely compressed deeply; medium stability (0.5-0.8) requires careful handling; low stability (<0.5) structures are not suitable for compression. Stability ratings form a two-dimensional decision matrix with similarity classification.

[0086] According to the two-dimensional decision of similarity classification and stability rating, different structures are compressed using adaptive compression methods. The compression strategy for high-encryption similarity structures is determined by the stability rating: high-stability high-similarity structures use aggressive reuse compression, identifying "mother fragments" and storing only differences and indexes for other fragments; medium-stability reduces reuse degree and retains some redundancy; low-stability avoids reuse even if similarity is high. The transform compression of medium-encryption similarity structures is adjusted according to stability: high stability seeks optimal transform functions, such as combinations of cyclic shift and bit permutation; medium stability limits transform complexity and uses simple reversible transforms; low stability only does lightweight processing. The preservation processing of low-encryption similarity structures also considers stability: high-stability low-similarity structures can attempt weak compression; medium-low stability completely preserves the original form. Adaptive adjustment of compression parameters: real-time monitoring of compression effect and security indicators for each strategy; dynamically adjusting decision boundaries based on feedback; ensuring the balance between overall compression rate and security. The differentiated application of the three compression methods fully utilizes the structure characteristics.

[0087] The results of multiplex compression, transform compression and reservation processing are organically integrated to generate a unified fractal compression code. The integration architecture is designed as a hierarchical structure: the top layer is the compression code header, which includes compression mode identification, version information and index table; the middle layer organizes the three types of compression results according to the original position order; and the bottom layer is the specific compression data and parameters. The encoding of the multiplex compression result: the master segment is completely stored in the front part of the compression code for fast access; the multiplex index table records the master segment and offset that should be referenced at each position; and the difference data is stored compactly using variable-length encoding to optimize space. The organization of the transform compression result: the transform parameters are stored centrally to form a parameter dictionary; each compression position is associated with the corresponding transform identifier; and parameter sharing is supported, with the same transform stored only once. The embedding of the reservation processing data: the position and length of the reserved area are marked in the compression code; the original data is copied but may be rearranged to optimize access; and the boundary alignment with the compression area is maintained. The optimization of the integration process: redundant indexes are eliminated, adjacent areas of the same type are merged, entropy coding is used to further compress the indexes and parameters, and a check code is added to ensure the integrity of the compression code. The generated fractal compression code realizes efficient compression while maintaining encryption strength.

[0088] By selective decompression and reconstruction of the fractal compression code, a third encrypted signaling is generated that maintains security characteristics. The generation process is not simply decompression, but intelligent reconstruction: the structure of the fractal compression code is parsed, and different types of compression areas are identified; for multiplex compression parts, they are not fully expanded but are kept in a partially compressed state to reduce similarity; for transform compression areas, inverse transformation is applied but controlled random perturbation is introduced; and the data of the reservation processing is used to maintain the randomness benchmark. The security enhancement of the reconstruction strategy: random intervals are inserted between similar segments to destroy the original regularity; fuzzy processing is performed on the compression boundaries, using a gradual transition instead of a hard boundary; and a time-varying factor is introduced to make the same compression code produce slightly different outputs at different times. Selective processing improves efficiency: key areas are fully reconstructed to ensure security; non-key areas are kept partially compressed to reduce data volume; and the reconstruction depth is dynamically adjusted according to the quality of the transmission channel. Quality control ensures the generation effect: the randomness indicators of the third encrypted signaling are not lower than those of the second encrypted signaling; it is checked whether new identifiable patterns have been introduced; and the reversibility of the compression-reconstruction process is evaluated. The third encrypted signaling inherits the security characteristics of the second encrypted signaling, while optimizing the data volume through fractal compression, making it suitable for transmission over bandwidth-limited channels. Through signaling fingerprint identification, floating hierarchical strategy, chaos enhancement and layer-by-layer processing of fractal reconstruction, a multi-layer security system is constructed that dynamically responds to network state, and finally completes the adaptive encryption of the control signaling.

[0089] In order to perform the adaptive encryption method of the wireless network control signaling corresponding to the above-mentioned method embodiment, to realize the corresponding functions and technical effects. Referring to Figure 2 , Figure 2A structural block diagram of a wireless network control signaling adaptive encryption device 200 provided by an embodiment of the present application is shown. For ease of illustration, only parts related to the present embodiment are shown. The wireless network control signaling adaptive encryption device 200 provided by the embodiment of the present application comprises:

[0090] A signaling collection module 201 is configured to acquire a control signaling stream in a wireless network, extract signaling timing characteristics based on the control signaling stream, generate a signaling fingerprint atlas according to the signaling timing characteristics, and identify a high-frequency control signaling node through the signaling fingerprint atlas;

