Network risk dynamic ACL active protection method and system based on behavior analysis

Abstract

The invention discloses a network risk dynamic ACL active protection method and system based on behavior analysis, and belongs to the technical field of network security. The method comprises the following steps: S1, data acquisition; s2, performing behavior analysis and high-risk identification based on the behavior analysis model; s3, based on the Bayesian network, obtaining a risk score in combination with the instantaneous abnormal score and the time sequence probability in the S2, and performing IP marking; s4, dynamic white list isolation; s5, the protection state is monitored and automatically relieved; and S6, performing closed-loop optimization. According to the method, active fusion of behavior analysis and a time-limited white list is realized by introducing a sunlight guarding mode, accurate intervention is ensured, and interference is minimized.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security, and particularly relates to a network risk dynamic ACL active protection method and system based on behavior analysis. BACKGROUND

[0002] With the rapid development of the Internet and mobile communication, network fraud has become a global security risk, especially in the field of telecommunications and online services. Network criminals use social engineering attacks, phishing links or false investment inducements, and other means to focus on users who are vulnerable to influence, such as the elderly and those with insufficient network operation experience, to carry out invasions, resulting in serious consequences such as personal information leakage and financial loss. Such invasions often take the behavior patterns of high-risk groups (such as frequent clicking of unknown links or abnormal transaction attempts) as the starting point. Traditional network prevention measures mainly rely on firewalls, virus scanning or post-facto accountability, but these methods are difficult to deal with real-time dynamic disturbances.

[0003] In recent years, behavior analysis technology (such as user entity behavior analysis, UEBA) has begun to emerge, which identifies abnormalities by monitoring network traffic and interaction patterns, but overall still faces the challenges of not timely intervention and high misjudgment rate. The root of these problems lies in the fact that existing systems are mostly passive responses, and cannot actively isolate users from illegal sources when risks first appear, thereby amplifying losses.

[0004] The network security disturbance detection of user / user entity behavior analysis in the prior art is to use a UEBA system to detect security anomalies by analyzing user or entity behavior, regardless of whether the user holds a legal credential. There are also network security and illegality detection systems and methods in the prior art that can uniquely identify physical devices connected to the network and monitor potential network illegality. In addition, some telecommunications field solutions, such as an anomaly detection model using an Isolation Forest (Isolation Forest anomaly detection) algorithm, identify illegal behavior patterns by processing network traffic through machine learning. These systems usually combine IP identification, behavior profiling and threshold scoring to flag risky users, and trigger an alarm or basic access restriction when an anomaly is detected. However, these existing technologies still have significant deficiencies, specifically:

[0005] First, these systems mostly employ passive defense strategies and passive detection models, responding only after illegal activities occur and failing to proactively block communication links, leading to delayed loss mitigation. For example, while UEBA systems can identify anomalies, they lack an immediate isolation mechanism for high-risk users, who may still complete transactions under inducement. Post-event detection or rule-based filtering, for instance, results in delayed intervention, failing to prevent risks from occurring before illegal activities. Specifically, while existing intranet monitoring mechanisms can identify abnormal behavior, they lack the ability to proactively mark and isolate potential victims. Once a user is exposed to an illegal source, sensitive information has often already been leaked or unauthorized transactions have occurred, limiting the effectiveness of loss mitigation.

[0006] Secondly, the whitelist application is limited and static, usually only covering a few fixed services, rather than dynamically adapting to a scale of about 300,000 trusted addresses, and it does not integrate time window control (such as protection of no more than 30 minutes), which can easily lead to excessive intervention or user inconvenience.

[0007] Finally, the protection against false alarms is weak, and there is no mechanism for automatic unblocking during network switching, which increases the risk of false blocking and affects normal use. Summary of the Invention

[0008] To address the problems mentioned in the background section, this invention proposes a proactive protection method and system for dynamic ACLs based on behavioral analysis of network risks. By introducing a "Sunshine Guardian" mode, it achieves proactive integration of behavioral analysis and time-limited whitelists, ensuring accurate intervention and minimizing interference.

[0009] Technical Solution: To solve the above-mentioned technical problems, the present invention adopts the following technical solution:

[0010] A proactive network risk protection method based on behavioral analysis dynamic ACL includes the following steps:

[0011] S1: Data collection, real-time analysis of network traffic through DPI probe, extraction of user application access logs, interaction sequences and IP traffic data;

[0012] S2: Based on behavioral analysis models, conduct behavioral analysis and high-risk identification;

[0013] S21: Extract features from the collected data to generate behavioral feature vectors;

[0014] S22: Input the extracted behavioral feature vector into the fusion model, use the isolated forest anomaly detection algorithm to detect instantaneous anomaly scores, and use LSTM to analyze the time series pattern and calculate the time series probability;

[0015] S3: Based on Bayesian networks, risk scores are obtained by combining the instantaneous anomaly scores and temporal probabilities from S2, thereby enabling IP tagging;

[0016] S4: Dynamic whitelist isolation, based on the network filter application programming interface, to deliver firewall rules in real time;

[0017] S5: Protection status monitoring and automatic deactivation;

[0018] S6: Closed-loop optimization: collect protection logs and false blocking events through a visual dashboard, reverse train the LSTM model, adjust feature weights and risk thresholds, and update the whitelist database daily.

[0019] As a preferred option, the specific implementation details in S21 are as follows:

[0020] The formula for calculating the behavioral feature vector is:

[0021] ,

[0022] in, Represents a behavioral feature vector; Indicates visit rate; Indicates the rate of abnormal keywords; This indicates fluctuations in traffic flow.

[0023] As a preferred option, in S22, the isolated forest anomaly detection algorithm is used to calculate the instantaneous anomaly score, specifically as follows:

[0024] The formula for calculating the instantaneous anomaly score s(x) is as follows:

[0025] ,

[0026] ,

[0027] Where x represents the data sample to be detected; Indicates the path length. Indicates the integrated average. γ represents the normalization term; m represents the subsample size; γ represents the Euler constant.

[0028] As a preferred option, in S22, LSTM is used to analyze user behavior time series patterns and predict time series probabilities. The specific content is as follows:

[0029] The LSTM model takes a temporal sequence consisting of historical behavior feature vectors as input, extracts temporal features through a gating mechanism, and outputs the final hidden state. ;

[0030] The time series sequence X is:

[0031] ,

[0032] Time series probability The calculation formula is:

[0033] ,

[0034] in, This represents the behavioral feature vector at time point tT. This represents the behavioral feature vector at time point t-1, where t represents the current time point; T represents the size of the time window; and σ represents the Sigmoid function. and Indicates model parameters; This represents the final hidden state of the LSTM model at time t-1.

[0035] As a preferred option, the specific implementation details in S3 are as follows:

[0036] Posterior probability The calculation is based on Bayes' theorem, specifically:

[0037] ,

[0038] ,

[0039] ,

[0040] ,

[0041] in, Represents the eigenvector; Represents prior probability; Represents the likelihood ratio; Indicates the probability of evidence; This indicates the number of high-risk users in historical data; This represents the total number of users in the historical data. Representing the eigenvector The i-th feature component in the vector; n represents the dimension of the feature vector; This represents the mean of the i-th feature component obtained from historical high-risk user data; This represents the variance of the i-th feature component obtained from historical high-risk user data. This indicates that the feature vectors observed under normal user behavior conditions The likelihood probability; This represents the prior probability that the user's behavior is normal.

[0042] As a preferred embodiment, in S3, the risk score is calculated by fusing the instantaneous anomaly score with the time-series probability, and the formula is as follows:

[0043] ,

[0044] in, This indicates the final risk score; Indicates the instantaneous anomaly score; α represents the time series probability; α and β both represent weighting coefficients.

[0045] As a preferred option, the specific implementation process in S4 is as follows:

[0046] S41: Rule distribution: After receiving high-risk IPs, the protection enforcement layer distributes firewall rules to the network filter application programming interface.

[0047] S42: Whitelist matching. When a user initiates an access request, it is first filtered by a Bloom filter. If a match is found, a precise query is performed on the Trie tree. If the match is successful, the request is allowed; otherwise, a fuzzy match is performed.

[0048] S43: Fuzzy blocking. Calculate the edit distance between the requested URL and the whitelisted address. If the similarity is less than the set threshold, return a customized blocking page and record the blocking log.

[0049] As a preferred option, the specific details of protection status monitoring and automatic deactivation in S5 are as follows:

[0050] S51: State initialization, after marking high-risk IPs, the state machine transitions from normal to guardian mode, and a 30-minute timer and Netlink monitoring are started;

[0051] S52: Real-time monitoring, calculates the false blocking rate every 5 seconds. If the false blocking rate is greater than 0.5, triggers the early release logic and deletes the ACL rule.

[0052] S53: Automatic release. If the timer times out or Netlink detects an IP change, the state machine transitions to release, restoring normal network access for the user and recording the reason for release.

[0053] A network risk dynamic ACL proactive protection system based on behavior analysis implements the network risk dynamic ACL proactive protection method based on behavior analysis described above, including a data acquisition layer, an analysis and decision layer, a protection execution layer, and a monitoring and feedback layer;

[0054] Data Acquisition Layer: Collects intranet user behavior data in real time, including application access logs, interaction sequences, and IP traffic data, and supports distributed log collection;

[0055] Analysis and Decision Layer: Based on user behavior data from the data collection layer, integrate machine learning models to detect abnormal behavior, calculate risk probabilities, and trigger IP tagging;

[0056] Protection Execution Layer: Based on risk labeling instructions from the analysis and decision-making layer, application layer whitelist control and time window isolation mechanism, and DPI technology-based traffic filtering;

[0057] Monitoring and feedback layer: Based on the protection status data of the protection execution layer, it performs log backtracking and adaptive optimization, and supports false blocking protection and automatic unblocking.

[0058] Beneficial effects: Compared with the prior art, the present invention has the following advantages:

[0059] (1) Accurately identify high-risk victims and significantly reduce risks;

[0060] Multi-dimensional behavioral analysis improves accuracy: By integrating time-series behavioral analysis (such as abnormal login peaks) and content semantic analysis, and combining the Isolation Forest and LSTM hybrid model, the accuracy of high-risk user identification is >95%.

[0061] Proactively block illegal communication links: Application-layer DPI technology deeply analyzes traffic and, combined with a trusted whitelist of over 300,000, blocks illegal source links in real time.

[0062] Technical support: Trie tree enables millisecond-level whitelist matching (latency <1ms), and dynamic ACL rules forcibly isolate users into the security ecosystem.

[0063] Results: The risk of sensitive information leakage is reduced by 90%, and the success rate of unauthorized transactions decreases by 85%.

[0064] (2) Dynamic accidental blocking protection mechanism to optimize user experience;

[0065] Triple-layered removal safeguards minimize the impact of misjudgments: behavior-driven removal.

[0066] Network switching deactivation: When the Netlink Socket listens for an IP change, protection will be automatically deactivated within 0.5 seconds.

[0067] Strict time limit: Mandatory release within 30 minutes to prevent indefinite isolation.

[0068] Results: The false blocking rate was less than 0.5%, and user complaints decreased by 95%.

[0069] Adaptive threshold optimization: Gradient descent dynamically adjusts the risk threshold.

[0070] Results: Protection intensity for high-risk users increased by 40%, and isolation time for low-risk users was shortened to 10 minutes.

[0071] (3) High-efficiency real-time protection, supporting carrier-grade large-scale deployment;

[0072] Millisecond-level response performance: The distributed stream processing architecture (Kafka+Flink) achieves behavioral analysis latency of no more than 100ms (P99) and protection rule distribution latency of no more than 200ms.

[0073] Technical support: Netfilter kernel hooks directly connect to the firewall, and DPDK accelerates 10Gbps traffic processing.

[0074] Results: Supports tens of millions of concurrent users, increasing throughput by 50 times.

[0075] Resource optimization and elastic scaling: Trie tree + Bloom filter compresses whitelist storage space by 70%, and containerized deployment (Docker + K8s) supports rapid scaling up and down.

[0076] Results: Hardware costs reduced by 60%, and operational efficiency improved by 80%.

[0077] (4) Closed-loop optimization system to continuously enhance protection capabilities;

[0078] AI feedback drives model evolution: A visual dashboard displays the characteristics of mistakenly sealed events in real time, and the LSTM model is trained in reverse to optimize feature weights.

[0079] Technical support: reinforcement learning dynamically updates the whitelist, and ROC curves calibrate the fuzzy matching threshold.

[0080] Results: The model iteration cycle was shortened to 24 hours, and the response speed of the new model was improved by 90%.

[0081] End-to-end observability: BPMN standardized process monitoring, real-time generation of protection heatmaps and false alarm rate curves.

[0082] Results: Maintenance personnel's efficiency improved by 75%, and system availability reached 99.99%. Attached Figure Description

[0083] Figure 1 This is the system logic diagram of the present invention;

[0084] Figure 2 This is a system architecture diagram of the present invention;

[0085] Figure 3 This is a schematic diagram of the system hardware architecture of the layered design of this invention;

[0086] Figure 4 This is a sequence diagram of the front-end interaction of the present invention;

[0087] Figure 5 This is a flowchart of the background workflow of the present invention;

[0088] Figure 6 This is a flowchart of the entire data processing process of the present invention;

[0089] Figure 7 This is a schematic diagram of the algorithm interaction of the present invention;

[0090] Figure 8 This is a flowchart of the dynamic state machine of the present invention;

[0091] Figure 9 This is a timing diagram of the accidental sealing protection mechanism of the present invention. Detailed Implementation

[0092] The present invention will be further illustrated below with reference to specific embodiments. These embodiments are implemented based on the technical solutions of the present invention, and it should be understood that these embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention.

[0093] Example 1

[0094] This embodiment provides a method and system for proactive protection of network risks based on dynamic ACLs using behavior analysis. By introducing the concept of "Sunshine Guardian Mode", it achieves proactive protection against illegal network behaviors based on behavior analysis.

[0095] The terms used in this embodiment are explained as follows:

[0096] Sunshine Guardian Mode: A proactive protection mechanism based on behavioral analysis that blocks risks by identifying high-risk users in real time and forcibly isolating them to a secure application ecosystem.

[0097] DPI Probe: A deep packet inspection tool based on Suricata (Network Intrusion Detection and Prevention System) / DPDK (Data Plane Development Kit), which parses application layer information (such as URLs and keywords) in network traffic in real time.

[0098] Dynamic ACL rules: Firewall access control lists that are updated in real time based on the Netfilter API (Network Filter Application Programming Interface) and are used to enforce whitelist isolation policies.

[0099] Trie tree: A high-efficiency string retrieval data structure used for millisecond-level matching of a whitelist of over 300,000 trusted addresses (latency <1ms).

[0100] LSTM model: Long Short-Term Memory Neural Network, which analyzes the temporal patterns of user behavior (such as high-frequency logins and abnormal transfers) to predict the probability of risk.

[0101] Isolation Forest: An anomaly detection algorithm that uses path length to calculate instantaneous anomaly scores and identify instantaneous high-risk behaviors.

[0102] Risk value: A risk quantification indicator for a 1km×1km grid, calculated by weighting user density change rate, movement speed deviation, and the proportion of special populations.

[0103] Levenshtein distance: a string similarity algorithm used for fuzzy matching of suspicious URLs against a whitelist (blocking if the similarity is less than 0.1).

[0104] Netlink monitoring: A Linux kernel communication mechanism that detects user IP change events in real time (such as switching from WiFi to 4G) and automatically disables protection.

[0105] Dual-trigger release mechanism: The dual conditions for releasing protection are a 30-minute hard timeout + an IP change event, ensuring that 99.9% of users' isolation time does not exceed the actual risk window.

[0106] Bloom filter: A probabilistic data structure that works with Trie trees to implement a whitelist secondary index, compressing storage space by 70%.

[0107] False blocking rate: Used to dynamically adjust the protection threshold.

[0108] Flink Window Computation: 5-second time window analysis for stream processing engine, real-time aggregation of behavioral feature vectors.

[0109] State Machine (FSM): A protective state management model that defines three core state transitions: Normal - Guard (risk triggered) - Deactivate (timeout / IP change).

[0110] This embodiment provides a proactive network risk protection method based on behavioral analysis using dynamic ACLs, specifically including the following steps:

[0111] S1: Data acquisition, real-time analysis of network traffic through DPI probe, extraction of user application access logs, interaction sequences and IP traffic data, and transmission to the analysis and decision module via Apache Kafka;

[0112] S2: Based on behavioral analysis models, conduct behavioral analysis and high-risk identification;

[0113] S21: Extract features from the collected data to generate behavioral feature vectors;

[0114] The formula for calculating the behavioral feature vector is:

[0115]

[0116] in, This represents a behavioral feature vector. Indicates visit rate; Indicates the rate of abnormal keywords; This indicates fluctuations in traffic flow.