[0091] A policy generation module 202 is configured to perform correlation analysis on the high-frequency control signaling node to generate a node importance score, map the node importance score to an encryption level interval, perform burst characteristic analysis on the signaling timing characteristics to determine a boundary expansion parameter, and generate a floating layered encryption policy based on the boundary expansion parameter;

[0092] A key construction module 203 is configured to extract a minimum control unit from the control signaling stream, perform timing dislocation reorganization on the minimum control unit to form an obfuscated signaling sequence, generate a pseudo-random key seed based on the obfuscated signaling sequence, and construct a layered key pool using the pseudo-random key seed;

[0093] A primary encryption module 204 is configured to dynamically divide the minimum control unit into a key segment and a normal segment according to the floating layered encryption policy, encrypt the key segment using the layered key pool to generate a ciphertext block, apply a bit shift to the normal segment to generate an obfuscated block, interleave the ciphertext block and the obfuscated block to form a first encrypted signaling;

[0094] An enhanced encryption module 205 is configured to perform entropy value analysis on the first encrypted signaling to obtain a confusion degree distribution, identify an encryption weak area based on the confusion degree distribution, superimpose a chaotic mask on the encryption weak area, and generate a second encrypted signaling through the chaotic mask enhancement;

[0095] A compression processing module 206 is configured to perform fractal analysis on the second encrypted signaling to extract a self-similar structure, construct a fractal compression code based on the self-similar structure, generate a third encrypted signaling through the fractal compression code, and complete adaptive encryption of the control signaling.

[0096] The wireless network control signaling adaptive encryption device 200 described above can implement the wireless network control signaling adaptive encryption method of the method embodiment described above. The optional items in the method embodiment described above are also applicable to the present embodiment, and will not be described in detail here. The remaining content of the present embodiment can refer to the content of the method embodiment described above, and will not be described in detail in the present embodiment.

[0097] AsFigure 3 As shown, the third embodiment of the present application further provides a computer device, comprising a memory 301, a processor 302, and a computer program stored in the memory 301 and capable of running on the processor 302, characterized in that the processor 302 implements the steps of the adaptive encryption method of wireless network control signaling according to the first embodiment of the present application when running the program.

[0098] The above embodiments are not exhaustive enumeration based on the present application, and in addition to the above, there can be a plurality of other embodiments not listed. Any substitution and improvement made without violating the concept of the present application is within the protection scope of the present application.

Claims

1. A method of adaptive encryption of wireless network control signaling, comprising: The method comprises the following steps: acquiring a control signaling stream in a wireless network, extracting signaling timing characteristics based on the control signaling stream, generating a signaling fingerprint atlas according to the signaling timing characteristics, and identifying a high-frequency control signaling node through the signaling fingerprint atlas; performing correlation analysis on the high-frequency control signaling node to generate a node importance score, mapping the node importance score to an encryption level interval, performing burst characteristic analysis on the signaling timing characteristics to determine a boundary expansion parameter, adjusting the encryption level interval based on the boundary expansion parameter to generate a floating layered encryption strategy; extracting a minimum control unit from the control signaling stream, performing time sequence misplacement reorganization on the minimum control unit to form an obfuscated signaling sequence, generating a pseudo-random key seed based on the obfuscated signaling sequence, and constructing a layered key pool using the pseudo-random key seed; dynamically dividing the minimum control unit into a key segment and a normal segment according to the floating layered encryption strategy, encrypting the key segment using the layered key pool to generate a ciphertext block, applying bit shift perturbation to the normal segment to generate an obfuscated block, interleaving the ciphertext block and the obfuscated block to form a first encrypted signaling; performing entropy value analysis on the first encrypted signaling to obtain a confusion degree distribution, identifying an encryption weak area based on the confusion degree distribution, superimposing a chaotic mask on the encryption weak area, and generating a second encrypted signaling through the chaotic mask enhancement; performing fractal analysis on the second encrypted signaling to extract self-similar structures, constructing a fractal compression code based on the self-similar structures, generating a third encrypted signaling through the fractal compression code, and completing adaptive encryption of the control signaling.

2. The method of claim 1, wherein, The method of generating a signaling fingerprint atlas according to the signaling timing characteristics comprises the following steps: waveform reconstruction is performed on the signaling timing characteristics to generate a reconstructed waveform; signaling texture information is extracted based on the reconstructed waveform; a signaling imprint matrix is established through the texture information, and the signaling imprint matrix comprises intensity imprint, frequency imprint, and phase imprint; the signaling imprint matrix is encoded to form a signaling fingerprint atlas.

3. The method of claim 1, wherein, The method of performing correlation analysis on the high-frequency control signaling node to generate a node importance score comprises the following steps: key entropy value analysis is performed on the high-frequency control signaling node to generate a node encryption intensity distribution; collaborative effects between nodes are identified based on the node encryption intensity distribution; enhanced intensity distribution is obtained by using the collaborative effects to enhance the node encryption intensity distribution; a node importance score is generated according to the enhanced intensity distribution.