[0117] S22: Input the extracted behavioral feature vectors into the fusion model to perform isolated forest anomaly detection, detect transient anomalies, and use LSTM to analyze temporal patterns and calculate temporal probabilities;

[0118] Anomaly detection uses the Isolation Forest algorithm to detect anomalies in behavioral feature vectors, calculates instantaneous anomaly scores, and isolates high-risk behavioral paths. The specific formula for calculating the instantaneous anomaly score s(x) is as follows:

[0119]

[0120]

[0121] Where x represents the data sample to be detected; Indicates the path length. Indicates the integrated average. γ represents the normalization factor, used to adjust the expected value of the path length so that it is independent of the sample size m; m represents the subsample size; γ represents Euler's constant, γ≈0.577.

[0122] Outliers are isolated using a random split tree; protection is triggered if s(x) < 0.5. If s(x) > 0.6, LSTM model analysis is triggered.

[0123] Using LSTM to analyze user behavior time series patterns and predict time series probabilities, the specific content is as follows:

[0124] The LSTM model takes a temporal sequence consisting of historical behavior feature vectors as input, extracts temporal features through a gating mechanism, and outputs the final hidden state. .

[0125] The time series sequence X is:

[0126]

[0127] Time series probability The calculation formula is:

[0128]

[0129] in, This represents the behavioral feature vector at time point tT, where t is the current time point and T is the size of the time window (i.e., the length of the historical sequence). σ represents the feature vector at time point t-1, i.e., the feature vector of the time point preceding the current time point t; t represents the current time point (or reference time point), used to identify the position of the latest data in the time series; σ represents the Sigmoid function. and Indicates model parameters; This represents the final hidden state of the LSTM model at time t-1.

[0130] This time-series probability represents the abnormal risk of a user behavior sequence and is used for subsequent Bayesian network fusion decisions.

[0131] S3: Based on Bayesian networks, risk scores are obtained by combining the instantaneous anomaly scores and temporal probabilities from S2, thereby enabling IP tagging;

[0132] Quantify the probability that user behavior conforms to illegal characteristics, and use it for IP tagging.

[0133] Posterior probability The calculation is based on Bayes' theorem, specifically:

[0134]

[0135]

[0136]

[0137]

[0138] in, Represents the eigenvector; Represents prior probability; Represents the likelihood ratio; Indicates the probability of evidence; This indicates the number of high-risk users in historical data; This represents the total number of users in the historical data. Representing the eigenvector The i-th feature component in the vector; n represents the dimension of the feature vector, i.e., the total number of feature components; This represents the mean of the i-th feature component obtained from historical high-risk user data; This represents the variance of the i-th feature component obtained from historical high-risk user data. This indicates that the feature vectors observed under normal user behavior conditions The likelihood probability; This represents the prior probability that the user's behavior is normal.

[0139] in, The calculation method and Similar, but using parameters obtained from historical normal user data statistics.

[0140] Derivation and Application: Approximate Bayesian inference through the Evidence Lower Bound (ELBO). If the probability is greater than 0.8, mark the IP and enter the "Sunshine Guard" mode to trigger protection; otherwise, release it.

[0141] Threshold Optimization: Minimize the cross-entropy loss using gradient descent , specifically:

[0142]

[0143] where y represents the true label (Ground Truth Label), indicating the true category of a sample (user); represents the predicted probability, indicating the probability that the model predicts this sample (user) belongs to the "high-risk" category.

[0144] Complexity: O(n), where n is the number of features.

[0145] The specific content of the risk scoring formula is as follows:

[0146] Risk Score is calculated by fusing the instantaneous anomaly score and the temporal probability, and its formula is:

[0147]

[0148] where is the final risk score; is the instantaneous anomaly score, calculated using Isolation Forest anomaly detection; is the temporal probability, calculated using the LSTM model; α and β are weight coefficients (α + β = 1), and their specific values are determined through training with historical data and optimization using the gradient descent algorithm.

[0149] After obtaining the risk score , compare it with the risk threshold T (initial value is 0.8); if R ≥ T, mark the user's IP as high-risk and trigger dynamic isolation protection; if R < T, determine that the user's behavior is normal and do not intervene.

[0150] The risk threshold T is dynamically adjusted by minimizing the cross-entropy loss function L1 to minimize the misjudgment rate of the system.

[0151]

[0152] where , is the risk score predicted by the model; y is the true label (1 indicates high-risk, 0 indicates normal).

[0153] S4: Dynamic whitelist isolation, based on Netfilter API (Network Filter Application Programming Interface), to deliver firewall rules in real time;

[0154] S41: Rule distribution: After receiving high-risk IPs, the protection enforcement layer distributes firewall rules to the network filter application programming interface.

[0155] S42: Whitelist matching. When a user initiates an access request, it is first filtered by a Bloom filter. If a match is found, a precise query is performed in the Trie tree (prefix tree). If the match is successful, the request is allowed; if the match fails, a fuzzy match is performed.

[0156] S43: Fuzzy blocking. Calculate the Levenshtein distance (edit distance) between the requested URL and the whitelisted address. If the similarity is less than 0.1, return a customized blocking page (displaying the remaining protection time) and record the blocking log.

[0157] In S43, fuzzy blocking is implemented by calculating the Levenshtein distance between the requested URL and the whitelisted addresses, and then converting this distance into a similarity score for decision-making. The specific process is as follows:

[0158] Calculate the Levenshtein distance d: Let the request URL be string A and the whitelist address be string B. Use dynamic programming to calculate their minimum edit distance d.

[0159] The edit distance d(A,B) is calculated using a dynamic programming algorithm. A represents the URL string requested by the user; B represents a certain address string in the whitelist; d(A,B) represents the minimum edit distance between strings A and B, which is the final value of dp[len(A)][len(B)].

[0160] Its recursive formula is:

[0161]

[0162] Where dp[i][j] represents the minimum edit distance between substring A[0:i] and substring B[0:j]; i is the index of string A (from 0 to len(A)); j is the index of string B (from 0 to len(B)). This indicates a function for indicating character equality; if If the characters are the same, then δ=0 (no editing is needed); if If the characters are different, then δ=1 (one replacement operation is required).

[0163] Calculate similarity The edit distance is normalized to similarity using the following formula:

[0164]

[0165] Where d represents the minimum edit distance; len(A) and len(B) are the lengths of strings A and B, respectively.

[0166] Blocking decision: Determine whether the calculated similarity is less than a set threshold T. similarity (In this embodiment, T) similarity = 0.1). If the similarity < 0.1 is met, the address is identified as suspicious, a customized interception page is returned, and a blocking log is recorded; otherwise, the address is allowed to pass.

[0167] S5: Protection status monitoring and automatic deactivation;

[0168] S51: State initialization, after marking high-risk IPs, the state machine transitions from normal to guardian mode, and a 30-minute timer and Netlink monitoring are started;

[0169] S52: Real-time monitoring, calculates the false blocking rate every 5 seconds. If the false blocking rate is greater than 0.5, triggers the early release logic and deletes the ACL rule.

[0170] false positive rate The specific calculation formula is as follows:

[0171]

[0172] in, The probability of misjudgment for each event.

[0173] Dynamic threshold adjustment, specifically:

[0174] 2

[0175] in, This indicates the updated risk threshold; This indicates the current risk threshold; This represents the learning rate (step size parameter, which controls the magnitude of each update). This represents the gradient of the loss function L2 with respect to the threshold θ (i.e., the direction in which the loss function changes the most rapidly).

[0176] The formula for calculating the loss function L2 is:

[0177]

[0178] Where β1 is the balance factor, β1=0.7.

[0179] Time overrun: This refers to a situation where, during the protection and isolation period for a high-risk IP, the actual protection time performed by the system exceeds the effective protection time truly required by the user.

[0180] Network switching deactivation: When the Netlink Socket listens for an IP change, protection will be automatically deactivated within 0.5 seconds.

[0181] Strict time limit: Mandatory release within 30 minutes to prevent indefinite isolation.

[0182] Results: The false blocking rate was less than 0.5%, and user complaints decreased by 95%.

[0183] S53: Automatic release. If the timer times out or Netlink detects an IP change, the state machine transitions to release, restoring normal network access for the user and recording the reason for release.

[0184] S6: Closed-loop optimization: collect protection logs and false blocking events through a visual dashboard, reverse train the LSTM model, adjust feature weights and risk thresholds, and update the whitelist database daily.

[0185] This embodiment provides a network risk dynamic ACL proactive protection system based on behavior analysis, which is a proactive protection system architecture for illegal network behaviors based on the "Sunshine Guardian Mode" of behavior analysis.

[0186] like Figure 1 As shown, the architecture is divided into four layers: data acquisition layer, analysis and decision-making layer, protection execution layer, and monitoring and feedback layer, ensuring closed-loop protection from behavior monitoring to risk isolation.

[0187] Data Acquisition Layer: Collects intranet user behavior data in real time, including application access logs, interaction sequences, IP traffic, etc., and supports distributed log collection (such as using the Apache Kafka framework).

[0188] Analysis and Decision Layer: Based on user behavior data from the data collection layer, integrate machine learning models (such as IsolationForest and LSTM) to detect abnormal behavior, calculate risk probabilities, and trigger IP tagging.

[0189] Protection Execution Layer: Based on risk labeling instructions from the analysis and decision-making layer, application layer whitelist control and time window isolation mechanism, and DPI technology for filtering traffic.

[0190] Monitoring and feedback layer: Based on the protection status data of the protection execution layer, it performs log backtracking and adaptive optimization, supports false blocking protection and automatic removal; the monitoring and feedback layer adjusts the threshold input to the analysis and decision layer, and optimizes the parameters to the data acquisition layer.

[0191] Overall architecture process: from behavioral data input - risk identification - protection triggering - status monitoring - feedback loop.

[0192] This architecture addresses the lag issue of existing passive defenses by enabling real-time loss mitigation through proactive labeling and isolation.

[0193] In this embodiment, the behavior analysis intelligent monitoring module (addressing the problem of inaccurate behavior recognition) analyzes user behavior in real time through multi-dimensional feature extraction to identify potential high-risk victims. The core algorithm employs a semi-supervised anomaly detection model, combining Isolation Forest and LSTM.

[0194] Data processing flow:

[0195] Input: Internal network log stream (such as IP access sequence, timestamp).

[0196] Feature extraction: Calculate behavior vectors, including frequency (number of visits / hour) and sequence bias (length of abnormal interaction chains).

[0197] Risk assessment: Calculating transient outlier scores using Isolation Forest. .

[0198] Where x represents the data sample to be detected; For path length, For the average path; E() represents the integrated average; if If the probability of LSTM predicting time series risk is greater than 0.6, then... (LSTM output).

[0199] Output: If >0.8, mark the IP and trigger protection.

[0200] Deep temporal fusion analysis improves identification accuracy: To address the problem of low identification accuracy (usually less than 85%) caused by the shallow behavior analysis of existing UEBA systems (such as relying on static rules), this invention introduces multi-dimensional temporal fusion technology, which integrates user behavior sequences (such as high-frequency logins and abnormal transfer operations), content semantics (such as keywords such as "safe account" and "high return"), and traffic fluctuation features. By modeling long-term behavior patterns through LSTM neural networks and combining Isolation Forest to detect instantaneous anomalies in real time, the risk identification accuracy is significantly improved to over 95% (a 23% improvement compared to traditional systems in actual tests), while the false alarm rate is reduced to less than 5%, effectively avoiding interference with normal users.

[0201] Dynamic IP Tagging and Tiered Real-Time Protection Mechanism to Address Lag: To solve the "intervention lag" problem commonly found in passive defense (average delay greater than 10 minutes), this invention constructs an automatic IP tagging-tiered triggering system: It utilizes network probes to analyze traffic in real time and match it against a malicious behavior rule base (such as illegal domain name access, frequency of sensitive operations), dynamically tags IPs based on a risk scoring formula, and implements tiered protection—low-risk (0.4 ≤ score < 0.6) triggers a pop-up warning; medium-risk (0.6 ≤ score < 0.8) restricts unnecessary applications and strengthens monitoring; high-risk (score ≥ 0.8) is immediately and forcibly isolated to a whitelisted security ecosystem; simultaneously, a strict self-tag time t is set. start Start 30 minutes (t) end = t start The protection window (+1800 seconds) automatically closes after the timeout to prevent excessive blocking. This mechanism reduces the delay of illegal intervention to less than 3 seconds, and actual tests have shown that it reduces the rate of financial loss by 70%.

[0202] Active blocking execution and closed-loop effect verification:

[0203] At the protection execution level, the system pushes the marked high-risk IPs to the protection engine in real time and updates the firewall ACL rules simultaneously, immediately redirecting users to the security service domain that only allows access to trusted applications whitelisted, thus achieving proactive blocking; its effectiveness is verified in real time through DPI deep analysis of traffic, and is supplemented by post-event transaction log analysis to confirm the reduction in losses, forming a complete protection chain from analysis, decision-making, execution to verification.

[0204] Application layer access control and whitelist mechanism module (solves the problem of insufficient whitelist coverage):

[0205] A mandatory whitelist is implemented, allowing access only to approximately 300,000 trusted addresses. Traffic is filtered using DPI, and dynamic ACL rules are maintained.

[0206] Workflow:

[0207] Input: User-requested URL.

[0208] Matching: Query the whitelist using the Trie tree. If there is no match, use the Levenshtein distance to calculate the similarity, and if it is less than 0.1, then block the connection.

[0209] Update: Automated scanning + manual review, updated daily.

[0210] This mechanism solves the problem of static whitelists by dynamically covering and adapting to the ecosystem, achieving a blocking rate of 98%.

[0211] Module for protection against false blocking and automatic deblocking (to resolve the problem of misjudgment interference):

[0212] The protection lasts for no more than 30 minutes and will be lifted upon network switching (IP change).

[0213] Calculate the probability of misjudgment and adaptively adjust the threshold.

[0214] Implementation: Timer + Netlink monitoring for IP changes, state machine management (normal - guardian - release).

[0215] To address over-protection, we use automated mechanisms to reduce user inconvenience and achieve a false blocking rate of less than 5%.

[0216] Practical logic integration and visualization module (solving overall coordination issues):

[0217] Process: Monitoring - Identification - Tagging - Isolation - Monitoring - Deactivation. Supports dashboard status display and AI feedback optimization.

[0218] like Figure 1 As shown, there is a risk: since the current method is executed through the source IP of the suspected victim, there may be changes in the IP correspondence, or one IP may correspond to one person or one organization.

[0219] The existing capabilities have limitations: 1) They can only target discovered URLs, and the time of the URL must be analyzed first; 2) There may be omissions in the discovery capabilities.

[0220] The advantages of this application method are: 1) It initiates protection based on the mobile phone IP of the suspected victim to avoid missed control; 2) It can specify the target and the degree of harm; and it can also be applied to fixed network scenarios.

[0221] This invention is primarily applied to intranet products of telecommunications operators, such as integration into mobile apps (e.g., the operator's official security app), gateway devices, or enterprise-level security platforms (e.g., telecommunications intranet protection systems). It provides proactive protection against illegal online activities for high-risk user groups (e.g., the elderly, internet novices). Application scenarios include encountering potential illegal risks during daily internet use (e.g., browsing social media, searching for information, or conducting online transactions), such as when a user clicks on suspicious investment links or frequently interacts with fraudulent advertisements. The system automatically intervenes in the background to prevent financial losses or information leaks. This invention is not limited to a single product and can be extended to smart routers, mobile security software, or cloud protection services, forming a hybrid model combining the user end and the backend.

[0222] 1. Functional characteristics;

[0223] Real-time behavior monitoring and risk identification: The system continuously monitors user network behavior (such as application access frequency and abnormal interaction). Once high-risk signs are detected (such as matching illegal keywords or abnormal login peaks), the user's IP is automatically marked and "Sunshine Guardian Mode" is activated.

[0224] The user is unaware of the feature, but optional notification functionality can be configured.

[0225] Proactive isolation and whitelist control: In protected mode, users are forcibly isolated into a secure ecosystem, only allowed access to pre-selected whitelisted applications and services, blocking unauthorized communication. This ensures that users cannot access high-risk content within a risk window (e.g., 30 minutes after detection) while maintaining basic functionality.

[0226] False blocking protection and automatic deactivation: Protection is strictly controlled to automatically deactivate within 30 minutes; if the user switches networks (e.g., from WiFi to mobile data, IP address change), the system immediately exits the mode. An integrated false alarm feedback mechanism allows users to report false blocking via the app to optimize the system.

[0227] Visual status display and feedback: Provides users with dashboards or notification bars to display protection status (such as "Sunshine Guardian Mode is activated, remaining time: 15 minutes"), and supports panoramic monitoring of high-risk user distribution and protection logs on the administrator side.

[0228] Compatibility and Expansion: Supports integration with Android / iOS mobile devices without additional hardware; seamlessly integrates with existing security apps, providing one-click enable / disable options.

[0229] 2. Operation method;

[0230] User actions are primarily passive (mainly protected by the background), but include a small amount of interaction to improve user-friendliness. The following explanation uses a hypothetical interaction process as an example:

[0231] Initial setup: After installing the operator's security app, users can authorize the "Sunshine Guardian" function with one click (UI interface: the homepage displays an "Enable Active Protection" button; clicking it will bring up permission instructions, including behavior monitoring and whitelist access). The system runs in the background by default and requires no daily intervention.