4. The method of claim 1, wherein, The method of performing time sequence misplacement reorganization on the minimum control unit to form an obfuscated signaling sequence comprises the following steps: time sequence mode analysis is performed on the minimum control unit to obtain time sequence characteristics; misplacement reorganization rules are generated using the time sequence characteristics; interleaved units are obtained by interleaving processing the minimum control unit based on the misplacement reorganization rules; obfuscated signaling sequences are formed by key bit shift injection on the interleaved units.

5. The method of claim 1, wherein, The method of dynamically dividing the minimum control unit into a key segment and a normal segment according to the floating layered encryption strategy comprises the following steps: layered guidance is obtained by analyzing the minimum control unit based on the floating layered encryption strategy; encryption depth levels are generated using the layered guidance; A layered boundary range is established through the encryption depth level; Saturated detection is started based on the layered boundary range, and dynamic division of critical segments and common segments is completed.

6. The method of claim 1, wherein, The encryption weak area is identified based on the chaos degree distribution, including: Entropy gradient analysis is performed from the chaos degree distribution to identify a chaos low valley region; Evolution trend analysis is performed on the chaos low valley region to obtain an evolution direction; The diffusion range of the weak area is predicted based on the evolution direction; The location of the encryption weak area is determined according to the diffusion range.

7. The method of claim 1, wherein, The fractal compression code is constructed based on the self-similar structure, including: Encryption similarity grading is performed based on the self-similar structure to generate a similarity grading structure, the similarity grading structure including a high encryption similarity structure, a medium encryption similarity structure, and a low encryption similarity structure; Stability evaluation is performed on the similarity grading structure to obtain a stability level; Compression modes are adjusted according to the stability level, multiplex compression is performed on the high encryption similarity structure, transform compression is performed on the medium encryption similarity structure, and the low encryption similarity structure is reserved; The multiplex compression, transform compression, and reservation processing results are fused to form a fractal compression code.

8. The method of claim 3, wherein, The node encryption intensity distribution is enhanced using the synergistic effect to obtain an enhanced intensity distribution, including: Factor analysis is performed on the synergistic effect to obtain a strengthening factor and an inhibiting factor; The node encryption intensity distribution is enhanced based on the strengthening factor to obtain a strengthened distribution; Noise is inhibited from the node encryption intensity distribution based on the inhibiting factor to obtain a purified distribution; The strengthened distribution and the purified distribution are superimposed to obtain an enhanced intensity distribution.

9. An apparatus for adaptive encryption of wireless network control signaling, the apparatus comprising: a processor configured to: determine a security level for a wireless network control signaling message; and encrypt the wireless network control signaling message based on the determined security level. It includes: A signaling collection module is configured to acquire control signaling flow in a wireless network, extract signaling timing characteristics based on the control signaling flow, generate a signaling fingerprint spectrum according to the signaling timing characteristics, and identify a high-frequency control signaling node through the signaling fingerprint spectrum; A policy generation module is configured to perform correlation analysis on the high-frequency control signaling node to generate a node importance score, map the node importance score to an encryption level interval, perform burst characteristic analysis on the signaling timing characteristics to determine a boundary expansion parameter, adjust the encryption level interval based on the boundary expansion parameter to generate a floating layered encryption policy; A key construction module is configured to extract a minimum control unit from the control signaling flow, perform timing dislocation reorganization on the minimum control unit to form an obfuscated signaling sequence, generate a pseudo-random key seed based on the obfuscated signaling sequence, and construct a layered key pool using the pseudo-random key seed; A primary encryption module is configured to dynamically divide the minimum control unit into critical segments and common segments according to the floating layered encryption policy, encrypt the critical segments using the layered key pool to generate ciphertext blocks, apply bit shift disturbance to the common segments to generate obfuscated blocks, interleave the ciphertext blocks and the obfuscated blocks to form first encrypted signaling; The enhanced encryption module is configured to perform entropy analysis on the first encrypted signaling to obtain a chaos degree distribution, identify an encryption weak area based on the chaos degree distribution, superimpose a chaotic mask on the encryption weak area, and generate second encrypted signaling through the chaotic mask enhancement; The compression processing module is configured to perform fractal analysis on the second encrypted signaling to extract a self-similar structure, construct a fractal compression code based on the self-similar structure, generate third encrypted signaling through the fractal compression code, and complete adaptive encryption of the control signaling.

10. A computer device, comprising: A computer readable storage medium storing a computer program, the computer program comprising instructions that, when executed by a computer, cause the computer to perform the method of any one of claims 1 to 8. A computer readable storage medium storing a computer program, the computer program comprising instructions that, when executed by a computer, cause the computer to perform the method of any one of claims 1 to 8.

Images