[0232] Risk Trigger and Protection Activation: When the system detects high-risk behavior (such as a user searching for "high-return investment" and clicking on an unknown link), the background system marks the IP address and activates the protection mode. User Interaction: An app push notification pop-up (e.g., "Potential risk detected, now in Sunshine Guardian mode, access restricted to secure applications only. Learn more?") allows users to view the whitelist.

[0233] During protection: When a user attempts to access content not on the whitelist, the browser or app displays a redirect page (e.g., "This link may be risky and has been blocked. Return to the safe zone?"), directing the user back to a whitelisted application. A countdown timer for the remaining time is displayed in the notification bar (UI: progress bar style, e.g., "Protection time remaining: 20 minutes").

[0234] Automatic deactivation and feedback: After timeout or network switch, a notification will be sent stating "Guardian mode has been deactivated and network has returned to normal." Users can report false blocking via the "Feedback" button in the app (UI: simple form "Was it a false alarm? Describe the behavior"), and the system will optimize the model accordingly.

[0235] Administrator interaction: Telecom operations and maintenance personnel can monitor through a web dashboard (UI: heat map showing the distribution of high-risk user IPs and bar chart of protection status), and manual intervention is supported (such as extending / removing protection for specific IPs).

[0236] Assuming a UI interaction diagram:

[0237] Homepage: The top displays "Sunshine Guardian: Real-time Protection", and the bottom buttons are "View Whitelist" and "Protection History".

[0238] Protection pop-up: Modal dialog box "Activation reason: Abnormal behavior detection", "Allowed applications: List", "Countdown: 29:59".

[0239] Feedback page: text box + submit button, integrated log preview.

[0240] These features and operations enable seamless protection on the product side, enhancing user security while minimizing disruption.

[0241] Hardware and software environment architecture: This system adopts a layered edge computing architecture, deploying traffic acquisition devices as edge nodes at core network nodes to form distributed processing capabilities. The hardware layer consists of dedicated DPI devices supporting 10Gbps throughput for deep traffic analysis. The software layer is based on Apache Kafka to build a real-time log pipeline, combined with a PyTorch-based LSTM+Isolation Forest dual-model analysis engine. The protection execution layer uses iptables (a stateful firewall) for dynamic ACL rule management. The management platform stores all logs through ElasticSearch (a distributed full-text search engine), and Grafana (an open-source data visualization tool) provides real-time monitoring dashboards.

[0242] like Figure 3 As shown, it includes the edge side, the computing side, and the control side.

[0243] The edge side includes user terminals, access switches, DPI probes, and firewalls.

[0244] Edge layer: Deploy DPI probes based on Suricata / DPDK to parse application layer information in network traffic in real time; at the same time, equip a firewall that supports Netfilter to enforce dynamic security rules.

[0245] The computing side includes a Kafka cluster and Flink compute nodes.

[0246] Computation layer: Composed of a Kafka cluster (processing capacity of over 100,000 messages / second), used to receive and process behavior logs; compute nodes are equipped with 32 CPU cores and 128GB of memory, running the Flink stream processing engine to perform risk model calculations.

[0247] The control side includes a protection engine, a database cluster, and a visualization server.

[0248] Control layer: The protection engine is deployed on an x86 server equipped with dual Intel Xeon Gold 6330 processors; the backend database uses Redis combined with a MySQL cluster to support business operations and store more than 300,000 whitelist records.

[0249] The various levels, components, and functions implemented in this embodiment.

[0250] Data Acquisition: Suricata / DPDK: Traffic Mirroring and Feature Extraction.

[0251] Stream processing: Kafka 3.4 + Flink 1.17: Real-time calculation of behavioral risk scores.

[0252] AI model: TensorFlow 2.12 + Scikit-learn: LSTM / Isolation Forest model.

[0253] Control layer: Netfilter API + Golang Hook: Dynamic firewall rule management.

[0254] Visualization: Grafana + ElasticSearch: Real-time monitoring of protection status.

[0255] like Figure 4 As shown, on the user side: when a user accesses illegal resources, the firewall redirects them to the blocking service and returns a customized page (displaying the remaining protection time, such as "Sunshine Guardian 28:15 remaining").

[0256] Management side: Administrators can monitor in real time through a visual dashboard.

[0257] Risk heatmap: Geographical distribution of high-risk IP density.

[0258] Dynamic countdown: Remaining protection time for each IP address.

[0259] False blocking rate curve: Statistical analysis of false judgments based on historical data.

[0260] In this embodiment, a user-unnoticed redirection technique is used to intercept response delays of less than 50ms.

[0261] like Figure 5 As shown, the background workflow is divided into four stages:

[0262] 1) Monitoring: DPI probes capture traffic and extract behavioral feature vectors.

[0263] 2) Decision: The behavioral analysis model (Isolation Forest + LSTM) calculates the risk probability and marks whether the IP is high-risk.

[0264] 3) Execution: The protection engine calls the Netfilter API to add rules.

[0265] 4) Disable: Automatically delete the rule when the 30-minute countdown ends or when an IP change is detected (such as switching from WiFi to 4G).

[0266] In this embodiment, dynamic rule injection technology is used, and the protection takes effect in no more than 200ms.

[0267] like Figure 6 As shown, data processing is divided into four stages:

[0268] 1) Data collection: DPI probes parse raw traffic and generate structured logs (processing 10Gb of traffic per second).

[0269] 2) Analysis: Fink window calculates feature vectors (window size 5 seconds), inputs them into the fusion model: IsolationForest to detect transient anomalies. LSTM analyzes temporal patterns (such as high-frequency access to the "transfer" page).

[0270] 3) Execution: The whitelist engine uses a Trie tree to match 300,000+ domain names (latency <1ms).

[0271] 4) Disable: Timer service monitoring protection status, Netlink Socket listens for IP change events.

[0272] In this embodiment, a two-stage matching process using a Trie tree and a Bloom filter is employed, resulting in a query efficiency of O(log n).

[0273] like Figure 7 As shown, features are extracted based on the original traffic and input into the fusion model. Then, Isolation Forest is performed to calculate the instantaneous anomaly score. At the same time, the temporal probability is obtained based on LSTM. The instantaneous anomaly score and the temporal probability are weighted and calculated to determine whether S is greater than 0.8. If so, protection is triggered; otherwise, it is released.

[0274] likeFigure 8 As shown, the state machine defines three core states:

[0275] Normal state: User behavior does not trigger the risk threshold.

[0276] Guardian mode: Enables whitelist isolation and activates two release triggers: countdown trigger (hard limit of 30 minutes); IP change listener (immediately evaluates new IPs upon detection).

[0277] Released: Clears firewall rules and releases user connections.

[0278] In this embodiment, the dual-trigger mechanism ensures that 99.9% of users' isolation time does not exceed the actual risk window.

[0279] This system uses an event-driven approach to transition between these three states, enabling dynamic isolation and intelligent deactivation of high-risk users. The specific execution process is as follows:

[0280] 1. Normal state;

[0281] 1) Condition: User behavior does not trigger the risk threshold (i.e., risk score R < 0.8).

[0282] 2) Behavior: The system continuously monitors user behavior but does not impose any access restrictions.

[0283] 3) Event listening: Started without a timer or Netlink listener.

[0284] 2. Guardian status;

[0285] 1) Triggering condition: When the user's behavior risk score R≥0.8, the system marks it as a high-risk IP, and the state machine changes from normal to guard state.

[0286] 2) Perform the action:

[0287] Start the 30-minute timer to begin the countdown.

[0288] Start the Netlink listener to monitor in real time whether the user's IP address changes (such as switching from WiFi to 4G).

[0289] Firewall rules are issued via the Netfilter API to isolate users into a whitelisted security ecosystem.

[0290] 3) Event Listening:

[0291] Countdown event: 30-minute timer.

[0292] IP Change Event: Netlink detected an IP change.

[0293] False blocking rate monitoring: The false blocking rate is calculated every 5 seconds. If the false blocking rate is greater than 0.5, early release is triggered.

[0294] 3. Deactivate status;

[0295] 1) Triggering conditions (any one of them needs to be met):

[0296] Timer expired: 30-minute countdown ended.

[0297] IP Change: Netlink detected a change in the user's IP address.

[0298] High false blocking rate: Real-time monitoring detected a false blocking rate greater than 0.5, triggering early release.

[0299] 2) Perform the action:

[0300] Delete the firewall ACL rule corresponding to this IP address.

[0301] Stop the timer and Netlink listener.

[0302] Record the reason for lifting the ban (timeout / IP change / accidental blocking).

[0303] The state machine transitions from the guardian state to the deactivated state, and the user returns to the normal state.

[0304] 3) Follow-up processing: After the problem is resolved, the user will have normal network access, and the system will continue to monitor their behavior.

[0305] like Figure 9 As shown, this sequence diagram details the entire process of the system from activating protection to dynamic deactivation, and finally completing closed-loop optimization, involving the collaborative work of multiple service modules. The entire false blocking protection mechanism process is divided into four main stages:

[0306] Phase 1: Initial protection activated;

[0307] 1. Trigger detection: The user's device exhibits high-risk behavior (e.g., frequent access to investment-related pages).

[0308] 2. Reporting and Analysis: Behavioral data is sent to the behavior analysis module. This module calculates the risk and determines it to be extremely high (risk value = 0.92 in the example, which is greater than 0.8), and sends a high-risk report to the protection engine.

[0309] 3. Isolation Execution: Upon receiving the report, the protection engine immediately sends an instruction to the firewall control module to add a rule, isolating the user's IP address to the whitelist. The user's device access is blocked, and a customized blocking page is displayed, showing a countdown to inform the user of the remaining protection time.

[0310] 4. Start Monitoring: The protection engine simultaneously sends a command to the timer service to start a 30-minute countdown. The protection engine also registers with the IP listening service to monitor the user's IP address in real time, in order to detect IP change events such as network switching.

[0311] Phase Two: Behavioral Monitoring During the Protection Period;

[0312] 1. Continuous monitoring: During the protection period, the user device's behavior data is continuously reported to the behavior analysis module.

[0313] 2. Calculate the false ban rate: The behavior analysis module calculates the real-time false ban probability (P) of the current user every 5 seconds.

[0314] Calculation formula: P = (Number of normal behaviors / Total number of behaviors) × (1 - Time used / 30).

[0315] Calculation logic: This formula takes into account both the normalization trend of user behavior and the consumption of protection time. As user behavior returns to normal and protection time increases, the false ban probability P will gradually increase.

[0316] Example values: The P-value may rise from 0.15 in the early stage to 0.35 in the middle stage, and then to 0.62 in the later stage.

[0317] Phase Three: Dynamic Response and Resolution Strategies;

[0318] The system will automatically disable protection in three situations based on monitoring results:

[0319] Scenario 1: The false positive rate is too high (P > 0.5);

[0320] 1. When the P-value calculated by the behavior analysis module exceeds the threshold of 0.5 (0.62 in the example), it will immediately send a "remove false block" command to the protection engine.

[0321] 2. Engine protection will:

[0322] Inform the firewall to delete the rule and restore the user's network access.

[0323] The notification timer service has been canceled for the countdown.

[0324] Notify the IP monitoring service to cancel monitoring of this IP.

[0325] Record the characteristics of this wrongful blocking incident and dynamically adjust the risk threshold according to the algorithm (e.g., θ=θ-0.1*P) to make the system more cautious in the future.

[0326] Scenario 2: Network switching (IP change) detected;

[0327] 1. When the IP monitoring service detects a change in a user's IP address (e.g., from 192.168.1.100 to 10.20.30.40), it immediately notifies the protection engine.

[0328] 2. The protection engine will forcibly disable protection, following the same process as above: restore access, stop timing, and cancel monitoring. This is because an IP change usually means that the user's network environment has changed, and the original risk may no longer exist.

[0329] Scenario 3: Timer times out;

[0330] 1. When the 30-minute countdown ends, the timer service will notify the protection engine.

[0331] 2. The protection engine executes a standard deactivation process: delete the firewall rules, restore access, and disable IP monitoring. This is a hard time limit for protection, ensuring users are not isolated indefinitely.

[0332] Phase Four: Subsequent Optimization;

[0333] 1. Data Collection: The protection engine sends detailed characteristic data of mistakenly blocked events to the behavior analysis module.

[0334] 2. Model Iteration: The behavior analysis module utilizes this feedback data:

[0335] Update model parameters: Reverse train models such as LSTM to optimize their feature weights.

[0336] Adjust decision threshold: Based on historical false blocking cases, dynamically reduce the risk threshold (e.g., from 0.75 to 0.68) to make the system less prone to misjudgment in subsequent judgments, thus achieving closed-loop optimization.

[0337] In this embodiment, the relevant model algorithm is as follows:

[0338] 1. Behavioral analysis and risk identification model;

[0339] Model type: Semi-supervised anomaly detection model, combining Isolation Forest and RNN (Recurrent Neural Network, such as LSTM).

[0340] Workflow:

[0341] Input: User behavior data stream (IP logs, access sequences, timestamps).

[0342] Feature extraction: Calculating vectors, such as behavioral feature vectors. Specifically:

[0343] .

[0344] Risk assessment: Isolation Forest is used to calculate the instantaneous anomaly score. If the anomaly score is greater than the threshold, LSTM is used to predict the sequence risk and output the high-risk probability.

[0345] Output: Risk label and IP tag signal, triggering "Sunshine Guardian" mode.

[0346] Training / Optimization: Using a historical illegal dataset (semi-supervised labels), an LSTM is trained using the Adam optimizer, and hyperparameter tuning is performed via grid search. The document "illegal labels" are used as prior knowledge.

[0347] In this embodiment, high-dimensional time-series data is processed efficiently, and online updates are supported to adapt to new patterns. The time complexity is O(nlogn).

[0348] 2. Whitelist access control model;

[0349] Model type: The rule engine combines a fuzzy matching model, using Trie trees and FuzzyLogic.

[0350] Workflow:

[0351] Input: User request (such as URL or application ID).

[0352] Query matching: The whitelist is quickly retrieved using a Trie tree. If no match is found, fuzzy logic is used to calculate the similarity (Levenshtein distance).

[0353] Control decision: If a match is found, allow passage; otherwise, block and log. Integrated time window check.

[0354] Output: Access permission / blocking signal.

[0355] Training / Optimization: The whitelist is statically built, and dynamic optimization is achieved through feedback learning. The fuzzy threshold is set using ROC curves.

[0356] In this embodiment, the query latency is less than 1ms, it supports large-scale whitelists, and reduces false positives. It is suitable for application layer control.

[0357] 3. Protection status management and deactivation model;

[0358] Model type: Finite state machine (FSM) combined with event-driven model.

[0359] Workflow:

[0360] Status definitions: Normal, Guardian, Deactivated.

[0361] Conversion rules: From Normal to Guard (risk triggered), Guard to Deactivate (timeout or network switch).

[0362] Event monitoring: Real-time monitoring of time t (≤30min) and network changes (ΔIP).

[0363] Output: Status update signals and logs.

[0364] Training / Optimization: Unsupervised, rule-based. Optimization involves adjusting the transition probabilities through simulated testing.

[0365] In this embodiment, it is simple and reliable, supports asynchronous event processing, and integrates false blocking protection to calculate the false judgment rate.

[0366] These models can be implemented using Python / TensorFlow.

[0367] The relevant algorithm in this embodiment is:

[0368] 1. Risk probability calculation algorithm: based on Bayesian network model;

[0369] Description: Quantifies the probability that a user's behavior matches illegal characteristics, used for IP tagging.

[0370] Derivation and Application: By approximating Bayesian inference using the Evidence Lower Bound (ELBO), if the risk probability > 0.8, the IP is marked and enters the "Sunshine Guardian" mode. Threshold Optimization: Gradient descent is used to minimize the cross-entropy loss.

[0371] Complexity: O(n), where n is the number of features. Applications: Real-time scoring, integrating prior information to adjust for illegal document tags.

[0372] 2. Anomaly Isolation Score Algorithm: An extension of Isolation Forest;

[0373] Description: Isolate high-risk behavioral pathways for rapid detection.

[0374] Derivation and Application: Randomly split trees isolate outliers; a score less than 0.5 triggers protection. Extension to Temporal Sequence: Incorporate LSTM hidden states as input. Optimization: The number of trees is selected by minimizing variance.

[0375] Application: Processing document behavior patterns, outputting data for whitelist triggering.

[0376] 3. Time window optimization algorithm: dynamic threshold adjustment;

[0377] Description: Ensure protection lasts no more than 30 minutes and calculate the probability of false blocking.

[0378] Derivation and Application: Gradient descent is used to optimize the threshold, supporting network handover detection (the handover is lifted when ΔIP exceeds the threshold). An integrated document protection mechanism is also included.

[0379] Application: Adaptive deactivation reduces user interference.

[0380] This invention introduces the concept of a "Sunshine Guardian Mode" to achieve proactive protection against illegal network activities based on behavioral analysis. The core idea is to combine intelligent monitoring with advanced intervention: First, real-time behavioral analysis (such as access frequency and abnormal interaction sequences) identifies high-risk victims and automatically tags their internal network IP addresses; second, within a critical time window, application-layer whitelist control is enforced, allowing access only to core applications that have undergone security assessment, thereby isolating users from the secure digital ecosystem and blocking illegal communication links with remote illegal sources. Simultaneously, it integrates false blocking protection (e.g., protection lasting no more than 30 minutes, lifted upon network switching) to ensure efficient intervention with minimal interference. Because of the passive and low-precision nature of existing technologies, this invention integrates machine learning models (such as anomaly detection algorithms) and state management mechanisms to form a proactive and precise solution for preventing illegal network activities, ultimately reducing the risk to high-risk users and achieving the goal of minimizing losses.

[0381] This invention solves the problem of lag in existing passive detection by combining behavior analysis and real-time IP tagging, achieving an intervention time of less than 1 minute and increasing the loss prevention rate by 80%.

[0382] By using a dynamic DPI whitelist, the problem of insufficient coverage of existing static whitelists is solved, achieving a 98% blocking rate for illegal communication and a 95% adaptability rate.

[0383] By using a time window and network switching to remove the block, the problem of high false positives and lack of automatic removal in existing technical solutions is solved, achieving a false block rate of less than 5% and a user satisfaction rate of more than 90%.

[0384] By fusing LSTM and Isolation Forest, the problem of insufficient precise intervention is solved, achieving an identification accuracy of 95% and a risk reduction of 70%.

[0385] To verify the effectiveness of this invention, a 10-day comparative experiment was conducted in a real-world environment of a telecommunications operator. The experiment compared the system of this invention (experimental group) with existing mainstream UEBA systems (control group), covering over 1 million users. Key experimental results are as follows:

[0386] I. Experimental Setup;

[0387] 1. Dataset: One month of real, anonymized user behavior data (including labeled high-risk and normal events) is used as the training and testing set.

[0388] 2. Evaluation indicators: accuracy of high-risk user identification, false blocking rate, intervention delay, system throughput, and user complaint rate.

[0389] 3. Baseline comparison: Existing commercial UEBA system (based on rule engine + static threshold).

[0390] II. Experimental Results and Data Analysis;

[0391] 1. Significantly improved accuracy in behavior recognition;

[0392] The present invention (Isolation Forest + LSTM fusion model) achieved an accuracy of 96.2% and a recall of 94.8% on the test set.

[0393] The control group (traditional rule engine) had an accuracy of 83.5% and a recall of 79.1%.

[0394] Analysis: The multi-dimensional temporal fusion model of this invention has a stronger ability to capture complex and hidden illegal behavior patterns, and the accuracy is improved by about 12.7%.

[0395] 2. Extremely low delay in proactive intervention;

[0396] From risk identification to the issuance of ACL rules to complete isolation, the average latency of this invention is 180ms (P99<200ms).

[0397] In the control group, the average delay from alarm generation to manual intervention by the administrator was 8.5 minutes.

[0398] Analysis: The real-time rule distribution mechanism based on the Netfilter API reduces the intervention time from "minutes" to "milliseconds", achieving true "proactive" protection.

[0399] 3. Improved false ban rate and user satisfaction;

[0400] The false sealing rate of this invention remained stable at 0.45% during the experiment. The false sealing rate of the control group was approximately 5.2%.

[0401] User satisfaction surveys showed that the experimental group users' satisfaction rating for the protective measures was 4.7 / 5.0, which was much higher than the control group's 3.0 / 5.0.

[0402] Analysis: The dynamic false blocking protection mechanism (dual-trigger release + real-time probability calculation) effectively protects the rights and interests of normal users and greatly reduces excessive protection.

[0403] 4. The system performance supports large-scale deployment;

[0404] On a single node (32-core CPU, 128GB memory), the system of this invention can process 10Gbps network traffic in real time and process more than 2 billion behavioral events per day.

[0405] Resource consumption: The Trie tree and Bloom filter structure reduces the memory usage of whitelist queries by 65%, and keeps the query performance within 0.8ms.

[0406] Analysis: The distributed architecture and efficient algorithm design enable the system to be deployed on a large scale at the telecom grade, while significantly reducing hardware costs.

[0407] III. Conclusion;

[0408] Based on the above experimental verification and analysis, the following conclusions can be drawn:

[0409] 1. Effectiveness has been proven: The dynamic ACL proactive protection method and system based on behavior analysis proposed in this invention are significantly superior to existing technologies in core indicators such as high-risk user identification accuracy, real-time intervention, and false blocking control.

[0410] 2. Practical and advanced: The system successfully solves the three major industry pain points mentioned in the background technology: "lagging passive defense", "insufficient whitelist coverage" and "serious misjudgment interference". Through a complete closed loop of "accurate identification - active isolation - intelligent deactivation - closed-loop optimization", it achieves maximum security protection with minimal user interference.

[0411] 3. Possesses large-scale application prospects: Experiments have proven that the system has excellent performance and low resource consumption, and can effectively support the large-scale deployment of telecommunications networks with tens of millions of users. It has broad application prospects in fields such as finance and the Internet of Things that have high requirements for real-time risk control.

[0412] Example 2

[0413] The difference from Embodiment 1 is that the present invention proposes alternative implementations of some key modules in Embodiment 1:

[0414] 1. Behavioral analysis and intelligent monitoring module;

[0415] Alternative 1: Graph Neural Network (GNN) instead of LSTM.

[0416] Principle: User behavior is abstracted into a heterogeneous graph (nodes = users / applications, edges = interaction frequency), and illegal patterns in the group are detected by aggregating multi-hop neighbor information through GNN.

[0417] Advantages: It solves the problem of LSTM's insufficient capture of related behaviors and is suitable for illegal detection of social engineering.

[0418] Alternative 2: Federated learning model.

[0419] Principle: User data is processed locally, and only the model gradient is uploaded to the central node for aggregation, thus protecting privacy.

[0420] Advantages: Complies with GDPR requirements and is suitable for multinational telecom operators.

[0421] 2. IP tagging and protection triggering module;

[0422] Alternative Solution 1: SDN (Software-Defined Networking) centralized control.

[0423] Principle: Dynamically distribute flow table rules to switches via the OpenFlow protocol, replacing kernel-level Netfilter hooks.

[0424] Advantages: Supports unified policy management across regional networks, suitable for cloud-network converged architectures.

[0425] Alternative Solution 2: Blockchain-based evidence storage and marking;

[0426] Principle: High-risk IP address information is uploaded to the blockchain (such as Hyperledger Fabric) to ensure tamper-proof protection and audit traceability.

[0427] Advantages: Enhances judicial evidence collection capabilities.

[0428] 3. Whitelist control module;

[0429] Alternative Solution 1: Dynamic Reasoning Based on Knowledge Graphs.

[0430] Principle: Construct an application trust graph (entities = domain name / developer, relationships = security authentication / user evaluation) and calculate the trust score in real time.

[0431] Advantages: Covers long-tail applications and solves the problem of insufficient static coverage of Trie trees.

[0432] Alternative Solution 2: Edge caching for acceleration;

[0433] Principle: Deploy a lightweight whitelist cache on the base station side to reduce central query latency.

[0434] Advantages: Applicable to rural / weak network areas, matching latency reduced from 1ms to 0.2ms.

[0435] 4. Accidental sealing protection module;

[0436] Alternative Solution 1: Dynamic parameter tuning using reinforcement learning.

[0437] Principle: Construct a DQN (Deep Q-Network) model, using the false positive rate plus the number of user complaints as the reward function to automatically optimize the protection duration.

[0438] Advantages: Adapts to different users' risk tolerance levels, and the protection time is dynamically adjusted (10-45 minutes).

[0439] Alternative Option 2: Multifactor biometric verification;

[0440] Principle: When the protection is triggered, the user is required to perform voiceprint / face verification. If the verification is successful, the protection is immediately lifted.

[0441] Advantages: It can replace single IP change detection and is suitable for fixed IP scenarios (such as corporate intranets).

[0442] In this embodiment, both horizontally and vertically, other application scenarios applicable to this application include:

[0443] 1. Financial sector;

[0444] Scenario adaptation: Replace "high-risk users" with "suspicious transaction accounts" and change "whitelist" to "trusted transaction channels".

[0445] Behavioral analysis focuses on abnormal transfer patterns (such as short-term fund aggregation across multiple accounts).

[0446] Innovative reuse: A proactive 30-minute blocking window prevents money laundering transactions, and accidental blocking protection avoids the accidental freezing of legitimate accounts.

[0447] 2. Security protection for IoT devices;

[0448] Scene adaptation:

[0449] Target devices: smart home devices (such as cameras), industrial sensors.

[0450] Behavioral analysis: Detects abnormal data uploads (such as continuous transmission of encrypted traffic to unknown IPs).

[0451] Innovative reuse: Device-level whitelist (only allowing access to the manufacturer's cloud platform), automatically removed when switching networks (SIM card change).

[0452] 3. Secure isolation of cloud desktops;

[0453] Scenario adaptation: Isolation is triggered when employees access high-risk websites in an enterprise cloud desktop environment.

[0454] Innovative reuse: Application-layer whitelist control (allowing access only to enterprise OA / CRM systems), and DPI deep analysis of RDP traffic.

[0455] Extended variants of the core technology are shown in Table 1 below.

[0456] Table 1 Extended Variants

[0457]

[0458] The technical effects of the alternative solutions are compared in Table 2 below.

[0459] Table 2 Comparison of Technical Effects

[0460]

[0461] This invention breaks away from the traditional passive defense model, pioneering a closed-loop protection logic of "behavior triggering - real-time isolation - window release," employing the following method:

[0462] 1. Active protection mechanism design:

[0463] 1) Real-time identification of high-risk behaviors based on dual-model fusion (Isolation Forest + LSTM).

[0464] 2) Dynamic IP tagging system: Risk scoring formula enables tiered protection (low-risk early warning / medium-risk access restriction / high-risk isolation).

[0465] 3) Forced cancellation within a time window: A double-insurance mechanism that is fixed at a maximum of 30 minutes and automatically canceled when switching networks (changing IP addresses).

[0466] 2. Dynamic control of a whitelist with hundreds of millions of entries:

[0467] Technological Breakthrough:

[0468] 1) A two-level index structure of Trie tree + Bloom filter enables millisecond-level matching of 300,000+ trusted addresses (latency <1ms).

[0469] 2) Fuzzy matching algorithm: Levenshtein distance is used to calculate similarity (threshold < 0.1 blocks), which solves the problem of long-tail application coverage.

[0470] 3) Automated rolling updates: A dynamic whitelist ecosystem with daily scanning and manual review.

[0471] 3. Accidental sealing protection system:

[0472] Core Algorithm:

[0473] 1) Real-time calculation of the probability of false sealing.

[0474] 2) Dynamic threshold adjustment model.

[0475] 3) State machine-driven deactivation: Triple trigger conditions (behavior normalization / P>0.5, network switching, countdown end)

[0476] 4. High-performance architecture implementation (hardware-level optimization):

[0477] 1) 10Gbps traffic processing accelerated by DPDK (Suricata probe).

[0478] 2) Distributed stream computing: Kafka throughput ≥ 100K msg / s + Flink window analysis (P99 latency ≤ 100ms).

[0479] 3) Rule-through injection: Netfilter kernel hooks enable protection to take effect in ≤200ms.

[0480] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A proactive network risk protection method based on behavioral analysis using dynamic ACLs, characterized in that: Includes the following steps: S1: Data collection, real-time analysis of network traffic through DPI probe, extraction of user application access logs, interaction sequences and IP traffic data; S2: Based on behavioral analysis models, conduct behavioral analysis and high-risk identification; S21: Extract features from the collected data to generate behavioral feature vectors; S22: Input the extracted behavioral feature vector into the fusion model, use the isolated forest anomaly detection algorithm to detect instantaneous anomaly scores, and use LSTM to analyze the time series pattern and calculate the time series probability; S3: Based on Bayesian networks, risk scores are obtained by combining the instantaneous anomaly scores and temporal probabilities from S2, thereby enabling IP tagging; S4: Dynamic whitelist isolation, based on the network filter application programming interface, to deliver firewall rules in real time; S5: Protection status monitoring and automatic deactivation; S6: Closed-loop optimization: collect protection logs and false blocking events through a visual dashboard, reverse train the LSTM model, adjust feature weights and risk thresholds, and update the whitelist database daily.

2. The network risk dynamic ACL proactive protection method based on behavior analysis according to claim 1, characterized in that: In S21, the specific implementation details are as follows: The formula for calculating the behavioral feature vector is: ， in, Represents a behavioral feature vector; Indicates visit rate; Indicates the rate of abnormal keywords; This indicates fluctuations in traffic flow.

3. The network risk dynamic ACL proactive protection method based on behavior analysis according to claim 1, characterized in that: In S22, the isolated forest anomaly detection algorithm is used to calculate the instantaneous anomaly score, specifically as follows: The formula for calculating the instantaneous anomaly score s(x) is as follows: ， ， Where x represents the data sample to be detected; Indicates path length. Indicates the integrated average. γ represents the normalization term; m represents the subsample size; γ represents the Euler constant.

4. The network risk dynamic ACL proactive protection method based on behavior analysis according to claim 1, characterized in that: In S22, LSTM is used to analyze user behavior time series patterns and predict time series probabilities. The specific content is as follows: The LSTM model takes a temporal sequence consisting of historical behavior feature vectors as input, extracts temporal features through a gating mechanism, and outputs the final hidden state. ; The time series sequence X is: ， Time series probability The calculation formula is: ， in, This represents the behavioral feature vector at time point tT. This represents the behavioral feature vector at time point t-1, where t represents the current time point; T represents the size of the time window; and σ represents the Sigmoid function. and Indicates model parameters; This represents the final hidden state of the LSTM model at time t-1.

5. The network risk dynamic ACL proactive protection method based on behavior analysis according to claim 1, characterized in that: In S3, the specific implementation details are as follows: Posterior probability The calculation is based on Bayes' theorem, specifically: ， ， ， ， in, Represents the eigenvector; Represents prior probability; Represents the likelihood ratio; Indicates the probability of evidence; This indicates the number of high-risk users in historical data; This represents the total number of users in the historical data. Representing the eigenvector The i-th feature component in the vector; n represents the dimension of the feature vector; This represents the mean of the i-th feature component obtained from historical high-risk user data; This represents the variance of the i-th feature component obtained from historical high-risk user data. This indicates that the feature vectors observed are under conditions of normal user behavior. The likelihood probability; This represents the prior probability that the user's behavior is normal.

6. The network risk dynamic ACL proactive protection method based on behavior analysis according to claim 5, characterized in that: In S3, the risk score is calculated by fusing instantaneous anomaly scores with time-series probabilities, and the formula is as follows: ， in, This indicates the final risk score; Indicates the instantaneous anomaly score; α represents the time series probability; α and β both represent weighting coefficients.

7. The network risk dynamic ACL proactive protection method based on behavior analysis according to claim 1, characterized in that: In S4, the specific implementation process is as follows: S41: Rule distribution: After receiving high-risk IPs, the protection enforcement layer distributes firewall rules to the network filter application programming interface. S42: Whitelist matching. When a user initiates an access request, it is first filtered by a Bloom filter. If a match is found, a precise query is performed on the Trie tree. If the match is successful, the request is allowed; otherwise, a fuzzy match is performed. S43: Fuzzy blocking. Calculate the edit distance between the requested URL and the whitelisted address. If the similarity is less than the set threshold, return a customized blocking page and record the blocking log.

8. The network risk dynamic ACL proactive protection method based on behavior analysis according to claim 1, characterized in that: In S5, the specific details of protection status monitoring and automatic deactivation are as follows: S51: State initialization, after marking high-risk IPs, the state machine transitions from normal to guardian mode, and a 30-minute timer and Netlink monitoring are started; S52: Real-time monitoring, calculates the false blocking rate every 5 seconds. If the false blocking rate is greater than 0.5, triggers the early release logic and deletes the ACL rule. S53: Automatic release. If the timer times out or Netlink detects an IP change, the state machine transitions to release, restoring normal network access for the user and recording the reason for release.

9. A network risk dynamic ACL proactive protection system based on behavior analysis, implementing the network risk dynamic ACL proactive protection method based on behavior analysis as described in any one of claims 1 to 8, characterized in that: It includes a data acquisition layer, an analysis and decision-making layer, a protection execution layer, and a monitoring and feedback layer; Data Acquisition Layer: Collects intranet user behavior data in real time, including application access logs, interaction sequences, and IP traffic data, and supports distributed log collection; Analysis and Decision Layer: Based on user behavior data from the data collection layer, integrate machine learning models to detect abnormal behavior, calculate risk probabilities, and trigger IP tagging; Protection Execution Layer: Based on risk labeling instructions from the analysis and decision-making layer, application layer whitelist control and time window isolation mechanism, and DPI technology-based traffic filtering; Monitoring and feedback layer: Based on the protection status data of the protection execution layer, it performs log backtracking and adaptive optimization, and supports false blocking protection and automatic unblocking.

Images